ace-assign 0.71.0 → 0.73.0

data/lib/ace/assign/authority/maintenance_workspace_retirement.rb

@@ -1,229 +0,0 @@
-# frozen_string_literal: true
-require_relative "../molecules/execution_scope_lineage"
-require "json"
-
-module Ace
-  module Assign
-    module Authority
-      # Source capabilities only. A serialized descriptor is not admission.
-      module MaintenanceWorkspaceRetirement
-        SCHEMA = "ace.maintenance-workspace-retirement/v1"
-        TARGET_FIELDS = %w[project_id mapping_id assignment_id attempt_id resource journal_commit binding_event_digest release_event_digest descriptor_sha256].freeze
-        INVOCATION_FIELDS = %w[request_id input_digest operation_owner_binding_digest dispatch_event_digest].freeze
-        REFERENCES = {
-          "captured" => %w[intent captured preservation],
-          "removed" => %w[intent captured preservation removal fence],
-          "completed" => %w[intent captured preservation removal fence receipt]
-        }.freeze
-
-        def self.immutable(value)
-          case value
-          when Hash then value.to_h { |key, item| [key.dup.freeze, immutable(item)] }.freeze
-          when Array then value.map { |item| immutable(item) }.freeze
-          when String then value.dup.freeze
-          else value.freeze
-          end
-        end
-
-        def self.unavailable!(message)
-          raise AttemptErrors::EvidenceUnavailable, message
-        end
-
-        class Evidence
-          attr_reader :descriptor, :owner
-
-          # Only the installed adapter mints this after validating its complete
-          # collection. Consumers additionally bind the exact adapter instance,
-          # original canonical projection and held operation before using it.
-          def self.mint!(owner:, descriptor:)
-            new(owner: owner, descriptor: descriptor)
-          end
-          private_class_method :new
-
-          def initialize(owner:, descriptor:)
-            @owner = owner
-            MaintenanceWorkspaceRetirement.unavailable!("retirement evidence descriptor is not an object") unless descriptor.is_a?(Hash)
-            @descriptor = MaintenanceWorkspaceRetirement.immutable(descriptor)
-            @thread = Thread.current
-            @consumption = nil
-            @expired = false
-            validate_descriptor!
-          rescue KeyError, TypeError, ArgumentError
-            MaintenanceWorkspaceRetirement.unavailable!("retirement evidence descriptor differs")
-          end
-
-          def verify!(owner:, target:, projection:, phase:, deadline:)
-            unless !@expired && @thread.equal?(Thread.current) && @owner.equal?(owner) && descriptor.fetch("target") == target &&
-                descriptor.fetch("phase") == phase && descriptor.fetch("resource") == projection.fetch("workspace_resource")
-              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence original owner or selection differs")
-            end
-            identities = projection.fetch("resource_identities")
-            root = projection.fetch("worker_cwd")
-            expected = projection.fetch("parent_resource_declarations").filter_map do |declaration|
-              path = declaration.fetch("host_path")
-              next unless declaration.fetch("stage") == "parent" && (path == root || path.start_with?(root + "/"))
-              matches = identities.select { |row| row.values_at("host_path", "view_path") == declaration.values_at("host_path", "view_path") }
-              MaintenanceWorkspaceRetirement.unavailable!("retirement declared row has no unique original identity") unless matches.one?
-              matches.first
-            end.sort_by { |row| row.values_at("host_path", "view_path") }
-            unless descriptor.fetch("covered_resources").map { |row| row.fetch("original") } == expected
-              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence covered resources are not exhaustive")
-            end
-            @owner.verify_retirement_evidence!(evidence: self, projection: projection, deadline: deadline)
-            true
-          end
-
-          def expire! = @expired = true
-
-          def covered_resource(path)
-            descriptor.fetch("covered_resources").find { |entry| entry.fetch("original").fetch("host_path") == path }
-          end
-
-          def verify_consumption!
-            unless !@expired && @consumption && @thread.equal?(Thread.current)
-              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence is outside its held observation")
-            end
-            true
-          end
-
-          def with_consumption(verification)
-            MaintenanceWorkspaceRetirement.unavailable!("retirement observation cannot be nested") if @consumption
-            installed = true
-            @consumption = verification
-            verify_consumption!
-            verification.call
-            result = yield
-            verify_consumption!
