ace-assign 0.71.0 → 0.73.1

data/lib/ace/assign/authority/readiness_hook.rb

@@ -1,120 +0,0 @@
-# frozen_string_literal: true
-require "ace/runtime/molecules/execution_network_selection"
-require "socket"
-require_relative "../errors"
-require "ace/runtime/molecules/readiness_configuration"
-require "ace/runtime/molecules/server_resource_observation"
-require "ace/runtime/molecules/protected_linux"
-require "ace/runtime/molecules/protected_socket"
-require_relative "transfer_codec"
-
-module Ace
-  module Assign
-    module Authority
-      # Fixed ExecStartPost action, deliberately independent of Deployment.load.
-      class ReadinessHook
-        class Files
-          def boundary_manifest!(config)
-            bytes = nil
-            Ace::Runtime::Molecules::ProtectedArtifactSet.new.with do |reader|
-              bytes, = reader.read_path!(config.dig("boundary_manifest", "path"), limit: 65_536)
-              unless Digest::SHA256.hexdigest(bytes) == config.dig("boundary_manifest", "sha256")
-                raise AttemptErrors::EvidenceUnavailable, "readiness boundary bytes differ"
-              end
-              reader.verify_unchanged!
-            end
-            bytes = bytes.dup.force_encoding(Encoding::UTF_8)
-            raise AttemptErrors::EvidenceUnavailable, "readiness boundary encoding differs" unless bytes.valid_encoding?
-            JSON.parse(bytes, create_additions: false, max_nesting: 8, allow_duplicate_key: false, allow_comments: false)
-          end
-
-          def verify_native!(server, config)
-            File.open("/proc/#{server.fetch('pid')}/exe", File::RDONLY) do |executable|
-              unless Digest::SHA256.hexdigest(executable.read(268_435_457)) == config.dig("native", "executable_sha256") &&
-                  File.read("/proc/#{server.fetch('pid')}/cmdline", 16_385).split("\0") == [config.dig("native", "executable"), "server"]
-                raise AttemptErrors::EvidenceUnavailable, "readiness native executable differs"
-              end
-            end
-          end
-        end
-
-        def initialize(slot:, configuration: nil, kernel: Ace::Runtime::Molecules::ProtectedLinux.new,
-          resources: nil, wire: Ace::Runtime::Molecules::ProtectedSocket, files: Files.new)
-          @configuration = configuration || Ace::Runtime::Molecules::ReadinessConfiguration.load(slot: slot)
-          @kernel, @wire = kernel, wire
-          @files = files
-          @resources = resources || Ace::Runtime::Molecules::ServerResourceObservation.new(kernel: kernel)
-        end
-
-        def run
-          config = @configuration.data
-          @kernel.supported!
-          hook = @kernel.capture(Process.pid)
-          expected = config.fetch("worker")
-          unless hook.values_at("uid", "gid", "groups") == expected.values_at("uid", "gid", "groups")
-            raise AttemptErrors::UnauthorizedIdentity, "readiness hook principal differs"
-          end
-          deadline = @wire.deadline(10)
-          authority = config.fetch("authority")
-          path = authority.fetch("socket_path")
-          @wire.root_path!(File.dirname(path), directory: true, owner: authority.fetch("uid"))
-          endpoint = @wire.socket_identity(path)
-          @wire.connect(path) do |socket|
-            peer = @kernel.peer(socket)
-            unless peer.values_at("uid", "gid", "groups") == authority.values_at("uid", "gid", "groups") &&
-                @wire.socket_identity(path) == endpoint
-              raise AttemptErrors::UnauthorizedIdentity, "readiness authority peer differs"
-            end
-            @wire.write(socket, {"version" => 1, "operation" => "native_readiness", "mutation_id" => nil,
-              "project_id" => config.fetch("project_id"), "params" => {"mapping_id" => config.fetch("mapping_id")}},
-              deadline: deadline, limit: 16_384)
-            challenge = @wire.read(socket, deadline: deadline, limit: 16_384)
