ace-assign 0.71.0 → 0.73.1

data/lib/ace/assign/authority/service_cleanup_evidence.rb

@@ -1,180 +0,0 @@
-# frozen_string_literal: true
-
-require "ace/runtime/molecules/protected_artifact_set"
-require_relative "cleanup_result_protection"
-
-module Ace
-  module Assign
-    module Authority
-      # The existing service evidence owner authenticates this complete pair.
-      # Root-private archives remain outside the authority evidence graph.
-      module ServiceCleanupEvidence
-        ROOT_SELECTION_SCHEMA = "ace.protected-workspace-prune-root-selection/v1"
-        ROOT_RECEIPT_SCHEMA = "ace.protected-workspace-prune-receipt/v1"
-        ROOT_SELECTION_FIELDS = %w[schema request_id input_digest operation_owner_binding_digest receipt_ref].freeze
-        ROOT_INSPECTION_SELECTION_SCHEMA = "ace.protected-workspace-prune-inspection-selection/v1"
-        ROOT_INSPECTION_SELECTION_FIELDS = %w[schema request_id input_digest operation_owner_binding_digest inspection_ref].freeze
-        ROOT_RECEIPT_FIELDS = %w[schema request_id input_digest maintenance target publication canonical_snapshots preservation removal].freeze
-
-        # Pre-import decoding reuses the collection validator. Only the lower
-        # writer's pending collection can authenticate protected storage and
-        # accept a terminal update.
-        def cleanup_inspection_inputs!(contents, record, challenge)
-          unless record["operation"] == "prune-preserved-workspace" && contents.is_a?(Array) && contents.size == 2
-            raise AttemptErrors::ReceiptRejected, "cleanup inspection requires its complete pair"
-          end
-          cleanup_documents!(contents, record, no_effect: true, challenge: challenge)
-          true
-        rescue KeyError, TypeError, JSON::ParserError, JSON::GeneratorError
-          raise AttemptErrors::ReceiptRejected, "cleanup inspection pair is unavailable"
-        end
-
-        private
-
-        def cleanup_collection!(references, record, state, pending)
-          unless record["operation"] == "prune-preserved-workspace" && %w[succeeded failed-settled].include?(state) && references.size == 2
-            raise AttemptErrors::ReceiptRejected, "cleanup completion requires its complete original evidence pair"
-          end
-          no_effect = state == "failed-settled"
-          challenge = no_effect ? challenge!(record, pending: pending) : nil
-          expected = no_effect ? context_for_challenge(record, challenge) : context(record)
-          proof = cleanup_dispatch_context!(record, commit: pending && pending[:commit] || @journal.ref_value, pending: pending)
-          contents = references.map do |reference|
-            if pending && pending[:pending_events]
-              @canonical.read_pending(reference, **expected, **pending.slice(:current_events, :pending_events, :blobs, :commit))
-            else
-              @canonical.read(reference, **expected, commit: pending && pending[:commit] || @journal.ref_value)
-            end
-          end
-          reference, operation_bytes = cleanup_documents!(contents, record, no_effect: no_effect,
-            challenge: challenge)
-          path = reference.fetch("path")
-          # The lower writer supplies its pending import transaction. Historical
-          # consumers have only a pinned commit and never reopen mutable storage.
-          if pending && pending[:pending_events]
-            selected_artifacts = @cleanup_artifacts || Ace::Runtime::Molecules::ProtectedArtifactSet.new(
-              protection: CleanupResultProtection.new(result_path: path, authority_gid: Process.egid))
-            selected_artifacts.with do |artifacts|
-              unless artifacts.read!(reference) == operation_bytes
-                raise AttemptErrors::ReceiptRejected, "cleanup retained result bytes differ"
-              end
-              artifacts.verify_unchanged!
-            end
-          end
-          if (view = service_read_view(pending))
-            view.projection = settlement_projection(record, pending, challenge, proof)
-          end
-          contents.freeze
-        rescue KeyError, TypeError, JSON::ParserError, JSON::GeneratorError, Ace::Runtime::RuntimeUnavailableError
-          raise AttemptErrors::ReceiptRejected, "cleanup original evidence is unavailable"
-        end
-
-        def cleanup_documents!(contents, record, no_effect:, challenge:)
-          documents = contents.map { |bytes| cleanup_json!(bytes) }
-          selection_schema = no_effect ? ROOT_INSPECTION_SELECTION_SCHEMA : ROOT_SELECTION_SCHEMA
-          selection_fields = no_effect ? ROOT_INSPECTION_SELECTION_FIELDS : ROOT_SELECTION_FIELDS
-          selection_index = documents.each_index.select { |index| documents[index]["schema"] == selection_schema }
-          receipt_index = documents.each_index.select do |index|
-            no_effect ? documents[index].keys.sort == ServiceEvidence::INSPECTION_FIELDS.sort : documents[index]["schema"] == ROOT_RECEIPT_SCHEMA
-          end
-          unless selection_index.one? && receipt_index.one?
