ace-assign 0.71.0 → 0.73.0

data/lib/ace/assign/molecules/canonical_attempt_state.rb

@@ -1,151 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "execution_scope_lineage"
-require_relative "../atoms/attempt_state_machine"
-
-module Ace
-  module Assign
-    module Molecules
-      # Canonical state projection, not live closure or settlement authority.
-      # The stopped producer and terminal consumer must additionally obtain the
-      # existing owners' authenticated original-prefix evidence and fresh proof.
-      module CanonicalAttemptState
-        STOPPED_FIELDS = %w[project_id mapping_id assignment_id attempt_id descriptor_sha256
-          scope_binding_event_id seal_event_id closed_proof_event_id service_settlement_event_digests].freeze
-        SELECTION_FIELDS = (STOPPED_FIELDS - %w[service_settlement_event_digests]).freeze
-
-        def self.derive(events)
-          return nil unless events.any? { |event| event["type"] == "intent" }
-          state = "reserved"
-          stopped = false
-          events.each do |event|
-            if stopped && %w[process_start receipt_accepted transition reconciliation attempt_stopped].include?(event["type"])
-              unavailable!("Accepted stopped attempt cannot be resurrected or replaced")
-            end
-            case event["type"]
-            when "process_start" then state = "running"
-            when "receipt_accepted" then state = event.dig("payload", "receipt", "verdict") || state
-            when "transition" then state = event.dig("payload", "to") || state
-            when "reconciliation" then state = event.dig("payload", "resolution") || state
-            when "attempt_stopped"
-              verify_stopped_acceptance!(events, event, prior_state: state)
-              state = "stopped"
-              stopped = true
-            end
-          end
-          state
-        end
-
-        def self.stopped_payload!(events:, selection:, service_evidence:, commit:)
-          unless selection.is_a?(Hash) && selection.keys.sort == SELECTION_FIELDS.sort &&
-              service_evidence.is_a?(Hash) && service_evidence.keys.sort == %w[commit services] &&
-              commit.is_a?(String) && commit.match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
-              service_evidence["commit"] == commit
-            unavailable!("Stopped plan evidence prefix differs")
-          end
-          services = service_evidence.fetch("services")
-          unless services.is_a?(Array) &&
-              services.all? { |item| item.is_a?(Hash) && item.keys.sort == %w[event_digest evidence_refs receipt_digest record_digest request_id state] }
-            unavailable!("Stopped settlement projections are malformed")
-          end
-          service_ids = services.map { |item| item.fetch("request_id") }
-          unless service_ids == service_ids.sort && service_ids.uniq == service_ids
-            unavailable!("Stopped settlement projection is not ordered unique owner output")
-          end
-          services.each do |item|
-            event = events.find { |entry| entry["digest"] == item.fetch("event_digest") && entry["type"] == "service_transition" }
-            unless event && event.dig("payload", "request_id") == item.fetch("request_id") &&
-                event.dig("payload", "state") == item.fetch("state") && %w[succeeded failed-settled].include?(item.fetch("state")) &&
-                event.dig("payload", "record_digest") == item.fetch("record_digest") &&
-                event.dig("payload", "receipt_digest") == item.fetch("receipt_digest")
-              unavailable!("Stopped service projection differs from canonical terminal event")
-            end
-          end
-          payload = selection.merge("service_settlement_event_digests" => services.map { |item| item.fetch("event_digest") }.sort)
-          validate_stopped_payload!(events, payload)
-          payload