-            unless challenge.is_a?(Hash) && challenge.keys.sort == %w[challenge_id server_identity version] &&
-                challenge["version"] == 1 && challenge["challenge_id"].is_a?(String) &&
-                challenge["challenge_id"].match?(/\A[0-9a-f]{64}\z/)
-              raise AttemptErrors::EvidenceUnavailable, "private readiness challenge differs"
-            end
-            manifest = @files.boundary_manifest!(config)
-            unless manifest.is_a?(Hash) && manifest.keys.sort == %w[network_installation resources schema slot_id] &&
-                manifest["schema"] == "ace.execution-boundary-manifest/v1" && manifest["slot_id"] == config.fetch("slot_id") &&
-                manifest["resources"].is_a?(Array) && manifest["resources"].size.between?(1, 64)
-              raise AttemptErrors::EvidenceUnavailable, "readiness boundary shape differs"
-            end
-            Ace::Runtime::Molecules::ExecutionNetworkSelection.validate_static!(manifest.fetch("network_installation"), slot_id: config.fetch("slot_id"))
-            manifest.fetch("resources").each do |entry|
-              paths = entry.is_a?(Hash) ? entry.values_at("host_path", "view_path") : []
-              unless entry.is_a?(Hash) && entry.keys.sort == %w[host_path read_only stage view_path worker_visible] &&
-                  paths.size == 2 && paths.all? { |path| path.is_a?(String) && path.bytesize.between?(1, 4096) && path.start_with?("/") && !path.include?("\0") && File.expand_path(path) == path } &&
-                  %w[parent native].include?(entry["stage"]) && [true, false].include?(entry["worker_visible"]) && [true, false].include?(entry["read_only"])
-                raise AttemptErrors::EvidenceUnavailable, "readiness resource declaration differs"
-              end
-            end
-            entries = manifest.fetch("resources").select { |entry| entry.fetch("worker_visible") }
-            server = challenge.fetch("server_identity")
-            @files.verify_native!(server, config)
-            report = @resources.observe!(server: server, entries: entries, authority_socket: path)
-            report = report.merge("version" => 1, "challenge_id" => challenge.fetch("challenge_id"),
-              "server_identity" => challenge.fetch("server_identity"), "resource_observer_identity" => hook)
-            bytes = JSON.generate(report)
-            codec = TransferCodec.new
-            transfer = codec.descriptor([bytes], purpose: :scope_boundary_observation)
-            @wire.write(socket, {"version" => 1, "challenge_id" => challenge.fetch("challenge_id"), "transfer" => transfer},
-              deadline: deadline, limit: 16_384)
-            codec.send(socket, parts: [bytes], descriptor: transfer, purpose: :scope_boundary_observation, deadline: deadline)
-            socket.shutdown(Socket::SHUT_WR)
-            acknowledgment = @wire.read(socket, deadline: deadline, limit: 16_384)
-            unless acknowledgment == {"version" => 1, "challenge_id" => challenge.fetch("challenge_id"), "status" => "ready"}
-              raise AttemptErrors::EvidenceUnavailable, "private readiness acknowledgement differs"
-            end
-            @kernel.live!(hook)
-            @kernel.live!(peer)
-            raise AttemptErrors::EvidenceUnavailable, "readiness endpoint changed" unless @wire.socket_identity(path) == endpoint
-          end
-          true
-        rescue SystemCallError, IOError, JSON::ParserError, KeyError, TypeError
-          raise AttemptErrors::EvidenceUnavailable, "private readiness observation unavailable"
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/receipt_transfer.rb

@@ -1,48 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require "digest"
-
-module Ace
-  module Assign
-    module Authority
-      # Receipt-first binary framing. Field names come from source operations,
-      # never from the wire. Artifact order and declared digests are exact.
