ace-assign 0.71.0 → 0.73.0

data/lib/ace/assign/authority/ordinary_queue.rb

@@ -1,115 +0,0 @@
-# frozen_string_literal: true
-
-require "tmpdir"
-require "fileutils"
-require_relative "prepared_work"
-require_relative "private_directory"
-require_relative "../organisms/assignment_executor"
-
-module Ace
-  module Assign
-    module Authority
-      # A disposable projection for the existing queue engine. Only bytes read
-      # from (or about to be committed to) the canonical execution ref enter it.
-      # No files left by an earlier coordinator are recovery input.
-      class OrdinaryQueue
-        attr_reader :bytes
-
-        def initialize(work:, root:, bytes: nil)
-          raise ArgumentError, "ordinary queue requires prepared work" unless work.is_a?(PreparedWork)
-          @work, @root = work, PrivateDirectory.verify!(root)
-          value = if bytes
-            invalid! unless bytes.is_a?(String) && bytes.bytesize.between?(1, PreparedWork::MAX_TOTAL)
-            JSON.parse(bytes)
-          else
-            {"version" => 1, "steps" => work.manifest.fetch("steps").to_h { |step|
-              name = step.fetch("filename"); [name, work.files.fetch("steps/#{name}")]
-            }, "reports" => {}}
-          end
-          validate!(value, initial: bytes.nil?)
-          @bytes = Atoms::EvidenceDigest.canonical_json(value).freeze
-        rescue JSON::ParserError
-          invalid!
-        end
-
-        def status
-          value = JSON.parse(@bytes)
-          assignment = Models::Assignment.from_h(@work.definition, cache_dir: File.join(@root, @work.manifest.fetch("assignment_id")))
-          Molecules::QueueScanner.new.scan_captured(steps: value.fetch("steps"), reports: value.fetch("reports"), assignment: assignment)
-        end
-
-        # This returns proposed bytes only. The lifecycle owns authorization,
-        # generation, replay and publication together with its attempt events.
-        def transition(operation:, scope: @work.manifest.fetch("scope"), step: nil, report: nil, message: nil)
-          invalid! unless @work.manifest.fetch("steps").any? { |entry| entry.fetch("number") == scope }
-          value = JSON.parse(@bytes)
-          Dir.mktmpdir("ordinary-queue-", @root) do |scratch|
-            File.chmod(0o700, scratch)
-            directory = File.join(scratch, @work.manifest.fetch("assignment_id"))
-            %w[steps reports].each { |name| FileUtils.mkdir_p(File.join(directory, name), mode: 0700) }
-            assignment = Models::Assignment.from_h(@work.definition, cache_dir: directory)
-            write(File.join(directory, "assignment.yaml"), assignment.to_h.to_yaml)
-            write(File.join(directory, "job.yaml"), @work.files.fetch("job.yaml"))
-            %w[steps reports].each do |group|
-              value.fetch(group).each { |filename, content| write(File.join(directory, group, filename), content) }
-            end
-            executor = Organisms::AssignmentExecutor.new(cache_base: scratch, selected_assignment: assignment)
-            case operation
-            when :activate
-              state = executor.status.fetch(:state)
-              invalid! unless state.find_by_number(scope)&.status == :pending
-              executor.step_writer.mark_active(state.find_by_number(scope).file_path)
-            when :start
-              executor.start_step(step_number: step, fork_root: scope)
-            when :finish
-              executor.finish_step(report_content: report, step_number: step, fork_root: scope)
-            when :fail
-              executor.fail(message, fork_root: scope)
-            else
-              raise ArgumentError, "unknown ordinary queue transition"
-            end
-            result = {"version" => 1}
-            %w[steps reports].each do |group|
-              result[group] = Dir.children(File.join(directory, group)).to_h do |filename|
-                [filename, File.binread(File.join(directory, group, filename)).force_encoding(Encoding::UTF_8)]
-              end
-            end
-            self.class.new(work: @work, root: @root, bytes: Atoms::EvidenceDigest.canonical_json(result))
-          end
-        end
-
-        private
-
-        def validate!(value, initial:)
-          invalid! unless value.is_a?(Hash) && value.keys.sort == %w[reports steps version] && value["version"].is_a?(Integer) && value["version"] == 1 &&
-            value["steps"].is_a?(Hash) && value["reports"].is_a?(Hash)
-          expected = @work.manifest.fetch("steps").map { |step| step.fetch("filename") }
-          invalid! unless value.fetch("steps").keys.sort == expected.sort
-          reports = []
-          value.fetch("steps").each do |filename, content|
-            parsed = @work.parse_queue_step!(content)
-            progress = parsed.fetch(:frontmatter).keys & PreparedWork::PROGRESS
-            allowed = initial ? %w[status] : %w[status started_at completed_at error stall_reason]
-            invalid! unless (progress - allowed).empty?