-        rescue KeyError, TypeError, ArgumentError, NoMethodError
-          unavailable!("Stopped plan evidence is malformed")
-        end
-
-        def self.verify_stopped_acceptance!(events, event, prior_state:)
-          Atoms::AttemptStateMachine.proof_stopped_transition!(prior_state)
-          unless events.count { |entry| entry["type"] == "attempt_stopped" } == 1 && Models::EvidenceEvent.chain_valid?(events)
-            unavailable!("Stopped canonical chain is ambiguous or corrupt")
-          end
-          payload = event.fetch("payload")
-          prefix = events.take_while { |entry| entry["digest"] != event.fetch("digest") }
-          validate_stopped_payload!(prefix, payload)
-          acceptance = events.find { |entry| entry["type"] == "authority_mutation" && entry["previous_digest"] == event.fetch("digest") }
-          data = acceptance&.dig("payload", "data")
-          generation = acceptance && events.take_while { |entry| entry["digest"] != acceptance["digest"] }.count { |entry| entry["type"] == "authority_mutation" } + 1
-          unless acceptance && data.is_a?(Hash) && data.keys.sort == %w[attempt_id generation proof_id required_action state] &&
-              data["generation"].is_a?(Integer) && data["generation"] == generation &&
-              acceptance.dig("payload", "operation") == "stop_attempt" &&
-              acceptance.dig("payload", "assignment_id") == payload.fetch("assignment_id") &&
-              acceptance.dig("payload", "attempt_id") == payload.fetch("attempt_id") &&
-              acceptance.dig("payload", "data", "attempt_id") == payload.fetch("attempt_id") &&
-              acceptance.dig("payload", "data", "state") == "stopped" &&
-              acceptance.dig("payload", "data", "proof_id") == payload.fetch("closed_proof_event_id") &&
-              acceptance.dig("payload", "data", "required_action").nil?
-            unavailable!("Stopped transition has no adjacent accepted owner mutation")
-          end
-          seal = prefix.find { |entry| entry["digest"] == payload.fetch("seal_event_id") }
-          accepted_seal = seal && prefix.find { |entry| entry["type"] == "authority_mutation" && entry["previous_digest"] == seal["digest"] &&
-            %w[close_execution_scope stop_attempt].include?(entry.dig("payload", "operation")) }
-          proof = prefix.find { |entry| entry["digest"] == payload.fetch("closed_proof_event_id") }
-          accepted_proof = proof && prefix.find { |entry| entry["type"] == "authority_mutation" && entry["previous_digest"] == proof["digest"] &&
-            %w[close_execution_scope stop_attempt].include?(entry.dig("payload", "operation")) &&
-            entry.dig("payload", "data", "proof_id") == proof["digest"] &&
-            (entry.dig("payload", "operation") == "close_execution_scope" ?
-              entry.dig("payload", "data", "state") == "closed_no_writers" :
-              entry.dig("payload", "data").is_a?(Hash) && entry.dig("payload", "data").keys.sort == %w[attempt_id generation proof_id required_action state] &&
-                entry.dig("payload", "data", "attempt_id") == payload.fetch("attempt_id") &&
-                entry.dig("payload", "data", "generation").is_a?(Integer) &&
-                entry.dig("payload", "data", "generation") == prefix.take_while { |item| item["digest"] != entry["digest"] }.count { |item| item["type"] == "authority_mutation" } + 1 &&
-                entry.dig("payload", "data", "state") == "uncertain" &&
-                entry.dig("payload", "data", "required_action") == "reconcile_scope") }
-          unless accepted_seal && (accepted_proof || event["previous_digest"] == proof&.fetch("digest"))
-            unavailable!("Stopped canonical seal or proof has no accepted owner")
-          end
-          event
-        rescue KeyError, TypeError, ArgumentError, NoMethodError, AttemptErrors::InvalidTransition
