ace-assign 0.71.0 → 0.73.0

data/lib/ace/assign/authority/ordinary_review_evidence.rb

@@ -1,180 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "candidate_transfer"
-require_relative "receipt_transfer"
-require_relative "../molecules/canonical_evidence"
-
-module Ace
-  module Assign
-    module Authority
-      # Source-owned views of the same ordinary journal used by lifecycle CAS.
-      # Caller labels, filesystem reports and protected launch tickets are not
-      # alternate evidence sources. Service and merge consumers share this owner.
-      module OrdinaryReviewEvidence
-        def with_scope(assignment:, attempt:, deadline:)
-          token!(assignment)
-          token!(attempt)
-          selected = registration(assignment, commit: @journal.ref_value)
-          raise AttemptErrors::NotFound, "ordinary assignment is not registered" unless selected
-          @exclusion.with_shared_multi([@exclusion.task_key(selected.fetch("task_id")),
-            @exclusion.assignment_key(assignment)], deadline: deadline) do
-            yield @journal, selected
-          end
-        end
-
-        def origin_at!(events:, commit:)
-          ordinary_origin_at!(events, commit, running: true)
-        end
-
-        def candidate_at!(events:, commit:, head:, generation:)
-          origin_at!(events: events, commit: commit)
-          selected = ordinary_candidate_event(events)&.dig("payload", "data")
-          unless selected && selected.values_at("head", "candidate_generation") == [head, generation]
-            raise AttemptErrors::Conflict, "ordinary candidate changed"
-          end
-          bytes = @journal.bounded_blob(selected.fetch("bundle_ref"), commit: commit, max_bytes: CandidateTransfer::MAX_BYTES)
-          unless bytes.bytesize == selected.fetch("bytes") && Digest::SHA256.hexdigest(bytes) == selected.fetch("sha256")
-            raise AttemptErrors::EvidenceUnavailable, "ordinary canonical candidate is corrupt"
-          end
-          selected.slice("head", "tree", "candidate_generation", "bundle_ref", "sha256", "bytes")
-        end
-
-        def candidate_reference_at!(events:, commit:, head:, generation:)
-          candidate_at!(events: events, commit: commit, head: head, generation: generation)
-          origin = origin_at!(events: events, commit: commit)
-          origin.slice("assignment_id", "attempt_id").merge("candidate_generation" => generation,
-            "acceptance_event_digest" => ordinary_candidate_event(events).fetch("digest"))
-        end
-
-        def review_at!(events:, commit:, head:, generation:)
-          current = candidate_at!(events: events, commit: commit, head: head, generation: generation)
-          assigned = ordinary_review_assignment!(events, current)
-          ordinary_review_origins!(events, commit, assigned)
-          accepted = events.reverse.find { |event| event["type"] == "authority_mutation" &&
-            event.dig("payload", "operation") == "accept_review" && event.dig("payload", "data", "review_id") == assigned.fetch("review_id") }
-          data = accepted && accepted.dig("payload", "data")
-          unless data && data.fetch("review_binding") == assigned.except("generation", "journal_commit")
-            raise AttemptErrors::ReceiptRejected, "ordinary candidate has no accepted independent review"
-          end
-          canonical = Molecules::CanonicalEvidence.new(journal: @journal)
-          reader = ->(_receipt, artifact) { canonical.read({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
-            **ordinary_review_context(data.fetch("review_binding")), commit: commit) }
-          receipt = data.fetch("review_receipt")
-          verified = ordinary_verify_review!(receipt, events, commit, assigned, reader)
-          original = canonical.read({"ref" => data.fetch("original_receipt_ref"), "sha256" => data.fetch("uploaded_receipt_sha256")},
-            **ordinary_review_context(data.fetch("review_binding")), commit: commit)
-          unless Digest::SHA256.hexdigest(original) == data.fetch("uploaded_receipt_sha256") &&
-              verified.digest == data.fetch("receipt_digest")
-            raise AttemptErrors::EvidenceUnavailable, "ordinary accepted review bytes differ"
-          end
-          original_data = JSON.parse(original)
-          original_receipt = Models::ExecutionReceipt.from_h(original_data)
-          unless original_receipt.digest == Atoms::EvidenceDigest.digest(original_receipt.digest_payload) &&
-              original_data.except("digest", "recorded_at", "artifacts") == receipt.except("digest", "recorded_at", "artifacts") &&
-              original_data.fetch("artifacts").map { |value| value.fetch("sha256") } == receipt.fetch("artifacts").map { |value| value.fetch("sha256") }
-            raise AttemptErrors::EvidenceUnavailable, "ordinary review original and canonical receipt differ"
-          end
-          data.merge("acceptance_event_digest" => accepted.fetch("digest"), "recorded_at" => accepted.fetch("recorded_at"))
-        rescue JSON::ParserError, KeyError, TypeError
-          raise AttemptErrors::EvidenceUnavailable, "ordinary accepted review is incomplete"
-        end
-
-        private
-
-        def ordinary_origin_at!(events, commit, running:)
-          raise AttemptErrors::Conflict, "ordinary evidence prefix changed" unless commit && @journal.ref_value == commit
-          intent = events.select { |event| event["type"] == "intent" }
-          starts = events.select { |event| event["type"] == "process_start" }
-          accepted = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "start_attempt" }
-          unless Models::EvidenceEvent.chain_valid?(events) && intent.one? && starts.one? && accepted.one?