-            original = @work.files.fetch("steps/#{filename}")
-            invalid! unless PreparedWork.work_projection(content) == PreparedWork.work_projection(original) &&
-              %w[pending active done failed].include?(parsed.fetch(:frontmatter).fetch("status", "pending"))
-            info = Atoms::StepFileParser.parse_filename(filename)
-            reports << Atoms::StepFileParser.generate_report_filename(info.fetch(:number), info.fetch(:name))
-          end
-          invalid! unless (value.fetch("reports").keys - reports).empty?
-          value.fetch("reports").each_value { |content| @work.parse_queue_step!(content) }
-          invalid! if Atoms::EvidenceDigest.canonical_json(value).bytesize > PreparedWork::MAX_TOTAL
-        end
-
-        def write(path, content)
-          File.open(path, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0600) { |file| file.write(content) }
-        end
-
-        def invalid!
-          raise AttemptErrors::EvidenceUnavailable, "ordinary canonical queue differs from its accepted work"
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/ordinary_release_artifacts.rb

@@ -1,143 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "release_artifact_manifest"
-require_relative "candidate_transfer"
-
-module Ace
-  module Assign
-    module Authority
-      # Retention is a canonical input, never a publication permit or result.
-      # Native/candidate/review and release policy are rechecked at every CAS.
-      module OrdinaryReleaseArtifacts
-        RELEASE_OPERATIONS = %w[retain_release_artifact].freeze
-        RELEASE_TRANSFERS = {"retain_release_artifact" =>
-          {direction: :upload, purpose: :release_artifact, roles: %i[worker supervisor]}}.freeze
-        RELEASE_PARAMETERS = %w[assignment_id attempt_id head candidate_generation pane expected_generation
-          authorization manifest transfer].freeze
-
-        # Read an accepted import at the current immutable canonical prefix only.
-        # Historical commit selection is not supported by the native origin reader.
-        # The later effect consumer must independently admit its fresh scope,
-        # candidate, review, authorization and fixed executor before dispatch.