-            verification.call
-            result
-          ensure
-            @consumption = nil if installed
-          end
-
-          private
-
-          def validate_descriptor!
-            fields = %w[schema phase target resource covered_resources invocation refs]
-            target = descriptor.fetch("target")
-            invocation = descriptor.fetch("invocation")
-            phase = descriptor.fetch("phase")
-            unless descriptor.keys.sort == fields.sort && descriptor.fetch("schema") == SCHEMA && REFERENCES.key?(phase) &&
-                target.is_a?(Hash) && target.keys.sort == TARGET_FIELDS.sort &&
-                invocation.is_a?(Hash) && invocation.keys.sort == INVOCATION_FIELDS.sort
-              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence is not a closed supported descriptor")
-            end
-            resource!(descriptor.fetch("resource"))
-            unless target.fetch("resource") == "workspace:#{target.fetch('project_id')}:#{target.fetch('mapping_id')}:#{target.fetch('assignment_id')}" &&
-                %w[project_id mapping_id assignment_id attempt_id].all? { |key| token?(target[key]) } &&
-                target.fetch("journal_commit").is_a?(String) && target.fetch("journal_commit").match?(/\A[0-9a-f]{40}\z/) &&
-                %w[binding_event_digest release_event_digest descriptor_sha256].all? { |key| digest?(target[key]) } &&
-                token?(invocation.fetch("request_id")) && (INVOCATION_FIELDS - ["request_id"]).all? { |key| digest?(invocation[key]) }
-              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence selectors differ")
-            end
-            covered = descriptor.fetch("covered_resources")
-            unless covered.is_a?(Array) && covered.size.between?(1, 64)
-              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence covered inventory differs")
-            end
-            covered.each do |entry|
-              unless entry.is_a?(Hash) && entry.keys.sort == %w[captured_host_path original] && path?(entry["captured_host_path"])
-                MaintenanceWorkspaceRetirement.unavailable!("retirement evidence covered row differs")
-              end
-              resource!(entry.fetch("original"))
-            end
-            unless covered.map { |entry| entry.fetch("original") }.uniq.size == covered.size &&
-                covered.map { |entry| entry.fetch("captured_host_path") }.uniq.size == covered.size
-              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence covered rows repeat")
-            end
-            roots = covered.select { |entry| entry.fetch("original") == descriptor.fetch("resource") }
-            unless roots.one? && covered.all? { |entry|
-                original = entry.fetch("original").fetch("host_path")
-                root = descriptor.fetch("resource").fetch("host_path")
-                (original == root || original.start_with?(root + "/")) &&
-                  entry.fetch("captured_host_path") == roots.first.fetch("captured_host_path") + original.delete_prefix(root) }
-              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence captured paths do not match exact relative resources")
-            end
-            refs = descriptor.fetch("refs")
-            unless refs.is_a?(Hash) && refs.keys.sort == REFERENCES.fetch(phase).sort
-              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence reference set differs")
-            end
-            refs.each_value do |ref|
-              unless ref.is_a?(Hash) && ref.keys.sort == %w[bytes path sha256] && path?(ref["path"]) && digest?(ref["sha256"]) &&
-                  ref["bytes"].is_a?(Integer) && ref["bytes"].between?(1, 64 * 1024 * 1024)
-                MaintenanceWorkspaceRetirement.unavailable!("retirement evidence reference differs")
-              end
-            end
-          end
-
-          def token?(value) = value.is_a?(String) && value.match?(/\A[A-Za-z0-9][A-Za-z0-9._:-]{0,127}\z/)
-          def digest?(value) = value.is_a?(String) && value.match?(/\A[0-9a-f]{64}\z/)
-          def path?(value)
-            value.is_a?(String) && value.valid_encoding? && value.bytesize.between?(1, 4096) &&
-              value.start_with?("/") && !value.include?("\0") && File.expand_path(value) == value
-          end
-          def resource!(value)
-            unless value.is_a?(Hash) && value.keys.sort == Molecules::ExecutionScopeLineage::RESOURCE_FIELDS.sort &&
-                %w[host_path view_path].all? { |key| path?(value[key]) } &&
-                %w[mount_id device inode].all? { |key| value[key].is_a?(Integer) && value[key].positive? } &&
-                %w[uid gid].all? { |key| value[key].is_a?(Integer) && value[key] >= 0 } &&
-                %w[ext4 xfs btrfs tmpfs].include?(value["filesystem_type"])
-              MaintenanceWorkspaceRetirement.unavailable!("retirement evidence resource identity differs")
-            end
-          end
-        end
-        class Session
-          attr_reader :projection
-          def self.open!(**arguments) = new(**arguments)
-          private_class_method :new
-
-          def initialize(lifecycle:, mapping_id:, journal:, commit:, target:, projection:, evidence_owner:, deadline:, contexts:)
-            @lifecycle, @mapping_id, @journal, @commit = lifecycle, mapping_id, journal, commit
-            @target, @projection = MaintenanceWorkspaceRetirement.immutable(target), projection
-            @owner, @deadline, @contexts = evidence_owner, deadline, contexts
-            @thread, @active, @phase = Thread.current, true, nil
-            @evidences = []
-            @writer = @owner.retirement_workspace_writer!
