ace-assign 0.71.0 → 0.73.0

data/lib/ace/assign/authority/service_publication_evidence.rb

@@ -1,110 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Authority
-      # Publication-specific facts remain artifacts of the existing service
-      # record and canonical import owner, not a second publication journal.
-      module ServicePublicationEvidence
-        PUBLICATION_NEED_FIELDS = %w[schema classification request_id input_digest claim_binding
-          candidate_generation head registry gem_name version artifact_digest dispatch_event_digest previous_challenge_digest].freeze
-        PUBLICATION_FIELDS = %w[publication_challenge_digest publication_challenge_ref publication_challenge_event_digest
-          publication_challenge_generation publication_issuing_event_digest].freeze
-
-        def publication_result!(bytes, record, state:)
-          value = JSON.parse(bytes, allow_duplicate_key: false, allow_nan: false, max_nesting: 16)
-          fields = %w[schema publication target classification code request_id input_digest claim_binding]
-          publication = value.fetch("publication")
-          allowed = state == "succeeded" ? ["registry_exact_artifact"] :
-            %w[provider_rejected_non_otp executor_credentials_unavailable registry_artifact_conflict]
-          unless bytes.bytesize.between?(1, 65536) && value.is_a?(Hash) && value.keys.sort == fields.sort &&
-              value["schema"] == "ace.publication-result/v1" && value["classification"] == state && allowed.include?(value["code"]) &&
-              %w[request_id input_digest claim_binding target].all? { |key| value[key] == record[key] } &&
-              publication.is_a?(Hash) && publication.keys.sort == %w[gem_name version head registry artifact_relative_path].sort &&
-              publication["head"] == record.fetch("candidate_head") && publication["registry"] == "https://rubygems.org" &&
-              publication["gem_name"].is_a?(String) && publication["gem_name"].match?(/\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/) &&
-              publication["version"].is_a?(String) && publication["version"].bytesize.between?(1, 128) &&
-              publication["version"].match?(/\A[0-9]+(?:\.[0-9A-Za-z]+)*(?:-[0-9A-Za-z]+(?:\.[0-9A-Za-z]+)*)?\z/) &&
-              "rubygems:#{publication['gem_name']}:#{publication['version']}" == record.dig("target", "resource") &&
-              publication["artifact_relative_path"].is_a?(String) && publication["artifact_relative_path"].bytesize.between?(1, 4096) &&
-              publication["artifact_relative_path"].end_with?(".gem") &&
-              publication["artifact_relative_path"].split("/", -1).all? { |part| part.match?(/\A[a-zA-Z0-9_.-]+\z/) && !%w[. ..].include?(part) }
-            raise AttemptErrors::ReceiptRejected, "publication result differs from original artifact"
-          end
-          value
-        rescue JSON::ParserError, KeyError, TypeError, NoMethodError
-          raise AttemptErrors::ReceiptRejected, "publication result is invalid"
-        end
-
-        def publication_collection!(references, record, state, pending)
-          unless %w[succeeded failed].include?(state) && references.size == 1
-            raise AttemptErrors::ReceiptRejected, "publication requires one exact result artifact"
-          end
-          expected = context(record, pending: pending)
-          bytes = if pending && pending[:pending_events]
-            @canonical.read_pending(references.first, **expected, **pending.slice(:current_events, :pending_events, :blobs, :commit))
-          else
-            @canonical.read(references.first, **expected, commit: pending && pending[:commit] || @journal.ref_value)
-          end
-          publication_result!(bytes, record, state: state)
-          [bytes].freeze
-        end
-
-        def publication_need!(bytes, record, previous:)
-          value = JSON.parse(bytes, allow_duplicate_key: false, allow_comments: false,
-            allow_nan: false, create_additions: false, max_nesting: 16)
-          unless bytes.bytesize.between?(1, 65536) && value.is_a?(Hash) &&
-              value.keys.sort == PUBLICATION_NEED_FIELDS.sort && value["schema"] == "ace.publication-otp-need/v1" &&
-              %w[otp-required otp-rejected otp-expired].include?(value["classification"]) &&
-              %w[request_id input_digest claim_binding candidate_generation].all? { |key| value[key] == record[key] } &&
-              value["head"] == record["candidate_head"] && value["registry"] == "https://rubygems.org" &&