-        def release_artifact_at!(events:, commit:, artifact_id:)
-          token!(artifact_id)
-          unless commit && Models::EvidenceEvent.chain_valid?(events)
-            raise AttemptErrors::EvidenceUnavailable, "release artifact history is unavailable"
-          end
-          accepted = events.select { |event| event["type"] == "authority_mutation" &&
-            event.dig("payload", "operation") == "retain_release_artifact" && event.dig("payload", "mutation_id") == artifact_id }
-          data = accepted.one? && accepted.first.dig("payload", "data")
-          unless data && data["artifact_id"] == artifact_id && data["input_digest"] == Atoms::EvidenceDigest.digest(data.fetch("input"))
-            raise AttemptErrors::EvidenceUnavailable, "release artifact acceptance is unavailable"
-          end
-          origin = data.fetch("producer_origin")
-          retained = @journal.read_events(origin.fetch("assignment_id"), commit: commit)
-            .select { |event| event["attempt_id"] == origin.fetch("attempt_id") }
-          unless retained == events && ordinary_origin_at!(events, commit, running: false) == origin
-            raise AttemptErrors::EvidenceUnavailable, "release artifact original scope differs"
-          end
-          context = release_evidence_context(data.fetch("input"), origin, data.fetch("authorization"), artifact_id)
-          bytes = Molecules::CanonicalEvidence.new(journal: @journal).read(data.fetch("artifact"), **context, commit: commit)
-          unless bytes.bytesize == data.dig("input", "publication", "artifact_bytes") &&
-              Digest::SHA256.hexdigest(bytes) == data.dig("input", "target", "artifact_digest")
-            raise AttemptErrors::EvidenceUnavailable, "release artifact retained bytes differ"
-          end
-          data.merge("bytes" => bytes)
-        rescue KeyError, TypeError
-          raise AttemptErrors::EvidenceUnavailable, "release artifact acceptance is incomplete"
-        end
-
-        private
-
-        def validate_ordinary_release!(request)
-          params = request.fetch("params")
-          strict!(params, RELEASE_PARAMETERS)
-          %w[assignment_id attempt_id authorization].each { |key| token!(params.fetch(key)) }
-          token!(request.fetch("mutation_id"))
-          unless params["head"].is_a?(String) && CandidateTransfer::SHA.match?(params["head"]) &&
-              %w[candidate_generation expected_generation].all? { |key| params[key].is_a?(Integer) && params[key].positive? }
-            raise ArgumentError, "invalid release artifact candidate selection"
-          end
-          ReleaseArtifactManifest.validate!(params.fetch("manifest"))
-        end
-
-        def authorize_ordinary_release!(request, peer, role, deadline)
-          validate_ordinary_release!(request)
-          params = request.fetch("params")
-          with_scope(assignment: params.fetch("assignment_id"), attempt: params.fetch("attempt_id"), deadline: deadline) do
-            prefix = @journal.ref_value
-            release_context_at!(request, peer, role, deadline, result_events(params, prefix), prefix)
-          end
-        end
-
-        # Caller holds lifecycle exclusion before entering the journal writer.
-        # This method never acquires another lifecycle lock or trusts a path.
-        def release_context_at!(request, peer, role, deadline, events, commit)
-          authorize!(request, peer, role, deadline)
-          unless %i[worker supervisor].include?(role) && @release_authorizer
-            raise AttemptErrors::UnauthorizedIdentity, "installed release artifact authorization is unavailable"
-          end
-          params = request.fetch("params")
-          origin = origin_at!(events: events, commit: commit)
-          current = candidate_at!(events: events, commit: commit, head: params.fetch("head"), generation: params.fetch("candidate_generation"))
-          reference = candidate_reference_at!(events: events, commit: commit, head: params.fetch("head"), generation: params.fetch("candidate_generation"))
-          observed = @admission.execution!(peer: peer, pane: params.fetch("pane"), head: current.fetch("head"), deadline: deadline)
-          unless observed.fetch(:identity).runtime_binding == origin.fetch("runtime_binding")
-            raise AttemptErrors::UnauthorizedIdentity, "release artifact producer native identity changed"
-          end
-          review_at!(events: events, commit: commit, head: current.fetch("head"), generation: current.fetch("candidate_generation"))
-          input = ReleaseArtifactManifest.publication_input(manifest: params.fetch("manifest"), candidate: current, reference: reference)
-          binding = params.slice("assignment_id", "attempt_id", "authorization").merge(
-            "operation" => "publish", "project_id" => @project, "candidate_head" => current.fetch("head"),