-            unless @writer.is_a?(Molecules::LifecycleExclusion::WorkspaceWriter) && @writer.projection == projection.fetch("workspace_exclusion")
-              MaintenanceWorkspaceRetirement.unavailable!("retirement session requires the original maintained workspace writer")
-            end
-            verify_held!
-          end
-
-          def verify_captured!(evidence:) = verify_phase!("captured", evidence)
-          def verify_removed!(evidence:) = verify_phase!("removed", evidence)
-          def close!
-            @active = false
-            @evidences.each(&:expire!)
-          end
-
-          private
-
-          def verify_held!
-            unless @active && @thread.equal?(Thread.current) &&
-                Thread.current[:ace_assign_maintenance_contexts]&.[](@lifecycle.object_id).equal?(@contexts)
-              MaintenanceWorkspaceRetirement.unavailable!("retirement session no longer owns complete maintenance contexts")
-            end
-            @lifecycle.send(:maintenance_deadline!, @deadline)
-            @lifecycle.send(:require_maintenance_context!, @mapping_id, @journal, @commit)
-            @writer.verify_unchanged!
-          end
-
-          def verify_phase!(phase, evidence)
-            unless evidence.is_a?(Evidence) && (phase == "captured" && @phase.nil? || phase == "removed" && @phase == "captured")
-              MaintenanceWorkspaceRetirement.unavailable!("retirement session phase or evidence differs")
-            end
-            @evidences << evidence
-            verify = -> {
-              verify_held!
-              evidence.verify!(owner: @owner, target: @target, projection: @projection, phase: phase, deadline: @deadline)
-            }
-            evidence.with_consumption(verify) do
-              @lifecycle.send(:verify_retirement_contexts!, evidence: evidence, deadline: @deadline)
-            end
-            @phase = phase
-            true
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/ordinary_attempt_start.rb

@@ -1,137 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Authority
-      module OrdinaryAttemptStart
-        START_KEYS = %w[assignment_id attempt_id expected_generation head pane scope].freeze
-
-        private
-
-        def start_attempt(request, peer, role, deadline)
-          params = request.fetch("params")
-          strict!(params, START_KEYS)
-          %w[assignment_id attempt_id].each { |key| token!(params.fetch(key)) }
-          if params.fetch("attempt_id").start_with?("definition-")
-            raise ArgumentError, "ordinary attempt ID uses the registration namespace"
-          end
-          token!(request.fetch("mutation_id"))
-          unless params.fetch("head").is_a?(String) && params.fetch("head").match?(/\A[0-9a-f]{40}\z/)
-            raise ArgumentError, "ordinary start HEAD is invalid"
-          end
-          unless %i[supervisor worker].include?(role) && params.fetch("expected_generation").is_a?(Integer) && params.fetch("expected_generation") == 0
-            raise AttemptErrors::UnauthorizedIdentity, "ordinary start requires an installed worker and a new attempt"
-          end
-          commit = @journal.ref_value
-          registered = registration(params.fetch("assignment_id"), commit: commit)
-          raise AttemptErrors::NotFound, "ordinary work is not registered" unless registered
-          work = registered_work(registered, commit, deadline)
-          scope = params.fetch("scope")
-          unless work.manifest.fetch("steps").any? { |step| step.fetch("number") == scope }
-            raise AttemptErrors::InvalidScope, "ordinary scope is not in the accepted work"
-          end
-          keys = [@exclusion.task_key(registered.fetch("task_id")), @exclusion.assignment_key(params.fetch("assignment_id"))]
-          @exclusion.with_shared_multi(keys, deadline: deadline) do
-            if @journal.mutation_result(request.fetch("mutation_id"))
-              # Work may legitimately have advanced since an acknowledged or
-              # lost start reply. Recover its original head, never recapture it.