-              value["previous_challenge_digest"] == previous && value["artifact_digest"] == record.dig("target", "artifact_digest") &&
-              "rubygems:#{value['gem_name']}:#{value['version']}" == record.dig("target", "resource") &&
-              value["dispatch_event_digest"].is_a?(String) && value["dispatch_event_digest"].match?(/\A[0-9a-f]{64}\z/)
-            raise AttemptErrors::ReceiptRejected, "publication OTP need differs from original dispatch"
-          end
-          value
-        rescue JSON::ParserError, KeyError, TypeError
-          raise AttemptErrors::ReceiptRejected, "publication OTP need is invalid"
-        end
-
-        def publication_challenge!(record, pending: nil)
-          context(record)
-          commit = pending && pending[:commit] || @journal.ref_value
-          events = pending && pending[:pending_events] ? pending.fetch(:current_events) + pending.fetch(:pending_events) :
-            @journal.read_events(record.fetch("assignment_id"), commit: commit).select { |event| event["attempt_id"] == record.fetch("attempt_id") }
-          unless Models::EvidenceEvent.chain_valid?(events)
-            raise AttemptErrors::EvidenceUnavailable, "publication challenge chain is corrupt"
-          end
-          event = events.find { |row| row["digest"] == record["publication_challenge_event_digest"] }
-          unless event && event["type"] == "service_publication_challenge" &&
-              event.dig("payload", "challenge_digest") == record["publication_challenge_digest"] &&
-              event.dig("payload", "request_id") == record["request_id"] &&
-              event.dig("payload", "generation") == record["publication_challenge_generation"]
-            raise AttemptErrors::EvidenceUnavailable, "publication challenge introduction is unavailable"
-          end
-          reference = record.fetch("publication_challenge_ref")
-          bytes = if pending && pending[:pending_events]
-            @canonical.read_pending(reference, **context(record), current_events: pending.fetch(:current_events),
-              pending_events: pending.fetch(:pending_events), blobs: pending.fetch(:blobs), commit: commit)
-          else
-            @canonical.read(reference, **context(record), commit: commit)
-          end
-          unless Digest::SHA256.hexdigest(bytes) == record.fetch("publication_challenge_digest")
-            raise AttemptErrors::EvidenceUnavailable, "publication challenge digest differs"
-          end
-          need = publication_need!(bytes, record, previous: event.dig("payload", "previous_challenge_digest"))
-          dispatch = events.find { |row| row["digest"] == need.fetch("dispatch_event_digest") }
-          unless dispatch && dispatch["type"] == "authority_mutation" && dispatch.dig("payload", "operation") == "begin_dispatch" &&
-              dispatch.dig("payload", "data", "request_id") == record.fetch("request_id") &&
-              dispatch.dig("payload", "data", "executor_process_binding") == record.fetch("executor_process_binding")
-            raise AttemptErrors::EvidenceUnavailable, "publication need has no original executor dispatch"
-          end
-          need
-        rescue KeyError, TypeError
-          raise AttemptErrors::EvidenceUnavailable, "publication challenge evidence is incomplete"
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/socket_server.rb

@@ -1,255 +0,0 @@
-# frozen_string_literal: true
-
-require "socket"
-require "fileutils"
-require_relative "transfer_codec"
-require_relative "../molecules/evidence_journal"
-
-module Ace
-  module Assign
-    module Authority
-      # Shared endpoint lifetime and bounded wire protocol. Concrete source
-      # compositions authenticate their own installed principals before dispatch.
-      # Protected deployment/kernel requirements remain in Server.
-      class SocketServer
-        CONNECTIONS = 16
-
-        def initialize(service:, lifecycle:, services: [])
-          unless services.is_a?(Array) && services.uniq.size == services.size &&
-              services.all? { |owned| owned.respond_to?(:run) && owned.respond_to?(:stop) }
-            raise ArgumentError, "authority services require distinct source-owned run/stop lifetimes"
-          end
-          @service, @lifecycle, @services = service, lifecycle, services.dup.freeze
-          @service_threads = []
-          @activation_gates = []
-          @mutex = Mutex.new
-          @connections = []
-          @handlers = []
-          @transfers = 0
-          @stopped = false
-        end
-
-        def serve
-          verify_listener!