-      module ReceiptTransfer
-        def self.decode(input:, receipt_sha256:, artifact_field:, reference_key:)
-          unless input && input.count.between?(1, 17) && %w[artifacts evidence].include?(artifact_field) &&
-              %w[path ref].include?(reference_key) && receipt_sha256.is_a?(String) && receipt_sha256.match?(/\A[0-9a-f]{64}\z/)
-            raise AttemptErrors::ReceiptRejected, "receipt transfer binding is invalid"
-          end
-          bytes = input.bytes(index: 0)
-          unless bytes.bytesize.between?(1, 16 * 1024) && Digest::SHA256.hexdigest(bytes) == receipt_sha256
-            raise AttemptErrors::ReceiptRejected, "first transfer part must be the exact receipt"
-          end
-          receipt = JSON.parse(bytes)
-          unless receipt.is_a?(Hash) && !Models::ExecutionReceipt.forbidden_field?(receipt)
-            raise AttemptErrors::ReceiptRejected, "receipt must contain bounded structured evidence"
-          end
-          references = receipt.fetch(artifact_field)
-          unless references.is_a?(Array) && references.length == input.count - 1 && references.length <= 16 &&
-              references.all? { |entry| entry.is_a?(Hash) && entry.keys.sort == [reference_key, "sha256"].sort &&
-                entry[reference_key].is_a?(String) && entry[reference_key].bytesize.between?(1, 256) &&
-                entry["sha256"].is_a?(String) && entry["sha256"].match?(/\A[0-9a-f]{64}\z/) } &&
-              references.map { |entry| entry[reference_key] }.uniq.length == references.length
-            raise AttemptErrors::ReceiptRejected, "receipt artifact parts are incomplete or duplicated"
-          end
-          artifacts = references.each_with_index.map do |reference, index|
-            artifact = input.bytes(index: index + 1)
-            unless artifact.bytesize <= 64 * 1024 && Digest::SHA256.hexdigest(artifact) == reference.fetch("sha256")
-              raise AttemptErrors::ReceiptRejected, "receipt artifact part differs from declaration"
-            end
-            artifact
-          end
-          raise AttemptErrors::ReceiptRejected, "receipt evidence exceeds its transfer limit" if artifacts.sum(&:bytesize) > 256 * 1024
-          {receipt: receipt, artifacts: artifacts, receipt_sha256: receipt_sha256}
-        rescue JSON::ParserError, KeyError
-          raise AttemptErrors::ReceiptRejected, "receipt transfer schema is invalid"
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/release_artifact_manifest.rb

@@ -1,91 +0,0 @@
-# frozen_string_literal: true
-
-require "digest"
-require "json"
-require "stringio"
-require "zlib"
-require "rubygems/package"
-require_relative "../molecules/canonical_evidence"
-
-module Ace
-  module Assign
-    module Authority
-      # One retained gem and the source-owned publication input it binds.
-      # Inspect bounded metadata only; never extract or evaluate build files.
-      module ReleaseArtifactManifest
-        FIELDS = %w[gem_name version platform registry sha256 bytes].freeze
-        NAME = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/
-        MAX_METADATA_BYTES = 1024 * 1024
-        REGISTRY = "https://rubygems.org"
-
-        def self.validate!(value)
-          unless value.is_a?(Hash) && value.keys.sort == FIELDS.sort &&
-              value["gem_name"].is_a?(String) && NAME.match?(value["gem_name"]) &&
-              value["version"].is_a?(String) && value["version"].bytesize.between?(1, 128) && Gem::Version.correct?(value["version"]) &&
-              value["platform"].is_a?(String) && NAME.match?(value["platform"]) &&
-              value["registry"] == REGISTRY && value["sha256"].is_a?(String) && value["sha256"].match?(/\A[0-9a-f]{64}\z/) &&
-              value["bytes"].is_a?(Integer) && value["bytes"].between?(1, Molecules::CanonicalEvidence::MAX_RELEASE_ARTIFACT_BYTES)
-            raise ArgumentError, "invalid release artifact manifest"
-          end
-          value
-        end
-
-        def self.verify!(bytes, manifest)
-          validate!(manifest)
-          unless bytes.is_a?(String) && bytes.bytesize == manifest.fetch("bytes") &&
-              Digest::SHA256.hexdigest(bytes.b) == manifest.fetch("sha256")
-            raise AttemptErrors::ReceiptRejected, "release artifact bytes differ from the manifest"
-          end
-          metadata = metadata!(bytes)
-          unless metadata == manifest.slice("gem_name", "version", "platform")
-            raise AttemptErrors::ReceiptRejected, "release artifact gem metadata differs from the manifest"
-          end
-          true
-        end
-
-        # Shared immutable input for retention and the later fixed publisher.