-              identity = @admission.identity!(peer: peer, pane: params.fetch("pane"), deadline: deadline)
-              return @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
-                mutation_id: request.fetch("mutation_id"), operation: "start_attempt", parameters_digest: start_digest(params, peer, identity),
-                expected_generation: 0, with_replay: true, deadline: deadline,
-                replay_authorizer: -> { authorize_start_replay!(request, peer, role, deadline) }) do
-                  raise AttemptErrors::EvidenceUnavailable, "accepted ordinary start disappeared"
-                end
-            end
-            # Only the installed admission can observe the actual native owner
-            # and worker checkout. It performs no launch or delivery effect.
-            observed = @admission.execution!(peer: peer, pane: params.fetch("pane"), head: params.fetch("head"), deadline: deadline)
-            identity = observed.fetch(:identity)
-            principal = {"uid" => peer.fetch("uid"), "actor" => identity.actor}
-            digest = start_digest(params, peer, identity)
-            authorize!(request, peer, role, deadline)
-            @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
-              mutation_id: request.fetch("mutation_id"), operation: "start_attempt", parameters_digest: digest,
-              expected_generation: 0, with_replay: true, deadline: deadline,
-              replay_authorizer: -> { authorize_start_replay!(request, peer, role, deadline) }) do |events, prefix, _generation|
-              authorize!(request, peer, role, deadline)
-              unless @admission.identity!(peer: peer, pane: params.fetch("pane"), deadline: deadline) == identity
-                raise AttemptErrors::UnauthorizedIdentity, "ordinary native worker changed before start acceptance"
-              end
-              unless events.empty? && registration(params.fetch("assignment_id"), commit: prefix) == registered
-                raise AttemptErrors::Conflict, "ordinary start registration or attempt changed"
-              end
-              if @journal.assignment_ids(commit: prefix).any? { |assignment|
-                  assignment != params.fetch("assignment_id") && @journal.read_events(assignment, commit: prefix).any? { |event|
-                    event.fetch("attempt_id") == params.fetch("attempt_id") } }
-                raise AttemptErrors::Conflict, "ordinary attempt ID belongs to another assignment"
-              end
-              # Sibling scopes may run independently. A different request ID
-              # never repeats an already consumed scope or any part of it.
-              if @journal.derived_attempts(params.fetch("assignment_id"), commit: prefix).any? { |attempt|
-                  Atoms::AssignmentScope.overlap?(attempt.binding.scope, scope) }
-                raise AttemptErrors::Conflict, "ordinary scope already has an attempt; reconcile its original execution"
-              end
-              record = current_queue_record(registered, prefix)
-              queue = OrdinaryQueue.new(work: work, root: @input_root, bytes: queue_bytes(record, prefix))
-                .transition(operation: :activate, scope: scope)
-              queue_sha = Digest::SHA256.hexdigest(queue.bytes)
-              queue_path = "execution/definitions/#{params.fetch('assignment_id')}-queue-#{queue_sha}.json"
-              {events: [
-                {type: "intent", payload: {"assignment_id" => params.fetch("assignment_id"), "scope" => scope,
-                  "project_id" => @project, "task_id" => registered.fetch("task_id"), "base_head" => observed.fetch(:checkout).fetch("head")}},
-                {type: "process_start", payload: {"actor" => identity.actor, "role" => identity.role, "runtime" => identity.runtime,
-                  "pid" => identity.process_pid, "process_identity" => identity.runtime_binding.fetch("process_identity"),
-                  "runtime_binding" => identity.runtime_binding, "checkout" => observed.fetch(:checkout)}}
-              ], blobs: {queue_path => queue.bytes}, data: {