-            "caller_uid" => origin.dig("runtime_binding", "process_identity", "uid"),
-            "input_digest" => Atoms::EvidenceDigest.digest(input), "target" => input.fetch("target"))
-          unless @release_authorizer.call(binding)
-            raise AttemptErrors::UnauthorizedIdentity, "release artifact manifest is not authorized"
-          end
-          {input: input, binding: binding, origin: origin}
-        rescue SecurityError
-          raise AttemptErrors::UnauthorizedIdentity, "release artifact manifest authorization is unavailable"
-        end
-
-        def retain_release_artifact(request, peer, role, deadline, transfer)
-          validate_ordinary_release!(request)
-          unless transfer && transfer.count == 1
-            raise AttemptErrors::MalformedTransfer, "release artifact requires its one bounded binary transfer"
-          end
-          params = request.fetch("params")
-          with_scope(assignment: params.fetch("assignment_id"), attempt: params.fetch("attempt_id"), deadline: deadline) do
-            prefix = @journal.ref_value
-            release_context_at!(request, peer, role, deadline, result_events(params, prefix), prefix)
-            bytes = transfer.bytes.dup.freeze
-            ReleaseArtifactManifest.verify!(bytes, params.fetch("manifest"))
-            digest = Atoms::EvidenceDigest.digest("project_id" => @project, "params" => params)
-            recheck = lambda do
-              current = @journal.ref_value
-              release_context_at!(request, peer, role, deadline, result_events(params, current), current)
-            end
-            @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
-              mutation_id: request.fetch("mutation_id"), operation: "retain_release_artifact", parameters_digest: digest,
-              expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
-              replay_authorizer: recheck) do |events, commit, _generation|
-              selected = release_context_at!(request, peer, role, deadline, events, commit)
-              artifact_id = request.fetch("mutation_id")
-              context = release_evidence_context(selected.fetch(:input), selected.fetch(:origin), params.fetch("authorization"), artifact_id)
-              plan = Molecules::CanonicalEvidence.new(journal: @journal).import_plan(**context,
-                artifacts: [bytes], admitted_after_event_digest: events.last.fetch("digest"))
-              plan.merge(data: {"artifact_id" => artifact_id, "input" => selected.fetch(:input),
-                "input_digest" => selected.fetch(:binding).fetch("input_digest"), "artifact" => plan.fetch(:references).first,
-                "authorization" => params.fetch("authorization"), "producer_origin" => selected.fetch(:origin)})
-            end
-          end
-        end
-
-        def release_evidence_context(input, origin, authorization, artifact_id)
-          {kind: "release-artifact", project_id: @project, assignment_id: origin.fetch("assignment_id"),
-            attempt_id: origin.fetch("attempt_id"), peer_uid: origin.dig("runtime_binding", "process_identity", "uid"),
-            binding: {"input" => input, "producer_origin" => origin, "authorization" => authorization},
-            request_id_or_event_id: artifact_id, generation: input.fetch("publication").fetch("candidate_reference").fetch("candidate_generation")}
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/ordinary_results.rb

@@ -1,206 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "receipt_transfer"
-require_relative "../molecules/canonical_evidence"
-
-module Ace
-  module Assign
-    module Authority
-      # A worker submits an attributable result. This never accepts a terminal
-      # outcome, an independent review, or an external delivery effect.
-      module OrdinaryResults
-        RESULT_OPERATIONS = %w[submit_result result_status result_snapshot].freeze
-        RESULT_TRANSFERS = {
-          "submit_result" => {direction: :upload, purpose: :receipt_artifacts, roles: %i[worker supervisor]},
-          "result_snapshot" => {direction: :download, purpose: :receipt_artifacts, roles: %i[worker supervisor]}
-        }.freeze
-        RESULT_KEYS = %w[assignment_id attempt_id expected_generation pane head receipt_sha256 transfer].freeze
-
-        private
-
-        def validate_result!(request)
-          params = request.fetch("params")
-          if request.fetch("operation") != "submit_result"
-            snapshot = request.fetch("operation") == "result_snapshot"
-            strict!(params, %w[assignment_id attempt_id] + (snapshot ? ["result_id"] : []))
-            token!(params.fetch("result_id")) if snapshot
-            raise ArgumentError, "ordinary result status mutation must be null" unless request.fetch("mutation_id").nil?