-            raise AttemptErrors::ReceiptRejected, "cleanup original evidence selection is ambiguous"
-          end
-          selection = documents.fetch(selection_index.first)
-          receipt = documents.fetch(receipt_index.first)
-          closed_cleanup!(selection, selection_fields)
-          closed_cleanup!(receipt, no_effect ? ServiceEvidence::INSPECTION_FIELDS : ROOT_RECEIPT_FIELDS)
-          unless [selection, receipt].all? { |value| value["request_id"] == record.fetch("request_id") && value["input_digest"] == record.fetch("input_digest") } &&
-              selection["operation_owner_binding_digest"] == Atoms::EvidenceDigest.digest(record.fetch("operation_owner_binding"))
-            raise AttemptErrors::ReceiptRejected, "cleanup original owner or request differs"
-          end
-          reference = selection.fetch(no_effect ? "inspection_ref" : "receipt_ref")
-          closed_cleanup!(reference, %w[path bytes sha256])
-          path = reference.fetch("path")
-          operation_bytes = contents.fetch(receipt_index.first)
-          unless path.is_a?(String) && path.bytesize <= 4096 && path.valid_encoding? && !path.include?("\0") &&
-              path.start_with?("/") && File.expand_path(path) == path &&
-              reference["bytes"].is_a?(Integer) && reference["bytes"].between?(1, 65_536) &&
-              reference["bytes"] == operation_bytes.bytesize && reference["sha256"] == Digest::SHA256.hexdigest(operation_bytes)
-            raise AttemptErrors::ReceiptRejected, "cleanup retained result reference differs"
-          end
-          if no_effect
-            inspection_projection!(receipt, record, challenge)
-          else
-            cleanup_receipt_projection!(receipt, record)
-          end
-          [reference, operation_bytes]
-        end
-
-        def cleanup_json!(bytes)
-          unless bytes.is_a?(String) && bytes.bytesize.between?(1, 65_536)
-            raise AttemptErrors::ReceiptRejected, "cleanup evidence exceeds bounds"
-          end
-          text = bytes.dup.force_encoding(Encoding::UTF_8)
-          raise AttemptErrors::ReceiptRejected, "cleanup evidence is invalid UTF8" unless text.valid_encoding? && !text.include?("\0")
-          value = JSON.parse(text, create_additions: false, max_nesting: 16, allow_duplicate_key: false, allow_comments: false)
-          raise AttemptErrors::ReceiptRejected, "cleanup evidence is not an object" unless value.is_a?(Hash)
-          value
-        end
-
-        def closed_cleanup!(value, fields)
-          unless value.is_a?(Hash) && value.keys.sort == fields.sort
-            raise AttemptErrors::ReceiptRejected, "cleanup evidence fields differ"
-          end
-        end
-
-        def cleanup_receipt_projection!(receipt, record)
-          preservation = receipt.fetch("preservation")
-          closed_cleanup!(preservation, %w[head branch destinations manifest_sha256 inventory_sha256 file_count total_bytes private_manifest_sha256 archives_sha256])
-          unless preservation["file_count"].is_a?(Integer) && preservation["file_count"].between?(0, 4096) &&
-              preservation["total_bytes"].is_a?(Integer) && preservation["total_bytes"].between?(0, 256 * 1024 * 1024) &&
-              %w[manifest_sha256 inventory_sha256 private_manifest_sha256 archives_sha256].all? { |key| cleanup_sha?(preservation[key]) } &&
-              preservation.values_at("manifest_sha256", "inventory_sha256", "private_manifest_sha256").uniq.one?