-          directory = File.dirname(@service.fetch("socket_path"))
-          wire.root_path!(directory, directory: true, owner: @service.fetch("uid"))
-          lock = File.open(File.join(directory, "listener.lock"), File::RDWR | File::CREAT | File::NOFOLLOW, 0o600)
-          unless lock.flock(File::LOCK_EX | File::LOCK_NB)
-            raise AttemptErrors::Conflict, "assignment authority already owns its listener"
-          end
-          path = @service.fetch("socket_path")
-          if File.exist?(path) || File.symlink?(path)
-            raise AttemptErrors::Conflict, "existing authority endpoint requires verified installer recovery"
-          end
-          @listener = UNIXServer.new(path)
-          @endpoint = wire.socket_identity(path)
-          File.chmod(0o660, path)
-          start_services!
-          verify_services!
-          @activation_gates.each { |gate| gate << :activate }
-          until @stopped
-            verify_services!
-            ready = IO.select([@listener], nil, nil, 0.25)
-            next unless ready
-            socket = @listener.accept_nonblock(exception: false)
-            next if socket == :wait_readable
-            admitted = @mutex.synchronize do
-              if @connections.size < CONNECTIONS
-                @connections << socket
-                true
-              end
-            end
-            unless admitted
-              refusal(socket, "busy")
-              socket.close
-              next
-            end
-            @mutex.synchronize do
-              @handlers.reject! { |handler| !handler.alive? }
-              @handlers << Thread.new(socket) { |connection| receive(connection) }
-            end
-          end
-        rescue IOError, Errno::EBADF
-          raise unless @stopped
-        ensure
-          begin
-            stop
-            stop_services!
-          ensure
-            # Closing a stream does not cancel an admitted transaction. Hold
-            # the owner lock and endpoint until every handler has ended.
-            begin
-              @mutex.synchronize { @handlers.dup }.each(&:join)
-              @lifecycle.close if @endpoint && @lifecycle.respond_to?(:close)
-            ensure
-              begin
-                File.unlink(path) if @endpoint && same_endpoint?(path)
-              ensure
-                lock&.close
-              end
-            end
-          end
-        end
-
-        def request_stop
-          @stopped = true
-        end
-
-        def stop
-          @stopped = true
-          @listener&.close unless @listener&.closed?
-          @mutex.synchronize { @connections.each { |socket| socket.close unless socket.closed? } }
-        end
-
-        private
-
-        # Installed HITL and merge listeners share the assignment owner lock.
-        # Every selected boundary must be ready before assignment ingress opens;
-        # a stopped boundary closes admission until the complete owner restarts.
-        def start_services!
-          @services.each do |owned|
-            ready = Queue.new
-            activation = Queue.new
-            @activation_gates << activation
-            thread = Thread.new do
-              owned.run(on_ready: lambda do
-                ready << :ready
-                unless activation.pop == :activate
-                  raise Ace::Runtime::RuntimeUnavailableError, "authority startup was cancelled"
-                end
-              end)
-            rescue Exception => error
-              ready << error
-            ensure
-              ready << :stopped
-            end
-            thread.report_on_exception = false
-            @service_threads << [owned, thread]
-            result = ready.pop(timeout: 5)
-            raise Ace::Runtime::RuntimeUnavailableError, "authority service startup did not become ready" unless result == :ready || result.is_a?(Exception)
-            raise result if result.is_a?(Exception)
-          end
-        end
-
-        def verify_services!
-          unless @service_threads.all? { |_, thread| thread.alive? }
-            raise Ace::Runtime::RuntimeUnavailableError, "an owned service stopped before its authority"
-          end
-        end
-
-        def stop_services!
-          errors = []
-          @activation_gates.each { |gate| gate << :cancel }
-          @service_threads.reverse_each do |owned, _|
-            owned.stop
-          rescue Exception => error
-            errors << error
-          end
-          @service_threads.each do |_, thread|
-            thread.join
-          rescue Exception => error
-            errors << error
-          end
-          raise errors.first unless errors.empty?
-        end
-
-        def same_endpoint?(path)
-          wire.socket_identity(path) == @endpoint
-        rescue StandardError
-          false
-        end
-
-        def verify_listener!