-            raise AttemptErrors::EvidenceUnavailable, "ordinary native origin is unavailable"
-          end
-          assignment, attempt = intent.first.dig("payload", "assignment_id"), intent.first.fetch("attempt_id")
-          token!(assignment)
-          token!(attempt)
-          registered = registration(assignment, commit: commit)
-          retained = @journal.read_events(assignment, commit: commit).select { |event| event["attempt_id"] == attempt }
-          start, data = starts.first.fetch("payload"), accepted.first.fetch("payload").fetch("data")
-          unless registered && retained == events && data.values_at("authority", "project_id", "assignment_id", "attempt_id", "runtime_binding") ==
-              ["ordinary", @project, assignment, attempt, start.fetch("runtime_binding")] &&
-              intent.first.dig("payload", "project_id") == @project
-            raise AttemptErrors::EvidenceUnavailable, "ordinary native origin differs from accepted start"
-          end
-          if running && Molecules::CanonicalAttemptState.derive(events) != "running"
-            raise AttemptErrors::Conflict, "ordinary delivery requires its original running attempt"
-          end
-          {"authority" => "ordinary", "project_id" => @project, "assignment_id" => assignment, "attempt_id" => attempt,
-            "intent_digest" => intent.first.fetch("digest"), "process_start_digest" => starts.first.fetch("digest"),
-            "runtime_binding" => start.fetch("runtime_binding"), "scope" => intent.first.dig("payload", "scope"),
-            "base_head" => intent.first.dig("payload", "base_head")}
-        end
-
-        def ordinary_candidate_event(events)
-          events.reverse.find { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "submit_candidate" }
-        end
-
-        def ordinary_review_assignment!(events, candidate)
-          selected = events.reverse.find { |event| event["type"] == "authority_mutation" &&
-            event.dig("payload", "operation") == "assign_review" &&
-            event.dig("payload", "data", "candidate_generation") == candidate.fetch("candidate_generation") }
-          data = selected && selected.dig("payload", "data")
-          cancelled = selected && events.any? { |event| event["type"] == "authority_mutation" &&
-            event.dig("payload", "operation") == "cancel_review" && event.dig("payload", "data", "review_id") == data.fetch("review_id") }
-          unless data && data.fetch("head") == candidate.fetch("head") && !cancelled
-            raise AttemptErrors::ReceiptRejected, "ordinary independent review assignment is absent or revoked"
-          end
-          data
-        end
-
-        def ordinary_review_origins!(events, commit, assigned, reviewer_running: false)
-          producer = origin_at!(events: events, commit: commit)
-          reviewer_events = @journal.read_events(assigned.fetch("reviewer_assignment_id"), commit: commit)
-            .select { |event| event["attempt_id"] == assigned.fetch("reviewer_attempt_id") }
-          reviewer = ordinary_origin_at!(reviewer_events, commit, running: reviewer_running)
-          unless producer == assigned.fetch("producer_origin") && reviewer == assigned.fetch("reviewer_origin")
-            raise AttemptErrors::EvidenceUnavailable, "ordinary review origins differ"
-          end
-          ordinary_independent_agents!(producer.fetch("runtime_binding"), reviewer.fetch("runtime_binding"))
-          [producer, reviewer]
-        end
-
-        def ordinary_independent_agents!(producer, reviewer)
-          sessions = [producer, reviewer].map { |binding|
-            Ace::Herdr::Atoms::NativeAgentSession.normalize(binding.fetch("agent_session"), agent: binding.fetch("agent")) }
-          identities = [producer, reviewer].map { |binding|
-            identity = binding.fetch("process_identity")
-            unless identity.is_a?(Hash) && %w[pid uid started_at host].all? { |key| identity.key?(key) }
-              raise AttemptErrors::EvidenceUnavailable, "ordinary agent process generation is missing"
-            end
-            identity.values_at("pid", "uid", "started_at", "host") }
-          unless sessions.all? && sessions[0].fetch("value").downcase != sessions[1].fetch("value").downcase && identities[0] != identities[1] && producer.fetch("pane") != reviewer.fetch("pane")