-          else
-            strict!(params, RESULT_KEYS)
-            token!(request.fetch("mutation_id"))
-            unless params.fetch("expected_generation").is_a?(Integer) && params.fetch("expected_generation").positive? &&
-                params.fetch("head").is_a?(String) && params.fetch("head").match?(/\A[0-9a-f]{40}\z/) &&
-                params.fetch("receipt_sha256").is_a?(String) && params.fetch("receipt_sha256").match?(/\A[0-9a-f]{64}\z/)
-              raise ArgumentError, "ordinary result selection is invalid"
-            end
-          end
-          %w[assignment_id attempt_id].each { |key| token!(params.fetch(key)) }
-        end
-
-        def ordinary_result(request, peer, role, deadline, transfer)
-          validate_result!(request)
-          params = request.fetch("params")
-          commit = @journal.ref_value
-          registered = registration(params.fetch("assignment_id"), commit: commit)
-          raise AttemptErrors::NotFound, "ordinary work is not registered" unless registered
-          if request.fetch("operation") != "submit_result"
-            if request.fetch("operation") == "result_status" && @journal.read_events(params.fetch("assignment_id"), commit: commit)
-                .none? { |event| event.fetch("attempt_id") == params.fetch("attempt_id") }
-              authorize!(request, peer, role, deadline)
-              return {data: params.slice("assignment_id", "attempt_id").merge("project_id" => @project,
-                "state" => "not_started", "generation" => 0, "submitted_result" => nil), replayed: false}
-            end
-            events = result_events(params, commit)
-            result = retained_ordinary_result(params, events, commit)
-            if request.fetch("operation") == "result_snapshot"
-              unless result && result.fetch("result_id") == params.fetch("result_id")
-                raise AttemptErrors::NotFound, "ordinary exact result is unavailable"
-              end
-              receipt = result.fetch("receipt")
-              canonical = Molecules::CanonicalEvidence.new(journal: @journal)
-              parts = [JSON.generate(receipt)] + receipt.fetch("artifacts").map { |artifact|
-                canonical.read({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
-                  **ordinary_result_context(result.fetch("binding")), commit: commit)
-              }
-              authorize!(request, peer, role, deadline)
-              return {data: ordinary_result_projection(result).merge("journal_commit" => commit), transfer_parts: parts, replayed: false}
-            end
-            authorize!(request, peer, role, deadline)
-            started = events.find { |event| event["type"] == "process_start" }.fetch("payload")
-            scope = events.find { |event| event["type"] == "intent" }.fetch("payload").fetch("scope")
-            return {data: {"project_id" => @project, "assignment_id" => params.fetch("assignment_id"), "attempt_id" => params.fetch("attempt_id"),
-              "scope" => scope, "producer" => started.slice("actor", "role", "runtime"),
-              "runtime_binding" => started.fetch("runtime_binding"),
-              "journal_commit" => commit, "generation" => @journal.authority_generation(events),
-              "state" => Molecules::CanonicalAttemptState.derive(events), "submitted_result" => result && ordinary_result_projection(result)}, replayed: false}
-          end
-          unless %i[worker supervisor].include?(role)
-            raise AttemptErrors::UnauthorizedIdentity, "ordinary result requires its original worker"
-          end
-          authorize_start_replay!(request, peer, role, deadline)
-          admitted = ReceiptTransfer.decode(input: transfer, receipt_sha256: params.fetch("receipt_sha256"),
-            artifact_field: "artifacts", reference_key: "path")
-          digest = Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project, "peer_uid" => peer.fetch("uid")})
-          keys = [@exclusion.task_key(registered.fetch("task_id")), @exclusion.assignment_key(params.fetch("assignment_id"))]
-          @exclusion.with_shared_multi(keys, deadline: deadline) do
-            @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
-              mutation_id: request.fetch("mutation_id"), operation: "submit_result", parameters_digest: digest,