-          unavailable!("Stopped canonical acceptance is malformed")
-        end
-
-        def self.validate_stopped_payload!(events, payload)
-          unless payload.is_a?(Hash) && payload.keys.sort == STOPPED_FIELDS.sort &&
-              %w[project_id mapping_id assignment_id attempt_id].all? { |key| payload[key].is_a?(String) && ExecutionScopeLineage::ID.match?(payload[key]) } &&
-              %w[descriptor_sha256 scope_binding_event_id seal_event_id closed_proof_event_id].all? { |key| digest?(payload[key]) } &&
-              %w[service_settlement_event_digests].all? { |key|
-                values = payload[key]
-                values.is_a?(Array) && values.all? { |value| digest?(value) } && values == values.sort && values.uniq == values }
-            unavailable!("Stopped canonical payload is not closed")
-          end
-          lineage = ExecutionScopeLineage.new(events: events, **payload.slice("project_id", "mapping_id", "assignment_id", "attempt_id").transform_keys(&:to_sym))
-          provisioning = events.select { |event| event["type"] == "scope_provisioning" }
-          unless provisioning.one? && provisioning.first.dig("payload", "descriptor_sha256") == payload.fetch("descriptor_sha256") &&
-              lineage.native_event && lineage.child_event &&
-              lineage.binding_event&.fetch("digest") == payload.fetch("scope_binding_event_id") &&
-              lineage.seal_event&.fetch("digest") == payload.fetch("seal_event_id") &&
-              lineage.proof_event&.fetch("digest") == payload.fetch("closed_proof_event_id")
-            unavailable!("Stopped canonical original scope selectors differ")
-          end
-          payload.fetch("service_settlement_event_digests").each do |digest|
-            unless events.any? { |event| event["digest"] == digest && event["type"] == "service_transition" &&
-                %w[succeeded failed-settled].include?(event.dig("payload", "state")) }
-              unavailable!("Stopped canonical service selector is not terminal evidence")
-            end
-          end
-          payload
-        rescue KeyError, TypeError, ArgumentError, NoMethodError
-          unavailable!("Stopped canonical scope is malformed")
-        end
-
-        def self.digest?(value) = value.is_a?(String) && ExecutionScopeLineage::DIGEST.match?(value)
-        def self.unavailable!(message) = raise AttemptErrors::EvidenceUnavailable, message
-        private_class_method :digest?, :unavailable!
-      end
-    end
-  end
-end

data/lib/ace/assign/molecules/canonical_evidence.rb

@@ -1,170 +0,0 @@
-# frozen_string_literal: true
-
-require "digest"
-require "securerandom"
-require "time"
-
-module Ace
-  module Assign
-    module Molecules
-      # One import/verification contract for protected review, service and
-      # inbox evidence. Filesystem projections never supply accepted bytes.
-      class CanonicalEvidence
-        MAX_ARTIFACT_BYTES = 64 * 1024
-        MAX_TOTAL_BYTES = 256 * 1024
-        MAX_ARTIFACTS = 16
-        ID = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/
-        MAX_RELEASE_ARTIFACT_BYTES = 64 * 1024 * 1024
-        ROLES = {"service" => "executor", "review" => "reviewer",
-                 "result" => "worker", "release-artifact" => "worker"}.freeze
-        REPORT_LIMITS = [MAX_ARTIFACT_BYTES, MAX_TOTAL_BYTES, MAX_ARTIFACTS].freeze
-        LIMITS = {"service" => REPORT_LIMITS, "review" => REPORT_LIMITS, "result" => REPORT_LIMITS,
-          "release-artifact" => [MAX_RELEASE_ARTIFACT_BYTES, MAX_RELEASE_ARTIFACT_BYTES, 1].freeze}.freeze
-        DESCRIPTOR_FIELDS = %w[version artifact_id kind project_id assignment_id attempt_id peer_uid role
-          binding_digest sha256 bytes admitted_at admitted_after_event_digest request_id_or_event_id
-          candidate_generation_or_claim_generation].freeze
-
-        # Shared closed descriptor validation before clients accept any bytes.