-                "authority" => "ordinary", "assignment_id" => params.fetch("assignment_id"), "attempt_id" => params.fetch("attempt_id"),
-                "project_id" => @project, "scope" => scope, "state" => "running", "started_by" => principal,
-                "base_head" => observed.fetch(:checkout).fetch("head"), "runtime_binding" => identity.runtime_binding,
-                "queue_ref" => queue_path, "queue_sha256" => queue_sha}}
-            end
-          end
-        end
-
-        def start_digest(params, peer, identity)
-          Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project,
-            "principal" => {"uid" => peer.fetch("uid"), "actor" => identity.actor}})
-        end
-
-        def authorize_start_replay!(request, peer, role, deadline)
-          authorize!(request, peer, role, deadline)
-          params = request.fetch("params")
-          identity = @admission.identity!(peer: peer, pane: params.fetch("pane"), deadline: deadline)
-          start_replay_owner!(params, identity)
-        end
-
-        def registered_work(registered, commit, deadline)
-          reference = registered.fetch("prepared_work")
-          bytes = @journal.bounded_blob(registered.fetch("prepared_bundle_ref"), commit: commit,
-            max_bytes: registered.fetch("prepared_bundle_bytes"))
-          work = PreparedWork.admit(bytes: bytes, head: reference.fetch("prepared_head"), tree: reference.fetch("prepared_tree"),
-            sha256: registered.fetch("prepared_bundle_sha256"), size: registered.fetch("prepared_bundle_bytes"),
-            root: @input_root, deadline: deadline)
-          unless work.reference(head: reference.fetch("prepared_head"), tree: reference.fetch("prepared_tree")) == reference &&
-              work.manifest.values_at("assignment_id", "project_id", "task_id") == registered.values_at("assignment_id", "project_id", "task_id") &&
-              Digest::SHA256.hexdigest(work.definition_bytes(head: reference.fetch("prepared_head"), tree: reference.fetch("prepared_tree"))) == registered.fetch("definition_digest")
-            raise AttemptErrors::EvidenceUnavailable, "ordinary prepared registration bytes differ"
-          end
-          work
-        end
-
-        def start_replay_owner!(params, identity)
-          events = @journal.read_events(params.fetch("assignment_id"))
-            .select { |event| event.fetch("attempt_id") == params.fetch("attempt_id") }
-          unless Models::EvidenceEvent.chain_valid?(events) && events.count { |event| event["type"] == "process_start" } == 1
-            raise AttemptErrors::EvidenceUnavailable, "ordinary start evidence is unavailable"
-          end
-          owner = events.find { |event| event["type"] == "process_start" }.fetch("payload")
-          unless owner.values_at("actor", "role", "runtime", "runtime_binding") ==
-              [identity.actor, identity.role, identity.runtime, identity.runtime_binding]
-            raise AttemptErrors::UnauthorizedIdentity, "ordinary replay belongs to its original native worker"
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/ordinary_client.rb

@@ -1,70 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "ordinary_peer"
-require_relative "transfer_codec"
-
-module Ace
-  module Assign
-    module Authority
-      # Installed selection is supplied by the caller's trusted composition.
-      # This client never selects a journal, local fallback or execution identity.
-      class OrdinaryClient
-        Reply = Struct.new(:data, :replayed, :parts, keyword_init: true)
-
-        def initialize(project_id:, service:, verify_selection:, peer: OrdinaryPeer.new, scratch_root: nil)
-          @project_id, @service, @verify_selection, @peer, @scratch_root = project_id, service, verify_selection, peer, scratch_root
-        end
-
-        def call(operation, params, mutation_id: nil, upload_parts: nil, download: false, purpose: nil, timeout: 30)
-          unless operation.is_a?(String) && params.is_a?(Hash) && !params.key?("transfer") &&
-              timeout.is_a?(Numeric) && timeout.finite? && timeout.positive?