-              expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
-              replay_authorizer: -> { authorize_start_replay!(request, peer, role, deadline) }) do |events, prefix, generation|
-              authorize_start_replay!(request, peer, role, deadline)
-              unless Molecules::CanonicalAttemptState.derive(events) == "running"
-                raise AttemptErrors::Conflict, "ordinary result requires the original running attempt"
-              end
-              raise AttemptErrors::Conflict, "ordinary attempt already submitted its result" if retained_ordinary_result(params, events, prefix)
-              observed = @admission.execution!(peer: peer, pane: params.fetch("pane"), head: params.fetch("head"), deadline: deadline)
-              start_replay_owner!(params, observed.fetch(:identity))
-              ordinary_result_plan(params, peer, admitted, observed, events, prefix, generation + 1)
-            end
-          end
-        end
-
-        def result_events(params, commit)
-          events = @journal.read_events(params.fetch("assignment_id"), commit: commit)
-            .select { |event| event.fetch("attempt_id") == params.fetch("attempt_id") }
-          unless Models::EvidenceEvent.chain_valid?(events) && events.one? { |event| event["type"] == "process_start" }
-            raise AttemptErrors::EvidenceUnavailable, "ordinary result attempt evidence is unavailable"
-          end
-          events
-        end
-
-        def ordinary_result_plan(params, peer, admitted, observed, events, commit, generation)
-          original = admitted.fetch(:receipt)
-          original_receipt = Models::ExecutionReceipt.from_h(original)
-          unless original_receipt.digest == Atoms::EvidenceDigest.digest(original_receipt.digest_payload)
-            raise AttemptErrors::ReceiptRejected, "ordinary original result digest differs"
-          end
-          identity = observed.fetch(:identity)
-          expected_producer = {"actor" => identity.actor, "role" => identity.role, "runtime" => identity.runtime}
-          validate_ordinary_result_receipt!(original, expected_producer)
-          id = SecureRandom.hex(16)
-          binding = params.slice("assignment_id", "attempt_id", "head").merge("authority" => "ordinary", "project_id" => @project,
-            "result_id" => id, "worker_uid" => peer.fetch("uid"), "producer" => expected_producer,
-            "runtime_binding" => identity.runtime_binding, "checkout" => observed.fetch(:checkout),
-            "generation" => generation, "uploaded_receipt_sha256" => admitted.fetch(:receipt_sha256),
-            "original_receipt_digest" => original_receipt.digest)
-          canonical = Molecules::CanonicalEvidence.new(journal: @journal)
-          plan = admitted.fetch(:artifacts).empty? ? {events: [], blobs: {}, references: []} :
-            canonical.import_plan(**ordinary_result_context(binding), artifacts: admitted.fetch(:artifacts),
-              admitted_after_event_digest: events.last.fetch("digest"))
-          receipt = original.except("digest", "recorded_at").merge("artifacts" => plan.fetch(:references).map { |reference|
-            {"path" => reference.fetch("ref"), "sha256" => reference.fetch("sha256")}
-          })
-          pending = @journal.send(:chain_mutation_events, params.fetch("attempt_id"), events.last.fetch("digest"), plan.fetch(:events))
-          reader = ->(_data, artifact) { canonical.read_pending({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
-            **ordinary_result_context(binding), current_events: events, pending_events: pending, blobs: plan.fetch(:blobs), commit: commit) }
-          verified = verify_ordinary_result_receipt(params, receipt, binding, commit, reader)
-          if JSON.generate(verified.to_h).bytesize > 16_384
-            raise AttemptErrors::ReceiptRejected, "canonical ordinary receipt exceeds its transfer limit"
-          end
-          payload = {"authority" => "ordinary", "result_id" => id, "binding" => binding, "receipt" => verified.to_h}
-          plan.merge(events: plan.fetch(:events) + [{type: "result_submitted", payload: payload}],
-            data: ordinary_result_projection(payload))
-        end
-
-        def ordinary_result_projection(payload)
-          payload.slice("result_id").merge(payload.fetch("binding").slice("head", "generation"),