-            raise AttemptErrors::ReceiptRejected, "review requires an independently started native agent and session"
-          end
-          true
-        rescue KeyError
-          raise AttemptErrors::EvidenceUnavailable, "ordinary agent identity is incomplete"
-        end
-
-        def ordinary_review_context(binding)
-          {kind: "review", project_id: @project, assignment_id: binding.fetch("producer_origin").fetch("assignment_id"),
-            attempt_id: binding.fetch("producer_origin").fetch("attempt_id"), peer_uid: binding.fetch("reviewer_uid"),
-            binding: binding, request_id_or_event_id: binding.fetch("review_id"), generation: binding.fetch("candidate_generation")}
-        end
-
-        def ordinary_verify_review!(receipt, events, commit, assigned, reader)
-          origin = origin_at!(events: events, commit: commit)
-          producer = events.find { |event| event["type"] == "process_start" }.fetch("payload").slice("actor", "role", "runtime")
-          unless receipt["operation"] == "review" && receipt["verdict"] == "succeeded" && !receipt["campaign"] &&
-              receipt["producer"] == producer && receipt.dig("review", "reviewer", "actor") == assigned.fetch("reviewer_actor")
-            raise AttemptErrors::ReceiptRejected, "ordinary review receipt attribution differs"
-          end
-          attempt = @journal.derived_attempts(origin.fetch("assignment_id"), commit: commit)
-            .find { |value| value.attempt_id == origin.fetch("attempt_id") }
-          independence = ->(_data) { ordinary_review_origins!(events, commit, assigned); true }
-          Molecules::ReceiptVerifier.new(artifact_reader: reader, review_independence_verifier: independence)
-            .verify_result!(receipt, attempt: attempt, live_head: assigned.fetch("head"), repo_root: @journal.repo_root)
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/ordinary_reviews.rb

@@ -1,214 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "ordinary_review_evidence"
-
-module Ace
-  module Assign
-    module Authority
-      module OrdinaryReviews
-        include OrdinaryReviewEvidence
-        REVIEW_OPERATIONS = %w[submit_candidate assign_review cancel_review export_candidate accept_review review_status].freeze
-        REVIEW_TRANSFERS = {
-          "submit_candidate" => {direction: :upload, purpose: :candidate, roles: %i[worker supervisor]},
-          "export_candidate" => {direction: :download, purpose: :candidate, roles: %i[worker supervisor]},
-          "accept_review" => {direction: :upload, purpose: :receipt_artifacts, roles: %i[worker supervisor]}
-        }.freeze
-        REVIEW_COMMON = %w[assignment_id attempt_id head candidate_generation pane].freeze
-        REVIEW_PARAMETERS = {
-          "submit_candidate" => REVIEW_COMMON + %w[expected_generation transfer],
-          "assign_review" => REVIEW_COMMON + %w[expected_generation reviewer_assignment_id reviewer_attempt_id],
-          "cancel_review" => REVIEW_COMMON + %w[expected_generation review_id],
-          "export_candidate" => REVIEW_COMMON + %w[review_id],
-          "accept_review" => REVIEW_COMMON + %w[expected_generation review_id receipt_sha256 transfer],
-          "review_status" => %w[assignment_id attempt_id head candidate_generation]
-        }.freeze
-
-        private
-
-        def validate_ordinary_review!(request)
-          operation, params = request.values_at("operation", "params")
-          strict!(params, REVIEW_PARAMETERS.fetch(operation))
-          %w[assignment_id attempt_id reviewer_assignment_id reviewer_attempt_id review_id].each { |key| token!(params[key]) if params.key?(key) }
-          unless params["head"].is_a?(String) && CandidateTransfer::SHA.match?(params["head"]) &&
-              params["candidate_generation"].is_a?(Integer) && params["candidate_generation"] >= 0
-            raise ArgumentError, "ordinary candidate selection is invalid"
-          end
-          if %w[export_candidate review_status].include?(operation)
-            raise ArgumentError, "ordinary review read mutation must be null" unless request["mutation_id"].nil?
-          else
-            token!(request["mutation_id"])
-            unless params["expected_generation"].is_a?(Integer) && params["expected_generation"].positive?