-        def self.valid_descriptor?(descriptor)
-          return false unless descriptor.is_a?(Hash) && descriptor.keys.sort == DESCRIPTOR_FIELDS.sort &&
-            descriptor["version"] == 1 && ROLES.key?(descriptor["kind"]) && ROLES[descriptor["kind"]] == descriptor["role"] &&
-            %w[artifact_id project_id assignment_id attempt_id request_id_or_event_id].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(ID) } &&
-            %w[binding_digest sha256 admitted_after_event_digest].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(/\A[0-9a-f]{64}\z/) } &&
-            descriptor["peer_uid"].is_a?(Integer) && descriptor["peer_uid"] >= 0 &&
-            descriptor["bytes"].is_a?(Integer) && descriptor["bytes"].between?(descriptor["kind"] == "release-artifact" ? 1 : 0,
-              LIMITS.fetch(descriptor["kind"]).first) &&
-            descriptor["candidate_generation_or_claim_generation"].is_a?(Integer) && descriptor["candidate_generation_or_claim_generation"] >= 0 &&
-            descriptor["admitted_at"].is_a?(String)
-          Time.iso8601(descriptor.fetch("admitted_at"))
-          true
-        rescue ArgumentError, TypeError
-          false
-        end
-
-        def initialize(journal:)
-          @journal = journal
-        end
-
-        # Construct the immutable bytes/events for EvidenceJournal#mutate.
-        # peer_uid comes from the accepted kernel-authenticated connection;
-        # callers of the wire API cannot supply provenance or artifact IDs.
-        def import_plan(kind:, project_id:, assignment_id:, attempt_id:, peer_uid:, binding:,
-          request_id_or_event_id:, generation:, admitted_after_event_digest:, artifacts:)
-          role = ROLES.fetch(kind) { raise ArgumentError, "invalid evidence kind" }
-          max_each, max_total, max_count = LIMITS.fetch(kind)
-          minimum = kind == "release-artifact" ? 1 : 0
-          ids = [project_id, assignment_id, attempt_id, request_id_or_event_id]
-          unless ids.all? { |id| id.is_a?(String) && id.match?(ID) } && binding.is_a?(Hash) &&
-              admitted_after_event_digest.is_a?(String) && admitted_after_event_digest.match?(/\A[0-9a-f]{64}\z/) &&
-              peer_uid.is_a?(Integer) && peer_uid >= 0 && generation.is_a?(Integer) && generation >= 0 &&
-              artifacts.is_a?(Array) && !artifacts.empty? && artifacts.length <= max_count &&
-              artifacts.all? { |bytes| bytes.is_a?(String) && bytes.bytesize.between?(minimum, max_each) } &&
-              artifacts.sum(&:bytesize) <= max_total
-            raise ArgumentError, "invalid or oversized canonical evidence import"
-          end
-          events = []
-          blobs = {}
-          references = artifacts.map do |bytes|
-            artifact_id = SecureRandom.hex(16)
-            artifact_id += "-no-effect" if kind == "service" && binding["no_effect_challenge"]
-            digest = Digest::SHA256.hexdigest(bytes.b)
-            path = "evidence/imports/#{artifact_id}"
-            descriptor = {"version" => 1, "artifact_id" => artifact_id, "kind" => kind,
-                          "project_id" => project_id, "assignment_id" => assignment_id,
-                          "attempt_id" => attempt_id, "peer_uid" => peer_uid, "role" => role,
-                          "binding_digest" => Atoms::EvidenceDigest.digest(binding), "sha256" => digest,
-                          "bytes" => bytes.bytesize, "admitted_at" => Time.now.utc.iso8601(9),
-                          "admitted_after_event_digest" => admitted_after_event_digest,
-                          "request_id_or_event_id" => request_id_or_event_id,
-                          "candidate_generation_or_claim_generation" => generation}
-            events << {type: "evidence_import", payload: descriptor}
-            blobs[path] = bytes.b
-            {"ref" => path, "sha256" => digest}
-          end
-          {events: events, blobs: blobs, references: references}
-        end
-
-        def read(reference, kind:, project_id:, assignment_id:, attempt_id:, peer_uid:, binding:,
-          request_id_or_event_id:, generation:, commit: @journal.ref_value)
-          # One immutable commit supplies both provenance events and bytes.