-        # Candidate/reference come from the installed canonical owner, not wire
-        # claims. Its digest is the existing service authorization input_digest.
-        def self.publication_input(manifest:, candidate:, reference:)
-          validate!(manifest)
-          {"target" => {"resource" => "rubygems:#{manifest.fetch('gem_name')}:#{manifest.fetch('version')}",
-            "artifact_digest" => manifest.fetch("sha256")},
-           "publication" => manifest.slice("gem_name", "version", "platform", "registry").merge(
-             "head" => candidate.fetch("head"), "tree" => candidate.fetch("tree"), "candidate_reference" => reference,
-             "artifact_bytes" => manifest.fetch("bytes"), "artifact_relative_path" => "artifacts/#{manifest.fetch('sha256')}.gem")}
-        end
-
-        def self.metadata!(bytes)
-          metadata = nil
-          Gem::Package::TarReader.new(StringIO.new(bytes)) do |archive|
-            archive.each do |entry|
-              next unless entry.full_name == "metadata.gz"
-              unless metadata.nil? && entry.file? && entry.header.size.between?(1, MAX_METADATA_BYTES)
-                raise AttemptErrors::ReceiptRejected, "release artifact metadata is missing, repeated or oversized"
-              end
-              compressed = entry.read
-              Zlib::GzipReader.wrap(StringIO.new(compressed)) do |reader|
-                metadata = reader.read(MAX_METADATA_BYTES + 1)
-                if metadata.bytesize > MAX_METADATA_BYTES
-                  raise AttemptErrors::ReceiptRejected, "release artifact metadata exceeds its bound"
-                end
-              end
-            end
-          end
-          raise AttemptErrors::ReceiptRejected, "release artifact metadata is unavailable" unless metadata
-          specification = Gem::Specification.from_yaml(metadata)
-          unless specification.is_a?(Gem::Specification)
-            raise AttemptErrors::ReceiptRejected, "release artifact metadata is invalid"
-          end
-          {"gem_name" => specification.name, "version" => specification.version.to_s,
-            "platform" => specification.platform.to_s}
-        rescue AttemptErrors::ReceiptRejected
-          raise
-        rescue StandardError
-          raise AttemptErrors::ReceiptRejected, "release artifact metadata is invalid"
-        end
-        private_class_method :metadata!
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/retained_input.rb

@@ -1,53 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require "digest"
-require_relative "private_directory"
-
-module Ace
-  module Assign
-    module Authority
-      # Immutable requester inputs, never evidence that an operation executed.
-      module RetainedInput
-        module_function
-
-        def read_file(path, limit)
-          File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
-            before = file.stat
-            raise ArgumentError, "retained input is not a bounded regular file" unless before.file? && before.size.between?(0, limit)
-            bytes = (file.read(limit + 1) || "").b
-            after, selected = file.stat, File.lstat(path)
-            identity = ->(stat) { [stat.dev, stat.ino, stat.size, stat.mtime, stat.ctime] }
-            unless bytes.bytesize == before.size && identity.call(before) == identity.call(after) &&
-                identity.call(after) == identity.call(selected) && !selected.symlink?
-              raise ArgumentError, "retained input changed during read"
-            end
-            bytes.freeze
-          end
-        end
-
-        def json(path, limit = 16_384)
-          JSON.parse(read_file(path, limit), allow_duplicate_key: false, create_additions: false, max_nesting: 24)
-        end
-
-        def create_output(path)
-          raise ArgumentError, "output must be a new directory path" unless path.is_a?(String) && !path.empty?