-              raise ArgumentError, "ordinary review generation is invalid"
-            end
-          end
-        end
-
-        def authorize_ordinary_review!(request, peer, role, deadline, events: nil, commit: nil)
-          authorize!(request, peer, role, deadline)
-          validate_ordinary_review!(request)
-          params = request.fetch("params")
-          commit ||= @journal.ref_value
-          events ||= result_events(params, commit)
-          origin = origin_at!(events: events, commit: commit)
-          operation = request.fetch("operation")
-          return origin if operation == "review_status"
-          identity = @admission.identity!(peer: peer, pane: params.fetch("pane"), deadline: deadline)
-          case operation
-          when "submit_candidate"
-            unless identity.runtime_binding == origin.fetch("runtime_binding")
-              raise AttemptErrors::UnauthorizedIdentity, "candidate belongs to its original native producer"
-            end
-          when "assign_review", "cancel_review"
-            registered = registration(params.fetch("assignment_id"), commit: commit)
-            unless role == :supervisor && identity.role == "coordinator" && identity.runtime_binding == supervisor_selection(registered, commit).fetch("binding")
-              raise AttemptErrors::UnauthorizedIdentity, "review selection belongs to the current canonical supervisor"
-            end
-          when "export_candidate", "accept_review"
-            candidate = candidate_at!(events: events, commit: commit, head: params.fetch("head"), generation: params.fetch("candidate_generation"))
-            assigned = ordinary_review_assignment!(events, candidate)
-            _, reviewer = ordinary_review_origins!(events, commit, assigned, reviewer_running: true)
-            unless assigned.fetch("review_id") == params.fetch("review_id") && identity.runtime_binding == reviewer.fetch("runtime_binding") &&
-                identity.actor == assigned.fetch("reviewer_actor") && peer.fetch("uid") == assigned.fetch("reviewer_uid")
-              raise AttemptErrors::UnauthorizedIdentity, "review belongs to its assigned native agent"
-            end
-          end
-          origin
-        end
-
-        def ordinary_review_operation(request, peer, role, deadline, transfer)
-          params, operation = request.values_at("params", "operation")
-          authorize_ordinary_review!(request, peer, role, deadline)
-          admitted = if operation == "submit_candidate"
-            raise ArgumentError, "ordinary candidate requires one bundle" unless transfer && transfer.count == 1
-            descriptor = params.fetch("transfer")
-            CandidateTransfer.new(root: @input_root).admit(bytes: transfer.bytes, sha256: descriptor.fetch("sha256"),
-              size: descriptor.fetch("bytes"), head: params.fetch("head"), deadline: deadline)
-          elsif operation == "accept_review"
-            ReceiptTransfer.decode(input: transfer, receipt_sha256: params.fetch("receipt_sha256"), artifact_field: "artifacts", reference_key: "path")
-          elsif transfer
-            raise ArgumentError, "ordinary review operation forbids upload"
-          end
-          with_scope(assignment: params.fetch("assignment_id"), attempt: params.fetch("attempt_id"), deadline: deadline) do
-            commit = @journal.ref_value
-            events = result_events(params, commit)
-            authorize_ordinary_review!(request, peer, role, deadline, events: events, commit: commit)
-            if %w[export_candidate review_status].include?(operation)
-              current = candidate_at!(events: events, commit: commit, head: params.fetch("head"), generation: params.fetch("candidate_generation"))
-              assigned = ordinary_review_assignment!(events, current)
-              if operation == "export_candidate"
-                bytes = @journal.bounded_blob(current.fetch("bundle_ref"), commit: commit, max_bytes: CandidateTransfer::MAX_BYTES)
-                return {data: current.merge("review_id" => assigned.fetch("review_id")), transfer_parts: [bytes], replayed: false}
-              end
-              accepted = events.any? { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "accept_review" && event.dig("payload", "data", "review_id") == assigned.fetch("review_id") }
-              value = accepted ? review_at!(events: events, commit: commit, head: params.fetch("head"), generation: params.fetch("candidate_generation")) : assigned
-              return {data: value.merge("accepted" => accepted, "journal_commit" => commit), replayed: false}
-            end
-            digest = Atoms::EvidenceDigest.digest({"params" => params, "project_id" => @project, "peer_uid" => peer.fetch("uid")})
-            replay = lambda do
-              authorize_ordinary_review!(request, peer, role, deadline)
-              if operation == "submit_candidate"
-                ordinary_candidate_replay!(request, admitted)
-              elsif operation == "accept_review"
-                prefix = @journal.ref_value
-                review_at!(events: result_events(params, prefix), commit: prefix, head: params.fetch("head"), generation: params.fetch("candidate_generation"))