-            raise ArgumentError, "invalid ordinary authority request"
-          end
-          raise ArgumentError, "ordinary download needs private scratch and forbids upload" if download && (upload_parts || !@scratch_root)
-          @verify_selection.call
-          wire = Ace::Runtime::Molecules::ProtectedSocket
-          path = @service.fetch("socket_path")
-          wire.root_path!(File.dirname(path), directory: true, owner: @service.fetch("uid"))
-          before = wire.socket_identity(path, mode: 0o660)
-          raise AttemptErrors::UnauthorizedIdentity, "ordinary endpoint owner differs" unless before.last == @service.fetch("uid")
-          codec = TransferCodec.new(root: download ? @scratch_root : nil)
-          descriptor = codec.descriptor(upload_parts, purpose: purpose) if upload_parts
-          parameters = descriptor ? params.merge("transfer" => descriptor) : params
-          deadline = wire.deadline([timeout, 30].min)
-          wire.connect(path, deadline: deadline) do |socket|
-            observed = @peer.capture(socket, deadline: deadline)
-            unless observed.values_at("uid", "gid") == @service.values_at("uid", "gid") && wire.socket_identity(path, mode: 0o660) == before
-              raise AttemptErrors::UnauthorizedIdentity, "ordinary endpoint peer changed"
-            end
-            @verify_selection.call
-            wire.write(socket, {"version" => 1, "operation" => operation, "mutation_id" => mutation_id,
-              "project_id" => @project_id, "params" => parameters}, deadline: deadline, limit: 16_384)
-            codec.send(socket, parts: upload_parts, descriptor: descriptor, purpose: purpose, deadline: deadline) if upload_parts
-            socket.shutdown(Socket::SHUT_WR)
-            ingress = wire::Ingress.new(socket)
-            result = wire.read(ingress, deadline: deadline, limit: 16_384)
-            unless result.is_a?(Hash) && result.keys.sort == %w[data status transport] && result["status"] == "ok" &&
-                result["data"].is_a?(Hash) && result["transport"].is_a?(Hash) &&
-                result["transport"].keys == ["replayed"] && [true, false].include?(result["transport"]["replayed"])
-              code = result.is_a?(Hash) && result["error"].is_a?(Hash) ? result["error"]["code"] : nil
-              raise AttemptErrors::EvidenceUnavailable, "ordinary authority refused (#{code || 'invalid_response'}); retain original mutation"
-            end
-            parts = if download
-              codec.receive(ingress, descriptor: result.fetch("data").fetch("transfer"), purpose: purpose, deadline: deadline) do |input|
-                Array.new(input.count) { |index| input.bytes(index: index) }
-              end
-            end
-            @verify_selection.call
-            @peer.live!(observed, deadline: deadline)
-            unless wire.socket_identity(path, mode: 0o660) == before
-              raise AttemptErrors::UnauthorizedIdentity, "ordinary endpoint changed before response acceptance"
-            end
-            Reply.new(data: result.fetch("data"), replayed: result.fetch("transport").fetch("replayed"), parts: parts)
-          end
-        rescue SystemCallError, IOError, Ace::Runtime::RuntimeUnavailableError
-          raise AttemptErrors::EvidenceUnavailable, "ordinary authority outcome unavailable; retain original mutation; no local fallback"
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/ordinary_completion.rb

@@ -1,104 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "ordinary_effect_settlement"
-require_relative "../organisms/attempt_coordinator"
-
-module Ace
-  module Assign
-    module Authority
-      # Terminal acceptance consumes the submitted canonical receipt. The
-      # supervisor cannot replace its bytes, worker, scope or candidate.
-      module OrdinaryCompletion
-        FINISH_KEYS = %w[assignment_id attempt_id expected_generation pane head result_id receipt_digest].freeze
-
-        private
-
-        def finish_result(request, peer, role, deadline)
-          params = request.fetch("params")
-          strict!(params, FINISH_KEYS)
-          %w[assignment_id attempt_id result_id].each { |key| token!(params.fetch(key)) }
-          token!(request.fetch("mutation_id"))
-          unless role == :supervisor
-            raise AttemptErrors::UnauthorizedIdentity, "ordinary completion requires the installed supervisor"
-          end
-          unless params.fetch("expected_generation").is_a?(Integer) && params.fetch("expected_generation").positive? &&
-              params.fetch("head").is_a?(String) && params.fetch("head").match?(/\A[0-9a-f]{40}\z/) &&
-              params.fetch("receipt_digest").is_a?(String) && params.fetch("receipt_digest").match?(/\A[0-9a-f]{64}\z/)
-            raise ArgumentError, "ordinary completion selection is invalid"
-          end
-          registered = registration(params.fetch("assignment_id"), commit: @journal.ref_value)
-          raise AttemptErrors::NotFound, "ordinary work is not registered" unless registered
-          verify_result_owner!(request, peer, role, deadline, registered)
-          digest = Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project, "peer_uid" => peer.fetch("uid")})