-          raise NotImplementedError, "source composition must verify its installed listener"
-        end
-
-        def dispatch_request(socket, request, peer, role, deadline, frame_bytes:)
-          params = request.fetch("params")
-          admitted_transfer = false
-          Molecules::EvidenceJournal.with_event_read_operation do
-            binding = @lifecycle.transfer_binding(request) if @lifecycle.respond_to?(:transfer_binding)
-            if binding
-              raise AttemptErrors::UnauthorizedIdentity, "transfer role differs" unless binding.fetch(:roles).include?(role)
-              raise ArgumentError, "transfer control header is oversized" if frame_bytes > 16_384
-              authorize_transfer!(request: request, peer: peer, role: role, deadline: deadline)
-              admitted_transfer = @mutex.synchronize do
-                if @transfers < 2
-                  @transfers += 1
-                  true
-                end
-              end
-              raise AttemptErrors::Conflict, "transfer capacity is busy" unless admitted_transfer
-              codec = transfer_codec
-              if binding.fetch(:direction) == :upload
-                result = codec.receive(socket, descriptor: params.fetch("transfer"), purpose: binding.fetch(:purpose), deadline: deadline) do |input|
-                  dispatch_lifecycle(request: request, peer: peer, role: role, transfer: input, deadline: deadline)
-                end
-              else
-                result = dispatch_lifecycle(request: request, peer: peer, role: role, deadline: deadline)
-                parts = result.fetch(:transfer_parts)
-                descriptor = codec.descriptor(parts, purpose: binding.fetch(:purpose))
-                result = result.merge(data: result.fetch(:data).merge("transfer" => descriptor))
-              end
-            else
-              raise ArgumentError, "unexpected transfer descriptor" if params.key?("transfer")
-              result = dispatch_lifecycle(request: request, peer: peer, role: role, deadline: deadline)
-            end
-            wire.write(socket, {"status" => "ok", "data" => result.fetch(:data),
-              "transport" => {"replayed" => result.fetch(:replayed, false)}}, deadline: deadline, limit: 16_384)
-            if binding && binding.fetch(:direction) == :download
-              codec.send(socket, parts: parts, descriptor: descriptor, purpose: binding.fetch(:purpose), deadline: deadline)
-            end
-          end
-        ensure
-          @mutex.synchronize { @transfers -= 1 } if admitted_transfer
-        end
-
-        def authorize_transfer!(request:, peer:, role:, deadline:)
-          @lifecycle.authorize_transfer!(request: request, peer: peer, role: role)
-        end
-
-        def dispatch_lifecycle(request:, peer:, role:, deadline:, transfer: nil)
-          options = {request: request, peer: peer, role: role}
-          options[:transfer] = transfer if transfer
-          @lifecycle.dispatch(**options)
-        end
-
-        # These closed read operations have no request body. Half-close proves
-        # framing completion before status or artifact data can be exposed.
-        def bodyless_read!(socket, deadline)
-          loop do
-            remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
-            raise ArgumentError, "read request framing is incomplete" unless remaining.positive? && IO.select([socket], nil, nil, remaining)
-            bytes = socket.read_nonblock(1, exception: false)
-            next if bytes == :wait_readable
-            raise ArgumentError, "unexpected read request body" unless bytes.nil?
-            return
-          end
-        end
-
-        def transfer_codec
-          @mutex.synchronize do
-            @transfer_codec ||= begin
-              root = @service.fetch("state_root")
-              PrivateDirectory.verify!(root)
-              spool = File.join(root, "transfers")
-              Dir.mkdir(spool, 0o700) unless File.exist?(spool) || File.symlink?(spool)
-              TransferCodec.new(root: spool)
-            end
-          end
-        end
-
-        def refusal(socket, code)
-          wire.write(socket, {"status" => "error", "error" => {"code" => code, "message" => "Protected authority refused #{code}"}},
-            deadline: wire.deadline(0.1))
-        rescue StandardError
-          nil
-        end
-
-        def wire
-          Ace::Runtime::Molecules::ProtectedSocket
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/task_context_entry.rb

@@ -1,32 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Authority
-      # Structural admission of source-owned pins. Artifact authentication belongs
-      # to the selected entry owner; these references are never an execution grant.