-            raise AttemptErrors::ReceiptRejected, "cleanup preservation observation differs"
-          end
-          input = receipt.slice("maintenance", "target", "publication").merge("schema" => "ace.protected-workspace-prune/v1",
-            "preservation" => preservation.slice("head", "branch", "destinations", "manifest_sha256"))
-          unless Atoms::EvidenceDigest.digest(input) == record.fetch("input_digest") &&
-              receipt.fetch("maintenance") == record.slice("project_id", "mapping_id", "assignment_id", "attempt_id")
-            raise AttemptErrors::ReceiptRejected, "cleanup original input differs"
-          end
-          snapshots = receipt.fetch("canonical_snapshots")
-          unless snapshots.is_a?(Array) && snapshots.size.between?(1, 256)
-            raise AttemptErrors::ReceiptRejected, "cleanup canonical snapshots exceed bounds"
-          end
-          snapshots.each do |snapshot|
-            closed_cleanup!(snapshot, %w[mapping_id journal_commit binding_event_digest release_event_digest proof_event_digest])
-            unless snapshot["mapping_id"].is_a?(String) && snapshot["mapping_id"].match?(Molecules::JournalMutation::ID) &&
-                snapshot["journal_commit"].is_a?(String) && snapshot["journal_commit"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
-                %w[binding_event_digest release_event_digest proof_event_digest].all? { |key| cleanup_sha?(snapshot[key]) }
-              raise AttemptErrors::ReceiptRejected, "cleanup canonical snapshot differs"
-            end
-          end
-          ids = snapshots.map { |snapshot| snapshot.fetch("mapping_id") }
-          raise AttemptErrors::ReceiptRejected, "cleanup canonical snapshots are not uniquely ordered" unless ids == ids.uniq.sort
-          removal = receipt.fetch("removal")
-          closed_cleanup!(removal, %w[original captured outcome fence_digest])
-          unless removal["outcome"] == "removed" && cleanup_sha?(removal["fence_digest"])
-            raise AttemptErrors::ReceiptRejected, "cleanup has no positive removal observation"
-          end
-          %w[original captured].each do |key|
-            object = removal.fetch(key)
-            closed_cleanup!(object, %w[device inode worktree_admin_id head branch])
-            unless %w[device inode].all? { |field| object[field].is_a?(Integer) && object[field].positive? } &&
-                object["worktree_admin_id"].is_a?(String) && object["worktree_admin_id"].bytesize.between?(1, 200) &&
-                object["worktree_admin_id"].match?(/\A[a-zA-Z0-9_.-]+\z/) &&
-                object["head"] == preservation["head"] && object["branch"] == preservation["branch"]
-              raise AttemptErrors::ReceiptRejected, "cleanup captured object differs"
-            end
-          end
-          unless removal.fetch("original") == removal.fetch("captured")
-            raise AttemptErrors::ReceiptRejected, "cleanup replaced object cannot attest removal"
-          end
-          true
-        end
-
-        def cleanup_sha?(value) = value.is_a?(String) && value.match?(/\A[0-9a-f]{64}\z/)
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/service_delivery_evidence.rb

@@ -1,101 +0,0 @@
-# frozen_string_literal: true
-require "ace/git/atoms/service_merge_evidence"
-require "ace/git/atoms/service_pr_evidence"
-require_relative "service_evidence"
-
-module Ace
-  module Assign
-    module Authority
-      # The existing service completion/import transaction owns delivery writes.
-      class ServiceDeliveryEvidence
-        def initialize(journal:)
-          @journal = journal
-        end
-
-        def completion_event(record:, receipt:, completion_digest:, artifacts:)
-          unless artifacts.length == 1
-            raise AttemptErrors::ReceiptRejected, "merge completion requires its one fixed evidence artifact"
-          end
-          proof = validate_artifact!(record, artifacts.first)
-          {type: "delivery", payload: payload(record, receipt, completion_digest, proof)}
-        end
-
-        def verified(record:, events:, commit:)
-          unless %w[create update ready merge].include?(record["operation"]) && record["state"] == "succeeded" &&
-              record.fetch("receipt").fetch("evidence").length == 1
-            raise AttemptErrors::EvidenceUnavailable, "canonical merge completion is unavailable"
-          end
-          receipt = record.fetch("receipt")
-          reference = receipt.fetch("evidence").first
-          bytes = Molecules::CanonicalEvidence.new(journal: @journal).read(reference,
-            **ServiceEvidence.new(journal: @journal).context(record), commit: commit)
-          expected = payload(record, receipt, record.fetch("completion_digest"), validate_artifact!(record, bytes))
-          results = events.select { |event| event["type"] == "delivery" && event.dig("payload", "service_request_id") == record.fetch("request_id") }
-          unless results.one? && Atoms::EvidenceDigest.digest(results.first.fetch("payload")) == Atoms::EvidenceDigest.digest(expected)
-            raise AttemptErrors::EvidenceUnavailable, "canonical merge delivery result differs"
-          end
-          transitions = events.select { |event| event["type"] == "service_transition" &&
-            event.dig("payload", "request_id") == record.fetch("request_id") && event.dig("payload", "state") == "succeeded" &&
-            event.dig("payload", "record_digest") == Atoms::EvidenceDigest.digest(record) &&
-            event.dig("payload", "receipt_digest") == Atoms::EvidenceDigest.digest(receipt) }
-          imports = events.select { |event| event["type"] == "evidence_import" &&
-            "evidence/imports/#{event.dig('payload', 'artifact_id')}" == reference.fetch("ref") }
-          unless transitions.one? && imports.one?