-              end
-            end
-            @journal.mutate(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"),
-              mutation_id: request.fetch("mutation_id"), operation: operation, parameters_digest: digest,
-              expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
-              replay_authorizer: replay) do |current_events, prefix, _generation|
-              authorize_ordinary_review!(request, peer, role, deadline, events: current_events, commit: prefix)
-              ordinary_review_plan(operation, params, peer, deadline, current_events, prefix, admitted, transfer)
-            end
-          end
-        end
-
-        def ordinary_review_plan(operation, params, peer, deadline, events, commit, admitted, transfer)
-          if operation == "submit_candidate"
-            current = ordinary_candidate_event(events)&.dig("payload", "data")
-            unless (current && current.fetch("candidate_generation") || 0) == params.fetch("candidate_generation")
-              raise AttemptErrors::Conflict, "ordinary candidate generation changed"
-            end
-            observed = @admission.execution!(peer: peer, pane: params.fetch("pane"), head: params.fetch("head"), deadline: deadline)
-            unless observed.fetch(:identity).runtime_binding == origin_at!(events: events, commit: commit).fetch("runtime_binding")
-              raise AttemptErrors::UnauthorizedIdentity, "ordinary candidate worker changed"
-            end
-            path = "candidates/bundles/#{SecureRandom.hex(16)}"
-            return {events: [], blobs: {path => admitted.fetch("bundle")}, data: admitted.except("bundle").merge(
-              "bundle_ref" => path, "candidate_generation" => params.fetch("candidate_generation") + 1,
-              "producer_origin" => origin_at!(events: events, commit: commit))}
-          end
-          current = candidate_at!(events: events, commit: commit, head: params.fetch("head"), generation: params.fetch("candidate_generation"))
-          if operation == "assign_review"
-            prior = events.reverse.find { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "assign_review" &&
-              event.dig("payload", "data", "candidate_generation") == current.fetch("candidate_generation") }
-            if prior && !events.any? { |event| event.dig("payload", "operation") == "cancel_review" && event.dig("payload", "data", "review_id") == prior.dig("payload", "data", "review_id") }
-              raise AttemptErrors::Conflict, "ordinary review is already assigned"
-            end
-            producer = origin_at!(events: events, commit: commit)
-            reviewer_events = @journal.read_events(params.fetch("reviewer_assignment_id"), commit: commit)
-              .select { |event| event["attempt_id"] == params.fetch("reviewer_attempt_id") }
-            reviewer = ordinary_origin_at!(reviewer_events, commit, running: true)
-            ordinary_independent_agents!(producer.fetch("runtime_binding"), reviewer.fetch("runtime_binding"))
-            observed = @admission.recorded_binding!(binding: reviewer.fetch("runtime_binding"), deadline: deadline)
-            unless observed == reviewer.fetch("runtime_binding")
-              raise AttemptErrors::UnauthorizedIdentity, "ordinary reviewer native binding changed"
-            end
-            start = reviewer_events.find { |event| event["type"] == "process_start" }.fetch("payload")
-            return {events: [], data: current.slice("head", "candidate_generation").merge(
-              "review_id" => SecureRandom.hex(16), "reviewer_assignment_id" => params.fetch("reviewer_assignment_id"),
-              "reviewer_attempt_id" => params.fetch("reviewer_attempt_id"), "reviewer_actor" => start.fetch("actor"),
-              "reviewer_uid" => reviewer.dig("runtime_binding", "process_identity", "uid"),
-              "reviewer_runtime_binding" => reviewer.fetch("runtime_binding"), "producer_origin" => producer, "reviewer_origin" => reviewer)}
-          end
-          assigned = ordinary_review_assignment!(events, current)
-          raise AttemptErrors::Conflict, "ordinary review selection changed" unless assigned.fetch("review_id") == params.fetch("review_id")
-          return {events: [], data: current.slice("head", "candidate_generation").merge("review_id" => assigned.fetch("review_id"))} if operation == "cancel_review"
-          if events.any? { |event| event.dig("payload", "operation") == "accept_review" && event.dig("payload", "data", "review_id") == assigned.fetch("review_id") }
-            raise AttemptErrors::Conflict, "ordinary review already accepted; retain original request"
-          end
-          observed = @admission.execution!(peer: peer, pane: params.fetch("pane"), head: current.fetch("head"), deadline: deadline)
-          unless observed.fetch(:identity).runtime_binding == assigned.fetch("reviewer_runtime_binding") &&
-              observed.fetch(:identity).actor == assigned.fetch("reviewer_actor")
-            raise AttemptErrors::UnauthorizedIdentity, "ordinary reviewer changed before receipt acceptance"
-          end
-          ordinary_accept_review_plan(params, events, commit, assigned, admitted, transfer.bytes(index: 0))