-      module TaskContextEntry
-        LIMITS = {"manifest" => 65_536, "wrapper" => 33_554_432}.freeze
-
-        def self.validate!(value)
-          unless value.is_a?(Hash) && value.keys.sort == LIMITS.keys.sort
-            raise ArgumentError, "task context entry fields differ"
-          end
-          LIMITS.each do |key, limit|
-            reference = value[key]
-            unless reference.is_a?(Hash) && reference.keys.sort == %w[bytes path sha256] &&
-                reference["bytes"].is_a?(Integer) && reference["bytes"].between?(1, limit) &&
-                reference["sha256"].is_a?(String) && reference["sha256"].match?(/\A[0-9a-f]{64}\z/) &&
-                reference["path"].is_a?(String) && reference["path"].encoding == Encoding::UTF_8 &&
-                reference["path"].valid_encoding? && reference["path"].bytesize.between?(2, 4096) &&
-                !reference["path"].include?("\0") && reference["path"].start_with?("/") &&
-                File.expand_path(reference["path"]) == reference["path"]
-              raise ArgumentError, "task context entry reference differs"
-            end
-          end
-          value
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/transfer_codec.rb

@@ -1,189 +0,0 @@
-# frozen_string_literal: true
-
-require "digest"
-require "tempfile"
-require "timeout"
-require "ace/runtime/molecules/protected_socket"
-require_relative "private_directory"
-require_relative "../atoms/candidate_limits"
-
-module Ace
-  module Assign
-    module Authority
-      # Binary framing after the existing authenticated control header. The
-      # Server selects purpose from a source handler's fixed operation table,
-      # admits a transfer slot before calling, and holds no journal lock here.
-      class TransferCodec
-        LIMITS = {prompt_text: [16_384, 1, 16_384], scope_boundary_observation: [65_536, 1, 65_536], candidate: [Atoms::CandidateLimits::BYTES, 1, Atoms::CandidateLimits::BYTES],
-                  release_artifact: [64 * 1024 * 1024, 1, 64 * 1024 * 1024],
-                  artifacts: [256 * 1024, 16, 64 * 1024],
-                  receipt_artifacts: [272 * 1024, 17, 64 * 1024],
-                  service_input: [64 * 1024, 1, 64 * 1024], assignment_snapshot: [Atoms::CandidateLimits::BYTES, 1, Atoms::CandidateLimits::BYTES]}.freeze
-        SHA256 = /\A[0-9a-f]{64}\z/
-
-        class Input
-          def initialize(file, descriptor)
-            @file, @descriptor = file, descriptor
-          end
-
-          def bytes(index: 0)
-            unless index.is_a?(Integer) && index.between?(0, count - 1)
-              raise ArgumentError, "Invalid transferred part index"
-            end
-            part = @descriptor.fetch("parts").fetch(index)
-            offset = @descriptor.fetch("parts").take(index).sum { |entry| entry.fetch("bytes") }
-            @file.seek(offset)
-            bytes = (@file.read(part.fetch("bytes")) || "").b
-            unless bytes.bytesize == part["bytes"] && Digest::SHA256.hexdigest(bytes) == part["sha256"]
-              raise AttemptErrors::ReceiptRejected, "Transferred bytes no longer match accepted binding"
-            end
-            bytes
-          end
-
-          def count
-            @descriptor.fetch("parts").length
-          end
-        end
-
-        def initialize(root: nil)
-          @root = root && PrivateDirectory.verify!(root)
-        end
-
-        # Upload write-EOF is required before invoking the mutation consumer.
-        # Persistent launch prompt streams use their fixed framed entry point below.
-        def receive(socket, descriptor:, purpose:, deadline:)
-          receive_parts(socket, descriptor: descriptor, purpose: purpose, deadline: deadline, eof: true) { |input| yield input }
-        end
-
-        # Fixed authenticated launch_control stream only. A declared exact
-        # prompt body is followed by the next bounded control frame; unlike
-        # public uploads, this private duplex connection remains writable.