-            raise AttemptErrors::EvidenceUnavailable, "canonical merge completion introduction differs"
-          end
-          # The first completion's authority mutation immediately follows its
-          # terminal transition. Later identical completion observations may
-          # have their own mutation IDs; they cannot replace this introduction.
-          completion = events[events.index(transitions.first) + 1]
-          unless completion && completion["type"] == "authority_mutation" &&
-              completion.dig("payload", "operation") == "complete_service" &&
-              completion.dig("payload", "data", "request_id") == record.fetch("request_id")
-            raise AttemptErrors::EvidenceUnavailable, "original merge completion mutation differs"
-          end
-          selected = [results.first, transitions.first, completion, imports.first]
-          introductions = @journal.event_commits!(assignment_id: record.fetch("assignment_id"),
-            event_digests: selected.map { |event| event.fetch("digest") }, commit: commit)
-          unless introductions.values.uniq.length == 1
-            raise AttemptErrors::EvidenceUnavailable, "merge delivery result was not atomically imported and completed"
-          end
-          results.first
-        rescue KeyError, TypeError, ArgumentError, AttemptErrors::ReceiptRejected
-          raise AttemptErrors::EvidenceUnavailable, "canonical merge delivery evidence is unverifiable"
-        end
-
-        private
-
-        def validate_artifact!(record, bytes)
-          options = {request_id: record.fetch("request_id"), input_digest: record.fetch("input_digest"),
-            target: record.fetch("target"), head: record.fetch("candidate_head")}
-          proof = if record.fetch("operation") == "merge"
-            Ace::Git::Atoms::ServiceMergeEvidence.validate(bytes, **options)
-          else
-            Ace::Git::Atoms::ServicePrEvidence.validate(bytes, operation: record.fetch("operation"), **options)
-          end
-          unless Atoms::EvidenceDigest.digest(proof.fetch(:input)) == record.fetch("input_digest")
-            raise AttemptErrors::ReceiptRejected, "merge evidence does not reconstruct the originally accepted input"
-          end
-          proof
-        rescue ArgumentError, KeyError
-          raise AttemptErrors::ReceiptRejected, "merge evidence original input or outcome differs"
-        end
-
-        def payload(record, receipt, completion_digest, proof)
-          self.class.payload(record, receipt, completion_digest, proof)
-        end
-
-        # Pure result shape shared with the read-only worker consumer. This
-        # function creates no evidence or authorization on its own.
-        def self.payload(record, receipt, completion_digest, proof)
-          {"stage" => "result", "operation" => record.fetch("operation"), "head" => record.fetch("candidate_head"), "outcome" => "succeeded",
-            "intent_digest" => nil, "intent_attempt_id" => nil,
-            "pr" => proof.fetch(:pr).slice("number", "url", "head_sha", "draft", "state", "merge_commit_sha"),
-            "service_request_id" => record.fetch("request_id"), "service_completion_digest" => completion_digest,
-            "service_receipt_digest" => Atoms::EvidenceDigest.digest(receipt), "service_evidence" => receipt.fetch("evidence"),
-            "producer" => {"actor" => "service:#{record.fetch('executor_uid')}", "role" => "service", "runtime" => "herdr"}}
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/service_evidence.rb

@@ -1,286 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "../molecules/evidence_journal"
-require_relative "../molecules/canonical_evidence"
-require_relative "service_cleanup_evidence"
-require_relative "service_cleanup_dispatch"
-require_relative "service_publication_evidence"
-require_relative "../molecules/execution_scope_lineage"
-
-module Ace
-  module Assign
-    module Authority
-      # One source-owned context for initial and retained service evidence.
-      # The journal supplies the record and transient pending view; callers
-      # never supply an alternate reader, artifact path or trusted flag.