-        end
-
-        def ordinary_candidate_replay!(request, admitted)
-          retained = @journal.mutation_result(request.fetch("mutation_id"))
-          data = retained.fetch("data")
-          bytes = @journal.bounded_blob(data.fetch("bundle_ref"), commit: retained.fetch("journal_commit"), max_bytes: CandidateTransfer::MAX_BYTES)
-          unless data.values_at("head", "tree", "sha256", "bytes") == admitted.values_at("head", "tree", "sha256", "bytes") &&
-              bytes.bytesize == data.fetch("bytes") && Digest::SHA256.hexdigest(bytes) == data.fetch("sha256")
-            raise AttemptErrors::EvidenceUnavailable, "ordinary retained candidate bytes differ"
-          end
-        end
-
-        def ordinary_accept_review_plan(params, events, commit, assigned, admitted, original_bytes)
-          original = admitted.fetch(:receipt)
-          original_model = Models::ExecutionReceipt.from_h(original)
-          unless (original.keys - original_model.to_h.keys).empty? &&
-              original_model.digest == Atoms::EvidenceDigest.digest(original_model.digest_payload)
-            raise AttemptErrors::ReceiptRejected, "ordinary uploaded review digest differs"
-          end
-          binding = assigned.except("generation", "journal_commit")
-          canonical = Molecules::CanonicalEvidence.new(journal: @journal)
-          plan = canonical.import_plan(**ordinary_review_context(binding), artifacts: [original_bytes] + admitted.fetch(:artifacts),
-            admitted_after_event_digest: events.last.fetch("digest"))
-          normalized = original.except("digest", "recorded_at").merge("artifacts" => plan.fetch(:references).drop(1).map { |ref| {"path" => ref.fetch("ref"), "sha256" => ref.fetch("sha256")} })
-          pending = @journal.send(:chain_mutation_events, params.fetch("attempt_id"), events.last.fetch("digest"), plan.fetch(:events))
-          reader = ->(_receipt, artifact) { canonical.read_pending({"ref" => artifact.fetch("path"), "sha256" => artifact.fetch("sha256")},
-            **ordinary_review_context(binding), current_events: events, pending_events: pending, blobs: plan.fetch(:blobs), commit: commit) }
-          verified = ordinary_verify_review!(normalized, events, commit, assigned, reader)
-          path = plan.fetch(:references).first.fetch("ref")
-          data = binding.slice("head", "candidate_generation", "review_id", "reviewer_uid", "reviewer_actor", "reviewer_runtime_binding", "producer_origin")
-            .merge("review_binding" => binding, "review_receipt" => verified.to_h, "receipt_digest" => verified.digest,
-              "original_receipt_ref" => path, "uploaded_receipt_sha256" => admitted.fetch(:receipt_sha256))
-          raise AttemptErrors::ReceiptRejected, "ordinary review reply is oversized" if JSON.generate(data).bytesize > 12_000
-          plan.merge(data: data)
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/ordinary_server.rb

@@ -1,75 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "socket_server"
-
-module Ace
-  module Assign
-    module Authority
-      # Explicit ordinary admission over Assign's existing wire/transfer owner.
-      # The Lab composition supplies a trusted installed admission object and
-      # closed handlers. No protected Deployment or kernel adapter is replaced.
-      class OrdinaryServer < SocketServer
-        def initialize(admission:, lifecycle:, services: [])
-          @admission = admission
-          super(service: admission.service, lifecycle: lifecycle, services: services)
-        end
-
-        private
-
-        def verify_listener!
-          @admission.verify_listener!
-        end
-
-        def authorize_transfer!(request:, peer:, role:, deadline:)
-          @lifecycle.authorize_transfer!(request: request, peer: peer, role: role, deadline: deadline)
-        end
-
-        def dispatch_lifecycle(request:, peer:, role:, deadline:, transfer: nil)
-          @lifecycle.dispatch(request: request, peer: peer, role: role, deadline: deadline, transfer: transfer)
-        end
-
-        def receive(socket)
-          deadline = wire.deadline(30)
-          peer = @admission.peer(socket, deadline: deadline)
-          ingress = Ace::Runtime::Molecules::ProtectedSocket::Ingress.new(socket)
-          frame = wire.read(ingress, deadline: [deadline, wire.deadline(5)].min, limit: 16_384, with_size: true)
-          request = frame.fetch(:data)
-          unless request.is_a?(Hash) && request.keys.sort == %w[mutation_id operation params project_id version] &&
-              request["version"].is_a?(Integer) && request["version"] == 1 &&
-              request["operation"].is_a?(String) && request["params"].is_a?(Hash)
-            raise ArgumentError, "invalid ordinary authority envelope"
-          end
-          role = @admission.authorize!(request: request, peer: peer, deadline: deadline)
-          binding = @lifecycle.transfer_binding(request)
-          bodyless_read!(ingress, deadline) unless binding && binding.fetch(:direction) == :upload
-          # Both binary bodies and EOF use ancillary-rejecting reads. Replies
-          # use the original duplex socket through the wrapper below.