-          directory = File.expand_path(path)
-          Dir.mkdir(directory, 0o700)
-          PrivateDirectory.verify!(directory)
-          directory
-        end
-
-        def write_file(directory, name, bytes)
-          raise ArgumentError, "retained filename is invalid" unless File.basename(name) == name && !%w[. ..].include?(name)
-          File.open(File.join(directory, name), File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0o600) do |file|
-            file.write(bytes)
-            file.flush
-            file.fsync
-          end
-          File.open(directory) { |file| file.fsync }
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/router.rb

@@ -1,81 +0,0 @@
-# frozen_string_literal: true
-module Ace
-  module Assign
-    module Authority
-      # Source-owned handlers share one listener. Requests never name a method.
-      class Router
-        def initialize(launch: nil, handlers: [])
-          @launch = launch
-          @routes = {}
-          ([launch].compact + handlers).each do |handler|
-            handler.class::OPERATIONS.each do |operation|
-              raise ArgumentError, "duplicate authority operation" if @routes.key?(operation)
-              @routes[operation] = handler
-            end
-          end
-          @routes.freeze
-        end
-
-        def dispatch(request:, peer:, role:, transfer: nil, deadline: nil)
-          validate_review_namespace!(request)
-          handler = @routes.fetch(request.fetch("operation")) { raise ArgumentError, "unknown authority operation" }
-          options = {request: request, peer: peer, role: role}
-          options[:transfer] = transfer if transfer
-          options[:deadline] = deadline if deadline
-          handler.dispatch(**options)
-        end
-
-        def transfer_binding(request)
-          validate_review_namespace!(request)
-          operation = request.fetch("operation")
-          handler = @routes.fetch(operation) { raise ArgumentError, "unknown authority operation" }
-          return nil unless handler.class.const_defined?(:TRANSFER_OPERATIONS, false)
-          binding = handler.class::TRANSFER_OPERATIONS[operation]
-          if operation == "evidence_fetch" && %w[prepared_work campaign_candidate].include?(request.dig("params", "kind"))
-            binding = {direction: :download, purpose: :candidate, roles: [:worker]}
-          end
-          return nil unless binding
-          unless binding.is_a?(Hash) && binding.keys.sort == %i[direction purpose roles] &&
-              %i[upload download].include?(binding[:direction]) && TransferCodec::LIMITS.key?(binding[:purpose]) &&
-              binding[:roles].is_a?(Array) && binding[:roles].all? { |role| %i[worker launcher reviewer executor supervisor observer signer].include?(role) }
-            raise ArgumentError, "invalid source transfer binding"
-          end
-          binding
-        end
-
-        def authorize_transfer!(request:, peer:, role:, deadline: nil)
-          validate_review_namespace!(request)
-          handler = @routes.fetch(request.fetch("operation"))
-          options = {request: request, peer: peer, role: role}
-          options[:deadline] = deadline if deadline
-          handler.authorize_transfer!(**options)
-        end
-
-        def validate_review_namespace!(request)
-          if request["mutation_id"].is_a?(String) && request["mutation_id"].start_with?("review-reply.")
-            raise ArgumentError, "reserved review reply namespace"
-          end
-          if request["mutation_id"].is_a?(String) && request["mutation_id"].start_with?("review-delegate.") &&
-              request["operation"] != "assign_review"
-            raise ArgumentError, "reserved review delegation namespace"
-          end
-        end
-        private :validate_review_namespace!
-
-        def close
-          @routes.values.uniq.each { |handler| handler.close if handler.respond_to?(:close) }
-        end
-
-        def serve_launch_control!(**options)
-          raise AttemptErrors::EvidenceUnavailable, "launch control is unavailable in this composition" unless @launch
-          @launch.serve_launch_control!(**options)
-        end
-
-        def gate_ready(**options)
-          raise AttemptErrors::EvidenceUnavailable, "launch gate is unavailable in this composition" unless @launch
-          @launch.gate_ready(**options)
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/server.rb

@@ -1,131 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "deployment"
-require_relative "socket_server"
-
-module Ace
-  module Assign
-    module Authority
-      # Protected admission is mandatory for this source-selected composition.