-        def receive_launch_prompt(socket, descriptor:, transfer_id:, deadline:)
-          deadline = [deadline, Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30].min
-          marker = launch_prompt_marker(transfer_id)
-          receive_parts(socket, descriptor: descriptor, purpose: :prompt_text, deadline: deadline, eof: false) do |input|
-            boundary = Ace::Runtime::Molecules::ProtectedSocket.read(socket, deadline: deadline, limit: 16_384, with_size: true)
-            unless boundary.fetch(:data) == marker && boundary.fetch(:bytesize) == (JSON.generate(marker) + "\n").bytesize
-              reject!("Private prompt boundary differs")
-            end
-            yield input
-          end
-        end
-
-        def send_launch_prompt(socket, bytes:, descriptor:, transfer_id:, deadline:)
-          deadline = [deadline, Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30].min
-          marker = launch_prompt_marker(transfer_id)
-          send(socket, parts: [bytes], descriptor: descriptor, purpose: :prompt_text, deadline: deadline)
-          Ace::Runtime::Molecules::ProtectedSocket.write(socket, marker, deadline: deadline, limit: 16_384)
-        end
-
-        def launch_prompt_marker(transfer_id)
-          unless transfer_id.is_a?(String) && transfer_id.match?(/\A[0-9a-f]{32}\z/)
-            raise ArgumentError, "invalid private prompt transfer identity"
-          end
-          {"type" => "launch_prompt_end", "transfer_id" => transfer_id}
-        end
-        private :launch_prompt_marker
-
-        def receive_parts(socket, descriptor:, purpose:, deadline:, eof:)
-          validate!(descriptor, purpose)
-          descriptor = descriptor.merge("parts" => descriptor.fetch("parts").map { |part| part.dup.freeze }.freeze).freeze
-          deadline = [deadline, Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30].min
-          raise ArgumentError, "receive requires protected source scratch" unless @root
-          PrivateDirectory.verify!(@root)
-          Tempfile.create(["transfer-", ".bytes"], @root, binmode: true) do |file|
-            digest = Digest::SHA256.new
-            descriptor.fetch("parts").each do |part|
-              part_digest = Digest::SHA256.new
-              remaining = part.fetch("bytes")
-              while remaining.positive?
-                chunk = read(socket, [remaining, 65_536].min, deadline)
-                reject!("Transferred bytes ended early") if chunk.nil?
-                file.write(chunk)
-                digest.update(chunk)
-                part_digest.update(chunk)
-                remaining -= chunk.bytesize
-              end
-              reject!("Transferred part digest differs") unless part_digest.hexdigest == part["sha256"]
-            end
-            reject!("Transferred aggregate digest differs") unless digest.hexdigest == descriptor["sha256"]
-            reject!("Transferred bytes exceed declared size") if eof && !read(socket, 1, deadline).nil?
-            file.flush
-            file.rewind
-            yield Input.new(file, descriptor)
-          end
-        end
-        private :receive_parts
-
-        def descriptor(parts, purpose:)
-          reject!("Invalid transfer parts") unless parts.is_a?(Array) && parts.all? { |part| part.is_a?(String) }
-          digest = Digest::SHA256.new
-          parts.each { |part| digest.update(part.b) }
-          result = {"version" => 1, "bytes" => parts.sum(&:bytesize), "sha256" => digest.hexdigest,
-                    "parts" => parts.map { |part| {"bytes" => part.bytesize, "sha256" => Digest::SHA256.hexdigest(part.b)} }}
-          validate!(result, purpose)
-          result
-        end
-
-        # The caller writes the bounded JSON descriptor first, then these raw
-        # bytes. Both directions share the Server's original monotonic deadline.
-        def send(socket, parts:, descriptor:, purpose:, deadline:)
-          expected = self.descriptor(parts, purpose: purpose)
-          reject!("Export descriptor differs from bytes") unless expected == descriptor
-          deadline = [deadline, Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30].min
-          parts.each do |part|
-            offset = 0
-            while offset < part.bytesize
-              wait(socket, deadline, write: true)
-              written = socket.write_nonblock(part.byteslice(offset, [65_536, part.bytesize - offset].min), exception: false)
-              offset += written unless written == :wait_writable
-            end
-          end
-        end
-
-        def validate!(descriptor, purpose)
-          total, count, each = LIMITS.fetch(purpose) { reject!("Unknown source transfer purpose") }
-          unless descriptor.is_a?(Hash) && descriptor.keys.sort == %w[bytes parts sha256 version] &&
-              descriptor["version"] == 1 && descriptor["bytes"].is_a?(Integer) &&
-              descriptor["bytes"].between?(0, total) && descriptor["sha256"].is_a?(String) && descriptor["sha256"].match?(SHA256) &&
-              descriptor["parts"].is_a?(Array) && descriptor["parts"].length.between?(1, count) &&
-              descriptor["parts"].all? { |part| part.is_a?(Hash) && part.keys.sort == %w[bytes sha256] &&
-                part["bytes"].is_a?(Integer) && part["bytes"].between?(0, each) &&
-                part["sha256"].is_a?(String) && part["sha256"].match?(SHA256) } &&
-              descriptor["bytes"] == descriptor["parts"].sum { |part| part["bytes"] } &&
-              (!%i[candidate service_input prompt_text assignment_snapshot release_artifact].include?(purpose) || descriptor["bytes"].positive?)