-          dispatch_request(Duplex.new(socket, ingress), request, peer, role, deadline, frame_bytes: frame.fetch(:bytesize))
-        rescue ArgumentError, KeyError, AttemptErrors::MalformedTransfer
-          refusal(socket, "invalid_input")
-        rescue AttemptErrors::UnauthorizedIdentity, SecurityError
-          refusal(socket, "unauthorized")
-        rescue AttemptErrors::Conflict
-          refusal(socket, "conflict")
-        rescue AttemptErrors::NotFound
-          refusal(socket, "missing")
-        rescue AttemptErrors::BoundedResultUnavailable
-          refusal(socket, "bounded_result")
-        rescue StandardError
-          refusal(socket, "evidence_unavailable")
-        ensure
-          socket.close unless socket.closed?
-          @mutex.synchronize { @connections.delete(socket) }
-        end
-
-        class Duplex
-          def initialize(socket, ingress) = (@socket, @ingress = socket, ingress)
-          def to_io = @socket
-          def read_nonblock(*args, **options) = @ingress.read_nonblock(*args, **options)
-          def write_nonblock(*args, **options) = @socket.write_nonblock(*args, **options)
-        end
-        private_constant :Duplex
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/ordinary_supervisor.rb

@@ -1,99 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Authority
-      # Replacement transfers only result ownership, never worker execution.
-      # The existing definition chain serializes it with canonical generation.
-      module OrdinarySupervisor
-        SUPERVISOR_OPERATIONS = %w[supervisor_status adopt_supervisor].freeze
-
-        private
-
-        def supervisor_operation(request, peer, role, deadline)
-          params = request.fetch("params")
-          assignment = params.fetch("assignment_id")
-          token!(assignment)
-          registered = registration(assignment, commit: @journal.ref_value)
-          raise AttemptErrors::NotFound, "ordinary work is not registered" unless registered
-          if request.fetch("operation") == "supervisor_status"
-            strict!(params, %w[assignment_id])
-            raise ArgumentError, "supervisor status mutation must be null" unless request.fetch("mutation_id").nil?
-            commit = @journal.ref_value
-            selected = supervisor_selection(registered, commit)
-            authorize!(request, peer, role, deadline)
-            return {data: selected.merge("journal_commit" => commit), replayed: false}
-          end
-          strict!(params, %w[assignment_id expected_generation pane previous_binding_sha256])
-          token!(request.fetch("mutation_id"))
-          unless role == :supervisor && params.fetch("expected_generation").is_a?(Integer) &&
-              params.fetch("expected_generation").positive? && params.fetch("previous_binding_sha256").is_a?(String) &&
-              params.fetch("previous_binding_sha256").match?(/\A[0-9a-f]{64}\z/)
-            raise AttemptErrors::UnauthorizedIdentity, "supervisor adoption requires exact current selection"
-          end
-          observed = @admission.identity!(peer: peer, pane: params.fetch("pane"), deadline: deadline)
-          raise AttemptErrors::UnauthorizedIdentity, "replacement is not an installed coordinator" unless observed.role == "coordinator"
-          binding = observed.runtime_binding
-          digest = Atoms::EvidenceDigest.digest({"project_id" => @project, "params" => params, "binding" => binding})
-          @exclusion.with_shared_multi([@exclusion.task_key(registered.fetch("task_id")), @exclusion.assignment_key(assignment)], deadline: deadline) do
-            @journal.mutate(assignment_id: assignment, attempt_id: "definition-#{assignment}",
-              mutation_id: request.fetch("mutation_id"), operation: "adopt_supervisor", parameters_digest: digest,
-              expected_generation: params.fetch("expected_generation"), with_replay: true, deadline: deadline,
-              replay_authorizer: -> {
-                verify_new_supervisor!(request, peer, role, deadline, observed)
-                unless supervisor_selection(registered, @journal.ref_value).fetch("binding") == binding
-                  raise AttemptErrors::UnauthorizedIdentity, "supervisor adoption was superseded"
-                end
-              }) do |_events, prefix, _generation|
-              verify_new_supervisor!(request, peer, role, deadline, observed)
-              previous = supervisor_selection(registered, prefix)
-              unless previous.fetch("binding_sha256") == params.fetch("previous_binding_sha256") && previous.fetch("binding") != binding
-                raise AttemptErrors::Conflict, "original supervisor selection changed"
-              end
-              ended = @admission.supervisor_ended!(binding: previous.fetch("binding"), deadline: deadline)
-              unless ended.is_a?(Hash) && ended["liveness"] == "ended"
-                raise AttemptErrors::EvidenceUnavailable, "original supervisor generation has not ended"
-              end
-              verify_new_supervisor!(request, peer, role, deadline, observed)
-              {events: [], data: {"authority" => "ordinary", "assignment_id" => assignment, "project_id" => @project,
-                "previous_binding" => previous.fetch("binding"), "binding" => binding,
-                "binding_sha256" => Atoms::EvidenceDigest.digest(binding), "ended_observation" => ended}}
-            end
-          end
-        end
-
-        def verify_new_supervisor!(request, peer, role, deadline, observed)
-          authorize!(request, peer, role, deadline)
-          unless @admission.identity!(peer: peer, pane: request.fetch("params").fetch("pane"), deadline: deadline) == observed
-            raise AttemptErrors::UnauthorizedIdentity, "replacement supervisor changed during adoption"
-          end
-        end
-
-        def supervisor_selection(registered, commit)
-          assignment = registered.fetch("assignment_id")
-          events = @journal.read_events(assignment, commit: commit).select { |event| event.fetch("attempt_id") == "definition-#{assignment}" }
-          unless Models::EvidenceEvent.chain_valid?(events)
-            raise AttemptErrors::EvidenceUnavailable, "ordinary supervisor history is corrupt"
-          end
-          selected = registered.fetch("supervisor_binding")
-          generation = 1
-          # Validate the entire old→new chain rather than trusting a local cache.