-            "receipt_digest" => payload.fetch("receipt").fetch("digest"), "verdict" => payload.fetch("receipt").fetch("verdict"),
-            "state" => "running", "authority" => "ordinary")
-        end
-
-        def ordinary_result_context(binding)
-          {kind: "result", project_id: @project, assignment_id: binding.fetch("assignment_id"), attempt_id: binding.fetch("attempt_id"),
-            peer_uid: binding.fetch("worker_uid"), binding: binding, request_id_or_event_id: binding.fetch("result_id"), generation: binding.fetch("generation")}
-        end
-
-        def validate_ordinary_result_receipt!(receipt, producer)
-          unless receipt["producer"] == producer && (receipt.keys - Models::ExecutionReceipt.from_h(receipt).to_h.keys).empty? &&
-              !receipt["campaign"] && !receipt["review"] && receipt["operation"] != "review" &&
-              !Molecules::ReceiptVerifier::EXTERNAL_EFFECT_OPERATIONS.include?(receipt["operation"])
-            raise AttemptErrors::ReceiptRejected, "ordinary result producer or operation requires another evidence owner"
-          end
-        end
-
-        def verify_ordinary_result_receipt(params, receipt, binding, commit, reader)
-          validate_ordinary_result_receipt!(receipt, binding.fetch("producer"))
-          attempt = @journal.derived_attempts(params.fetch("assignment_id"), commit: commit).find { |item| item.attempt_id == params.fetch("attempt_id") }
-          raise AttemptErrors::EvidenceUnavailable, "ordinary result attempt is unavailable" unless attempt
-          Array(receipt["artifacts"]).each { |artifact| reader.call(receipt, artifact) }
-          Molecules::ReceiptVerifier.new(artifact_reader: reader).verify_result!(receipt,
-            attempt: attempt, live_head: binding.fetch("head"), repo_root: @journal.repo_root)
-        end
-
-        def retained_ordinary_result(params, events, commit)
-          raise AttemptErrors::EvidenceUnavailable, "ordinary result chain is corrupt" unless Models::EvidenceEvent.chain_valid?(events)
-          records = events.select { |event| event["type"] == "result_submitted" }
-          replies = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "submit_result" }
-          return nil if records.empty? && replies.empty?
-          unless records.one? && replies.one?
-            raise AttemptErrors::EvidenceUnavailable, "ordinary result provenance is missing or duplicated"
-          end
-          payload = records.first.fetch("payload")
-          binding = payload.fetch("binding")
-          start = events.find { |event| event["type"] == "process_start" }.fetch("payload")
-          unless payload.keys.sort == %w[authority binding receipt result_id] && payload["authority"] == "ordinary" &&
-              payload["result_id"].is_a?(String) && payload["result_id"].match?(/\A[0-9a-f]{32}\z/) &&
-              binding.keys.sort == %w[assignment_id attempt_id authority checkout generation head original_receipt_digest producer project_id result_id runtime_binding uploaded_receipt_sha256 worker_uid] &&
-              binding["authority"] == "ordinary" && binding["result_id"] == payload["result_id"] &&
-              binding["head"] == binding.dig("checkout", "head") &&
-              binding.values_at("project_id", "assignment_id", "attempt_id", "runtime_binding") ==
-              [@project, params.fetch("assignment_id"), params.fetch("attempt_id"), start.fetch("runtime_binding")] &&
-              binding.fetch("producer") == start.slice("actor", "role", "runtime") &&
-              binding.fetch("worker_uid") == start.dig("runtime_binding", "process_identity", "uid") &&
-              payload.fetch("receipt").fetch("producer") == binding.fetch("producer") &&
-              replies.first.dig("payload", "data").slice(*ordinary_result_projection(payload).keys) == ordinary_result_projection(payload)
-            raise AttemptErrors::EvidenceUnavailable, "ordinary result owner differs"
-          end
-          canonical = Molecules::CanonicalEvidence.new(journal: @journal)
-          reader = ->(_data, artifact) { canonical.read({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
-            **ordinary_result_context(binding), commit: commit) }
-          verify_ordinary_result_receipt(params, payload.fetch("receipt"), binding, commit, reader)
-          payload
-        end
-      end
-    end
-  end
-end