-          events = @journal.read_events(assignment_id, commit: commit)
-            .select { |event| event["attempt_id"] == attempt_id }
-          verified_bytes(reference, events: events, kind: kind, project_id: project_id,
-            assignment_id: assignment_id, attempt_id: attempt_id, peer_uid: peer_uid, binding: binding,
-            request_id_or_event_id: request_id_or_event_id, generation: generation) do |path|
-            if kind == "release-artifact"
-              @journal.bounded_blob(path, commit: commit, max_bytes: MAX_RELEASE_ARTIFACT_BYTES)
-            else
-              @journal.blob(path, commit: commit)
-            end
-          end
-        end
-
-        # Only the journal writer supplies this transient pre-CAS view. It
-        # validates the exact same provenance/chain/bytes as committed reads;
-        # it does not accept a receipt or advance the canonical ref itself.
-        def read_pending(reference, current_events:, pending_events:, blobs:, commit:,
-          kind:, project_id:, assignment_id:, attempt_id:, peer_uid:, binding:,
-          request_id_or_event_id:, generation:)
-          events = current_events + pending_events
-          unless events.all? { |event| event["attempt_id"] == attempt_id } && blobs.is_a?(Hash)
-            unavailable!
-          end
-          verified_bytes(reference, events: events, kind: kind, project_id: project_id,
-            assignment_id: assignment_id, attempt_id: attempt_id, peer_uid: peer_uid, binding: binding,
-            request_id_or_event_id: request_id_or_event_id, generation: generation) do |path|
-            if blobs.key?(path)
-              blobs.fetch(path)
-            elsif kind == "release-artifact"
-              @journal.bounded_blob(path, commit: commit, max_bytes: MAX_RELEASE_ARTIFACT_BYTES)
-            else
-              @journal.blob(path, commit: commit)
-            end
-          end
-        end
-
-        private
-
-        def verified_bytes(reference, events:, kind:, project_id:, assignment_id:, attempt_id:, peer_uid:, binding:,
-          request_id_or_event_id:, generation:)
-          unless reference.is_a?(Hash) && reference.keys.sort == %w[ref sha256] &&
-              reference["ref"].is_a?(String) && reference["ref"].match?(%r{\Aevidence/imports/[a-z0-9-]+\z})
-            unavailable!
-          end
-          unavailable! unless Models::EvidenceEvent.chain_valid?(events)
-          artifact_id = reference.fetch("ref").delete_prefix("evidence/imports/")
-          imports = events.select do |event|
-            event["type"] == "evidence_import" && event.dig("payload", "artifact_id") == artifact_id
-          end
-          unavailable! unless imports.length == 1
-          event = imports.first
-          descriptor = event.fetch("payload")
-          expected = {"version" => 1, "artifact_id" => artifact_id, "kind" => kind,
-                      "project_id" => project_id, "assignment_id" => assignment_id,
-                      "attempt_id" => attempt_id, "peer_uid" => peer_uid, "role" => ROLES.fetch(kind),
-                      "binding_digest" => Atoms::EvidenceDigest.digest(binding),
-                      "sha256" => reference.fetch("sha256"), "request_id_or_event_id" => request_id_or_event_id,
-                      "candidate_generation_or_claim_generation" => generation}
-          unavailable! unless self.class.valid_descriptor?(descriptor) &&
-            expected.all? { |key, value| descriptor[key] == value }
-          before = events.take_while { |entry| entry["digest"] != event["digest"] }
-          unavailable! unless before.any? { |entry| entry["digest"] == descriptor["admitted_after_event_digest"] }
-          if kind == "service" && binding["no_effect_challenge"]
-            unavailable! unless descriptor["admitted_after_event_digest"] == binding.fetch("challenge_event_digest")
-          end
-          Time.iso8601(descriptor.fetch("admitted_at"))
-          bytes = yield(reference.fetch("ref"))
-          unavailable! unless bytes.is_a?(String) && bytes.bytesize <= LIMITS.fetch(kind).first && bytes.bytesize == descriptor["bytes"] &&
-            Digest::SHA256.hexdigest(bytes) == descriptor["sha256"]
-          bytes
-        rescue ArgumentError, KeyError, TypeError
-          unavailable!
-        end
-
-        def unavailable!