-      class Server < SocketServer
-        def initialize(authority_id:, lifecycle:, deployment: Deployment.load,
-          kernel: Ace::Runtime::Molecules::ProtectedLinux.new, composition: "launch", services: [])
-          @authority_id, @deployment, @kernel, @composition = authority_id, deployment, kernel, composition
-          deployment.verify_composition!(authority_id, composition: composition)
-          super(service: deployment.authority(authority_id), lifecycle: lifecycle, services: services)
-        end
-
-        private
-
-        def verify_listener!
-          @kernel.supported!
-          me = @kernel.capture(Process.pid)
-          unless principal?(me, @service, "uid", "gid", "groups")
-            raise AttemptErrors::UnauthorizedIdentity, "listener principal differs from installed authority"
-          end
-          @deployment.verify_receiver_paths!(@authority_id)
-        end
-
-        def receive(socket)
-          deadline = wire.deadline(30)
-          peer = @kernel.peer(socket)
-          frame = wire.read(socket, deadline: [deadline, wire.deadline(5)].min, with_size: true)
-          request = frame.fetch(:data)
-          unless request.is_a?(Hash) && request.keys.sort == %w[mutation_id operation params project_id version] &&
-              request["version"].is_a?(Integer) && request["version"] == 1 && request["operation"].is_a?(String) && request["params"].is_a?(Hash)
-            raise ArgumentError, "invalid authority envelope"
-          end
-          deadline = wire.deadline(90) if %w[reserve_attempt close_execution_scope stop_attempt].include?(request.fetch("operation"))
-          params = request.fetch("params")
-          map = @deployment.verify!(params.fetch("mapping_id"), kernel: @kernel, authority_state: true)
-          unless map["authority_id"] == @authority_id && map["project_id"] == request["project_id"]
-            raise AttemptErrors::UnauthorizedIdentity, "mapping belongs to another authority or project"
-          end
-          project = @deployment.project(map.fetch("project_id"))
-          owner_contexts = project.fetch("inbox_contexts", {}).select do |_id, context|
-            context.fetch("native_mapping_id") == params.fetch("mapping_id") &&
-              context.fetch("owner_credentials").values_at("uid", "gid", "groups") == peer.values_at("uid", "gid", "groups")
-          end
-          context_query = %w[inbox_context_original].include?(request["operation"])
-          if context_query || !owner_contexts.empty?
-            unless context_query && @composition == "services" && request["mutation_id"].nil? &&
-                owner_contexts.key?(params.fetch("inbox_context_id")) && frame.fetch(:bytesize) <= 16_384
-              raise AttemptErrors::UnauthorizedIdentity, "context owner is exclusive to its fixed read-only inbox queries"
-            end
-            role = :context_owner
-          end
-          if request["operation"] == "native_readiness"
-            unless @composition == "launch" && request["mutation_id"].nil? && params.keys == ["mapping_id"] &&
-                frame.fetch(:bytesize) <= 16_384
-              raise ArgumentError, "private readiness envelope differs"
-            end
-            admitted_transfer = @mutex.synchronize do
-              if @transfers < 2
-                @transfers += 1
-                true
-              end
-            end
-            raise AttemptErrors::Conflict, "readiness transfer capacity is busy" unless admitted_transfer
-            @lifecycle.native_readiness!(mapping_id: params.fetch("mapping_id"), peer: peer, socket: socket,
-              codec: transfer_codec, deadline: wire.deadline(10))
-            return
-          end
-          role ||= if principal?(peer, map, "launcher_uid", "launcher_gid", "launcher_groups")
-            :launcher
-          elsif principal?(peer, map, "worker_uid", "worker_gid", "worker_groups")
-            :worker
-          end
-          unless role
-            project = @deployment.project(map.fetch("project_id"))
-            configured = project.fetch("peer_credentials")[peer.fetch("uid").to_s]
-            if configured && peer["gid"] == configured["gid"] && peer["groups"] == configured["groups"]
-              {reviewer: "reviewer_uids", executor: "service_executor_uids", supervisor: "supervisor_uids"}.each do |candidate, key|
-                role ||= candidate if project.fetch(key).include?(peer.fetch("uid"))