-          @exclusion.with_shared_multi([@exclusion.task_key(registered.fetch("task_id"))], deadline: deadline) do
-            @exclusion.with_exclusive(@exclusion.assignment_key(params.fetch("assignment_id")), deadline: deadline) do
-              authorize!(request, peer, role, deadline)
-              with_result_transport(request, deadline) do |transport|
-                @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
-                  mutation_id: request.fetch("mutation_id"), operation: "finish", parameters_digest: digest,
-                  expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
-                  replay_authorizer: -> { verify_result_owner!(request, peer, role, deadline, registered) }) do |events, prefix, _generation|
-                  verify_result_owner!(request, peer, role, deadline, registered)
-                  unless Molecules::CanonicalAttemptState.derive(events) == "running"
-                    raise AttemptErrors::Conflict, "ordinary completion requires a running attempt"
-                  end
-                  result = retained_ordinary_result(params, events, prefix)
-                  unless result && result.fetch("result_id") == params.fetch("result_id") &&
-                      result.dig("receipt", "digest") == params.fetch("receipt_digest") && result.dig("binding", "head") == params.fetch("head")
-                    raise AttemptErrors::ReceiptRejected, "ordinary completion requires its exact submitted result"
-                  end
-                  binding = result.fetch("binding")
-                  observed = @admission.recorded_execution!(binding: binding.fetch("runtime_binding"), head: binding.fetch("head"), deadline: deadline)
-                  unless observed.fetch(:runtime_binding) == binding.fetch("runtime_binding") && observed.fetch(:checkout) == binding.fetch("checkout")
-                    raise AttemptErrors::UnauthorizedIdentity, "ordinary result worker checkout changed"
-                  end
-                  references = events.select { |event| event["type"] == "inbox_binding" }.map { |event| event.fetch("payload") }
-                  delivery = transport.call(references: references, attempt_id: params.fetch("attempt_id"), owner: binding.fetch("runtime_binding"))
-                  scope = events.find { |event| event["type"] == "intent" }.fetch("payload").fetch("scope")
-                  work = registered_work(registered, prefix, deadline)
-                  queue = OrdinaryQueue.new(work: work, root: @input_root, bytes: queue_bytes(current_queue_record(registered, prefix), prefix))
-                  verdict = result.dig("receipt", "verdict")
-                  complete = verdict == "succeeded" ? queue.status.subtree_complete?(scope) : queue.status.subtree_failed?(scope)
-                  raise AttemptErrors::Conflict, "ordinary result scope has unfinished progress" unless complete
-                  settlement = OrdinaryEffectSettlement.new(journal: @journal).verify!(project: @project,
-                    assignment: params.fetch("assignment_id"), attempt: params.fetch("attempt_id"), events: events, commit: prefix)
-                  verify_result_owner!(request, peer, role, deadline, registered)
-                  plan = Organisms::AttemptCoordinator.finished_transition_plan(events: events, receipt: result.fetch("receipt"), authority: :ordinary)
-                  plan.merge(data: params.slice("assignment_id", "attempt_id", "result_id", "head", "receipt_digest").merge(
-                    "authority" => "ordinary", "scope" => scope, "state" => verdict, "settlement" => settlement, "inbox_deliveries" => delivery))
-                end
-              end
-            end
-          end
-        rescue Ace::Herdr::Error => error
-          raise AttemptErrors::EvidenceUnavailable, "ordinary transport settlement is unavailable: #{error.message}"
-        end
-
-        def verify_result_owner!(request, peer, role, deadline, registered)
-          authorize!(request, peer, role, deadline)
-          supervisor = @admission.identity!(peer: peer, pane: request.fetch("params").fetch("pane"), deadline: deadline)
-          unless supervisor.role == "coordinator" &&
-              supervisor.runtime_binding == supervisor_selection(registered, @journal.ref_value).fetch("binding")
-            raise AttemptErrors::UnauthorizedIdentity, "ordinary completion belongs to its original supervisor"
-          end
-        end
-
-        def with_result_transport(request, deadline)
-          if @journal.mutation_result(request.fetch("mutation_id"), commit: @journal.ref_value)
-            # A terminal reply is immutable. Current peer authority is still
-            # checked by mutate, but retired transport files are not replay input.
-            return yield nil
-          end
-          if @inbox
-            @inbox.with_delivery_settlement(deadline: deadline) { |verify| yield verify }
-          else
-            yield lambda { |references:, **_|
-              raise AttemptErrors::EvidenceUnavailable, "ordinary Inbox owner is not installed" unless references.empty?
-              []
-            }
-          end
-        end
-      end
-    end
-  end
-end