-          raise AttemptErrors::EvidenceUnavailable, "Canonical evidence import or binding is unverifiable"
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/molecules/canonical_read_commands.rb

@@ -1,84 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Molecules
-      # Closed bounded read dialect shared by isolated protected snapshots and
-      # trusted installed journals. Neither boundary can dispatch a Git write.
-      module CanonicalReadCommands
-        BYTE_LIMIT = 256 * 1_048_576
-        OID = /\A[0-9a-f]{40}\z/
-
-        attr_reader :commit
-
-        # EvidenceJournal uses this only as its existing read command boundary.
-        def call(argv, stdin_data: "", output_limit: BYTE_LIMIT)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless read_command?(argv, stdin_data)
-            refuse!("write_or_unsupported_command")
-          end
-          result = read_result(argv, stdin_data: stdin_data, limit: [output_limit, BYTE_LIMIT].min)
-          [result.stdout.to_s.strip, result.stderr.to_s.strip, result.status]
-        end
-
-        def blob_batch(entries, output_limit:)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless entries.is_a?(Array) && entries.all? { |oid| oid.is_a?(String) && oid.match?(OID) }
-            refuse!("unsupported_command")
-          end
-          result = run!(["cat-file", "--batch"], stdin_data: entries.join("\n") + "\n",
-            limit: [output_limit, BYTE_LIMIT].min)
-          result.stdout.to_s.b
-        end
-
-        def history_diff(commits, paths, output_limit:)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless commits.is_a?(Array) && commits.size.between?(1, 64) && commits.uniq.size == commits.size &&
-              commits.all? { |commit| commit.is_a?(String) && commit.match?(OID) } &&
-              paths.is_a?(Array) && !paths.empty? && paths.uniq.size == paths.size &&
-              (paths == ["execution/"] || paths.all? { |path| path.is_a?(String) && path.match?(%r{\Aexecution/[a-zA-Z0-9_.:-]+/events/\z}) }) &&
-              output_limit.is_a?(Integer) && output_limit.positive?
-            refuse!("unsupported_command")
-          end
-          result = run!(%w[diff-tree --stdin --always --root -r --raw -z --no-renames --no-ext-diff
-            --no-textconv --no-abbrev --] + paths, stdin_data: commits.join("\n") + "\n",
-            limit: [output_limit, BYTE_LIMIT].min)
-          result.stdout.to_s.b
-        end
-
-        def blob_sizes(oids)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless oids.is_a?(Array) && oids.size.between?(1, 64) && oids.all? { |oid| oid.is_a?(String) && oid.match?(OID) }
-            refuse!("unsupported_command")
-          end
-          run!(%w[cat-file --batch-check], stdin_data: oids.join("\n") + "\n", limit: oids.size * 128).stdout.to_s.b
-        end
-
-        def blob(path, commit:, max_bytes:)
-          refuse!("read_outside_snapshot") unless @view && @commit
-          unless commit.is_a?(String) && commit.match?(OID) && max_bytes.is_a?(Integer) && max_bytes.positive?
-            refuse!("unsupported_command")
-          end
-          result = run!(["cat-file", "blob", "#{commit}:#{path}"], limit: [max_bytes, BYTE_LIMIT].min)
-          result.stdout.to_s.b
-        end
-
-        private
-
-        def read_result(argv, **options)
-          run!(argv, **options)
-        end
-
-        def read_command?(argv, stdin)
-          return false unless argv.is_a?(Array) && argv.all? { |item| item.is_a?(String) && !item.include?("\0") } && stdin.empty?
-          allowed = {"rev-parse" => %w[--verify --quiet --git-dir], "cat-file" => %w[-t -s blob],
-            "rev-list" => %w[--first-parent --parents], "ls-tree" => %w[-r -l -d --name-only --],
-            "show" => [], "log" => %w[--diff-filter=A -1 --format=%H --]}
-          flags = allowed[argv.first]
-          flags && argv.drop(1).all? { |item| !item.start_with?("-") || flags.include?(item) || item == "--max-count=100001" }
-        end
-
-      end
-    end
-  end
-end