-              end
-            end
-          end
-          raise AttemptErrors::UnauthorizedIdentity, "unmapped kernel peer" unless role
-          if request["operation"] == "launch_control"
-            raise AttemptErrors::UnauthorizedIdentity, "Private launcher control requires launcher peer" unless role == :launcher
-            raise ArgumentError, "Private launcher header is oversized" unless frame.fetch(:bytesize) <= 16_384
-            @lifecycle.serve_launch_control!(request: request, peer: peer, socket: socket, codec: transfer_codec, deadline: deadline)
-            return
-          end
-          if %w[bind_inbox finish recover request_review review_status launch_review_intent cancel_review evidence_fetch assignment_inventory observe_execution_scope close_execution_scope stop_attempt prompt_status launch_input_inhibit_selection launch_input_inhibit_completion launch_prompt_intent launch_prompt_completion claim_service_settlement workspace_prune_preview_context].include?(request["operation"]) ||
-              @composition == "services" && %w[attempt_status inbox_context_original].include?(request["operation"])
-            raise ArgumentError, "review control header is oversized" if %w[request_review review_status cancel_review launch_review_intent].include?(request["operation"]) && frame.fetch(:bytesize) > 16_384
-            bodyless_read!(socket, deadline)
-          end
-          if request["operation"] == "gate_ready"
-            raise AttemptErrors::UnauthorizedIdentity, "gate readiness requires worker peer" unless role == :worker
-            @lifecycle.gate_ready(request: request, peer: peer, socket: socket, deadline: deadline)
-          else
-            dispatch_request(socket, request, peer, role, deadline, frame_bytes: frame.fetch(:bytesize))
-          end
-        rescue ArgumentError, KeyError, AttemptErrors::MalformedTransfer
-          refusal(socket, "invalid_input")
-        rescue AttemptErrors::UnauthorizedIdentity, SecurityError
-          refusal(socket, "unauthorized")
-        rescue AttemptErrors::Conflict
-          refusal(socket, "conflict")
-        rescue AttemptErrors::NotFound
-          refusal(socket, "missing")
-        rescue AttemptErrors::BoundedResultUnavailable
-          refusal(socket, "bounded_result")
-        rescue StandardError
-          refusal(socket, "evidence_unavailable")
-        ensure
-          socket.close unless socket.closed?
-          @mutex.synchronize do
-            @connections.delete(socket)
-            @transfers -= 1 if admitted_transfer
-          end
-        end
-
-        def principal?(identity, mapping, uid, gid, groups)
-          identity["uid"] == mapping[uid] && identity["gid"] == mapping[gid] && identity["groups"] == mapping[groups]
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/service_cleanup_dispatch.rb

@@ -1,88 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Authority
-      # Canonical-only original dispatch proof shared by status, root admission
-      # and initial/retained inspection imports. Installed peer policy stays in
-      # the fixed root transport owner.
-      module ServiceCleanupDispatch
-        CLEANUP_MUTABLE_SETTLEMENT_FIELDS = %w[state receipt reason claimed_at failed_at no_effect_challenge
-          challenge_generation challenge_event_digest completion_digest no_effect_completion_digest].freeze
-
-        def cleanup_dispatch_context!(record, commit:, selectors: nil, pending: nil)
-          unless @journal.evidence_mode == :protected &&
-              record.values_at("operation", "dispatch_phase") == ["prune-preserved-workspace", "dispatch_started"]
-            raise AttemptErrors::EvidenceUnavailable, "cleanup original dispatch is unavailable"
-          end
-          pending ||= {commit: commit}
-          @journal.verify_canonical_prefix!(commit: commit) unless service_read_view(pending)
-          # The existing index authenticates accepted record provenance without
-          # recursively asking this terminal collection to validate itself.
-          selected = @journal.service_request_records(commit: commit)
-            .select { |entry| entry["request_id"] == record.fetch("request_id") }
-          # Initial import receives the lower writer's proposed terminal
-          # replacement. Its settlement fields are validated by that writer
-          # and collection; the original immutable dispatch must still match.