-            reject!("Invalid or oversized transfer descriptor")
-          end
-          if purpose == :receipt_artifacts
-            receipt, *evidence = descriptor.fetch("parts")
-            unless receipt.fetch("bytes").between?(1, 16 * 1024) && evidence.sum { |part| part.fetch("bytes") } <= 256 * 1024
-              reject!("Receipt or evidence exceeds its fixed transfer limit")
-            end
-          end
-          true
-        end
-
-        private
-
-        def read(socket, count, deadline)
-          loop do
-            wait(socket, deadline)
-            bytes = socket.read_nonblock(count, exception: false)
-            return bytes unless bytes == :wait_readable
-          end
-        end
-
-        def wait(socket, deadline, write: false)
-          remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
-          raise Timeout::Error, "Transfer deadline exceeded" unless remaining.positive?
-          ready = IO.select(write ? nil : [socket], write ? [socket] : nil, nil, remaining)
-          raise Timeout::Error, "Transfer deadline exceeded" unless ready
-        end
-
-        def reject!(message)
-          raise AttemptErrors::MalformedTransfer, message
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/attempt/base.rb

@@ -1,84 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require_relative "../../../authority/protected_assignment_context"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        # Public `ace-assign attempt` command namespace (interface contract:
-        # start, status, finish, reconcile).
-        module Attempt
-          # Shared coordinator construction, option validation, and JSON output.
-          module Base
-            private
-
-            def protected_context(options)
-              keys = %i[mapping assignment result head candidate_generation mutation expected_generation inbox_context registration signature]
-              keys.each do |key|
-                if options.key?(key) && options[key].to_s.strip.empty?
-                  raise Ace::Support::Cli::Error, "Empty protected --#{key.to_s.tr('_', '-')} selector"
-                end
-              end
-              context = @protected_assignment_context ||= Ace::Assign::Authority::ProtectedAssignmentContext.load
-              selected = keys.any? do |key|
-                options.key?(key)
-              end
-              context if context.protected_participant? || selected || context.mapping_hint?
-            rescue SecurityError, Ace::Runtime::RuntimeUnavailableError
-              protected_transport_unavailable!
-            end
-
-            def protected_attempt_request(context, options, usage)
-              params = {"assignment_id" => require_option(options, :assignment, usage),
-                "attempt_id" => require_option(options, :attempt, usage),
-                "expected_generation" => integer_option(options, :expected_generation, usage)}
-              context.verify_attempt_hints!(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"))
-              [context.client(options: options), params, require_option(options, :mutation, usage)]
-            rescue SecurityError, Ace::Runtime::RuntimeUnavailableError
-              protected_transport_unavailable!
-            end
-
-            def protected_call(client, operation, params, mutation)
-              client.call(operation, params, mutation_id: mutation, timeout: 30).data
-            rescue SecurityError, Ace::Runtime::RuntimeUnavailableError
-              protected_transport_unavailable!
-            end
-
-            def protected_transport_unavailable!
-              raise AttemptErrors::EvidenceUnavailable, "Protected authority outcome unavailable; retain original selectors and mutation for reconciliation"
-            end
-
-            def integer_option(options, key, usage, positive: false)
-              value = options[key]
-              unless value.is_a?(Integer) || (value.is_a?(String) && value.match?(/\A(?:0|[1-9][0-9]*)\z/))
-                raise Ace::Support::Cli::Error, "--#{key.to_s.tr('_', '-')} requires an exact integer: #{usage}"
-              end
-              number = value.is_a?(Integer) ? value : Integer(value, 10)
-              unless positive ? number.positive? : number >= 0
-                raise Ace::Support::Cli::Error, "--#{key.to_s.tr('_', '-')} is out of range"
-              end
-              number
-            end
-
-            def build_coordinator
-              Organisms::AttemptCoordinator.new
-            end
-
-            def require_option(options, key, usage)
-              value = options[key].to_s.strip
-              raise Ace::Support::Cli::Error, "Missing --#{key}: usage: ace-assign attempt #{usage}" if value.empty?
-
-              value
-            end
-
-            def emit_json(payload)
-              puts JSON.generate(payload)
-            end
-          end
-        end
-      end
-    end
-  end
-end