-          events.select { |event| event["type"] == "authority_mutation" }.each do |event|
-            payload = event.fetch("payload")
-            next if payload.fetch("operation") == "register_assignment"
-            data = payload.fetch("data")
-            unless payload.fetch("operation") == "adopt_supervisor" && data.fetch("previous_binding") == selected &&
-                data.values_at("authority", "assignment_id", "project_id", "generation") == ["ordinary", assignment, @project, generation + 1] &&
-                data.fetch("binding_sha256") == Atoms::EvidenceDigest.digest(data.fetch("binding")) &&
-                data.dig("ended_observation", "liveness") == "ended"
-              raise AttemptErrors::EvidenceUnavailable, "ordinary supervisor adoption chain differs"
-            end
-            selected, generation = data.fetch("binding"), data.fetch("generation")
-          end
-          {"project_id" => @project, "assignment_id" => assignment, "generation" => generation,
-            "binding" => selected, "binding_sha256" => Atoms::EvidenceDigest.digest(selected)}
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/original_inbox_selection.rb

@@ -1,41 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Authority
-      # Original descriptor selection shared by canonical Inbox consumers.
-      # The held historical manifest/key owner supplies the exact artifact.
-      class OriginalInboxSelection
-        def initialize(history:, authority_id:)
-          @history, @authority_id = history, authority_id
-        end
-
-        def load!(events:, params:, map:, journal:, commit:)
-          provisioning = events.select { |event| event["type"] == "scope_provisioning" }
-          reservations = events.select { |event| event["type"] == "authority_mutation" && event.dig("payload", "operation") == "reserve_attempt" }
-          unless provisioning.one? && reservations.one?
-            raise AttemptErrors::EvidenceUnavailable, "context completion original selection is ambiguous"
-          end
-          identity = provisioning.first.fetch("payload")
-          reserved = reservations.first.fetch("payload").fetch("data")
-          original = @history.descriptor!(sha256: identity.fetch("descriptor_sha256"))
-          selected = original.mapping(params.fetch("mapping_id"))
-          unless identity.keys.sort == %w[deployment_digest descriptor_sha256 reservation_generation slot_id] &&
-              reserved.values_at("project_id", "assignment_id", "attempt_id", "mapping_id") ==
-                [map.fetch("project_id"), params.fetch("assignment_id"), params.fetch("attempt_id"), params.fetch("mapping_id")] &&
-              identity.fetch("reservation_generation") == reserved.fetch("reservation_generation") &&
-              identity.fetch("deployment_digest") == original.mapping_digest(params.fetch("mapping_id")) &&
-              selected.fetch("project_id") == map.fetch("project_id") && selected.fetch("authority_id") == @authority_id &&
-              identity.fetch("slot_id") == selected.fetch("execution_scope").fetch("slot_id") &&
-              original.project(selected.fetch("project_id")).values_at("journal_repository", "evidence_git_ref", "evidence_checkout_root") ==
-                [journal.repo_root, journal.ref, journal.checkout_root]
-            raise AttemptErrors::EvidenceUnavailable, "context completion original association differs"
-          end
-          journal.event_commit!(assignment_id: params.fetch("assignment_id"), event_digest: provisioning.first.fetch("digest"), commit: commit)
-          [original, selected]
-        end
-
-      end
-    end
-  end
-end