-          unless selected.one? && selected.first.except(*CLEANUP_MUTABLE_SETTLEMENT_FIELDS) ==
-              record.except(*CLEANUP_MUTABLE_SETTLEMENT_FIELDS)
-            raise AttemptErrors::EvidenceUnavailable, "cleanup selected record differs"
-          end
-          context(record, pending: {commit: commit})
-          events = service_read_events(record, pending)
-          names = %w[request_event_digest dispatch_event_digest]
-          operations = %w[request_service begin_dispatch]
-          if selectors.nil?
-            selectors = names.zip(operations).to_h do |name, operation|
-              matches = events.select do |event|
-                event["type"] == "authority_mutation" && event.dig("payload", "operation") == operation &&
-                  event.dig("payload", "data", "request_id") == record.fetch("request_id") &&
-                  event.dig("payload", "data", "claim_binding") == record.fetch("claim_binding") &&
-                  event.dig("payload", "data", operation == "request_service" ? "claim" : "invocation") ==
-                    (operation == "request_service" ? "created" : "permitted")
-              end
-              raise AttemptErrors::EvidenceUnavailable, "cleanup original acceptance is ambiguous" unless matches.one?
-              [name, matches.first.fetch("digest")]
-            end
-          end
-          unless selectors.is_a?(Hash) && selectors.keys.sort == names.sort &&
-              selectors.values.all? { |value| value.is_a?(String) && value.match?(/\A[0-9a-f]{64}\z/) } && selectors.values.uniq.size == 2
-            raise AttemptErrors::EvidenceUnavailable, "cleanup original acceptance selectors differ"
-          end
-          introductions = service_read_introductions(record, selectors.values, pending)
-          dispatch_record = nil
-          names.zip(operations).each do |name, operation|
-            selector = selectors.fetch(name)
-            matches = events.select { |event| event.fetch("digest") == selector }
-            event = matches.one? && matches.first
-            payload = event && event.fetch("payload")
-            unless event && event.fetch("type") == "authority_mutation" && payload.fetch("operation") == operation &&
-                payload.slice("assignment_id", "attempt_id") == record.slice("assignment_id", "attempt_id") &&
-                payload.fetch("data").slice("request_id", "claim_binding") == record.slice("request_id", "claim_binding") &&
-                payload.fetch("data").fetch(operation == "request_service" ? "claim" : "invocation") ==
-                  (operation == "request_service" ? "created" : "permitted")
-              raise AttemptErrors::EvidenceUnavailable, "cleanup original acceptance differs"
-            end
-            prefix = @journal.read_events(record.fetch("assignment_id"), commit: introductions.fetch(selector))
-              .select { |entry| entry.fetch("attempt_id") == record.fetch("attempt_id") }
-            original = @journal.service_request(record.fetch("request_id"), commit: introductions.fetch(selector))
-            expected = operation == "request_service" ? original&.merge("dispatch_phase" => "dispatch_started",
-              "operation_owner_binding" => record.fetch("operation_owner_binding"),
-              "executor_process_binding" => record.fetch("executor_process_binding")) : original
-            unless expected&.except(*CLEANUP_MUTABLE_SETTLEMENT_FIELDS) == record.except(*CLEANUP_MUTABLE_SETTLEMENT_FIELDS) &&
-                prefix.last == event && prefix[-2] &&
-                prefix[-2].fetch("type") == (operation == "request_service" ? "service_claim" : "service_transition") &&
-                prefix[-2].dig("payload", "record_digest") == Atoms::EvidenceDigest.digest(original) &&
-                event.fetch("previous_digest") == prefix[-2].fetch("digest")
-              raise AttemptErrors::EvidenceUnavailable, "cleanup acceptance is not its original canonical introduction"
-            end
-            dispatch_record = original if operation == "begin_dispatch"
-          end
-          freeze_projection(JSON.parse(JSON.generate(selectors.merge("commit" => commit, "dispatch_record" => dispatch_record))))
-        rescue KeyError, TypeError, ArgumentError
-          raise AttemptErrors::EvidenceUnavailable, "cleanup original dispatch proof is incomplete"
-        end
-      end
-    end
-  end
-end