-      class ServiceEvidence
-        include ServiceCleanupEvidence
-        include ServiceCleanupDispatch
-        include ServicePublicationEvidence
-        FIELDS = (Molecules::EvidenceJournal::TERMINAL_BINDING_FIELDS +
-          %w[dispatch_ticket_id claim_binding candidate_generation claim_generation policy_digest]).freeze
-        CHALLENGE_FIELDS = %w[version request_id input_digest claim_binding dispatch_ticket_id no_effect_challenge
-          challenge_generation failure_event_digest failure_generation].freeze
-        INSPECTION_FIELDS = %w[version request_id input_digest claim_binding no_effect_challenge challenge_generation
-          challenge_event_digest failure_event_digest failure_generation target dispatch_phase effect_absent
-          handler_terminated writers_absent].freeze
-
-        def initialize(journal:, cleanup_artifacts: nil)
-          @journal = journal
-          @canonical = Molecules::CanonicalEvidence.new(journal: journal)
-          @cleanup_artifacts = cleanup_artifacts
-        end
-
-        # Executor-only projection from the same authenticated original record;
-        # selectors never come from the receiver or a caller-supplied target.
-        def settlement_context(record, commit: @journal.ref_value, read_view: nil)
-          pending = {commit: commit, service_read_view: read_view}
-          context(record, pending: pending)
-          challenge = challenge!(record, pending: pending, current: false) if
-            %w[no_effect_challenge challenge_generation challenge_event_digest].any? { |key| record.key?(key) }
-          proof = cleanup_dispatch_context!(record, commit: commit, pending: pending) if
-            record.values_at("operation", "dispatch_phase") == ["prune-preserved-workspace", "dispatch_started"]
-          settlement_projection(record, pending, challenge, proof)
-        rescue KeyError, TypeError
-          raise AttemptErrors::EvidenceUnavailable, "original service settlement context is incomplete"
-        end
-
-        def context(record, no_effect: false, pending: nil)
-          binding = FIELDS.to_h { |key| [key, record.fetch(key)] }
-          if record.fetch("operation") == "prune-preserved-workspace" && record["dispatch_phase"] == "dispatch_started"
-            binding["operation_owner_binding"] = record.fetch("operation_owner_binding")
-            executor = record.fetch("executor_process_binding")
-            boot = record.fetch("worker_process_binding").fetch("started_at").split(":").fetch(1)
-            Molecules::ExecutionScopeLineage.validate_process_identity!(executor, boot_id: boot)
-            raise AttemptErrors::EvidenceUnavailable, "original cleanup executor differs" unless executor.fetch("uid") == record.fetch("executor_uid")
-            binding["executor_process_binding"] = executor
-          end
-          if record["operation"] == "publish" && record["dispatch_phase"] != "issued"
-            executor = record.fetch("executor_process_binding")
-            boot = record.fetch("worker_process_binding").fetch("started_at").split(":").fetch(1)
-            Molecules::ExecutionScopeLineage.validate_process_identity!(executor, boot_id: boot)
-            raise AttemptErrors::EvidenceUnavailable, "original publication executor differs" unless executor.fetch("uid") == record.fetch("executor_uid")
-            binding["executor_process_binding"] = executor
-          end
-          unless %w[claim_binding policy_digest].all? { |key| binding[key].is_a?(String) && binding[key].match?(/\A[0-9a-f]{64}\z/) } &&
-              %w[candidate_generation claim_generation].all? { |key| binding[key].is_a?(Integer) && binding[key].positive? } &&
-              binding["dispatch_ticket_id"].is_a?(String) && binding["dispatch_ticket_id"].match?(Molecules::JournalMutation::ID)
-            raise AttemptErrors::EvidenceUnavailable, "canonical dispatch binding is invalid"
-          end
-          if no_effect
-            return context_for_challenge(record, challenge!(record, pending: pending))
-          end
-          {kind: "service", project_id: record.fetch("project_id"), assignment_id: record.fetch("assignment_id"),
-            attempt_id: record.fetch("attempt_id"), peer_uid: record.fetch("executor_uid"), binding: binding,
-            request_id_or_event_id: record.fetch("request_id"), generation: record.fetch("claim_generation")}
-        rescue KeyError
-          raise AttemptErrors::EvidenceUnavailable, "canonical service evidence binding is incomplete"
-        end
-
-        # Exact original challenge and failure selected from the same immutable
-        # canonical prefix as its import. Pending events are the journal owner's
-        # held CAS plan, never caller-supplied alternative history.
-        def challenge!(record, pending: nil, current: true)
-          context(record)
-          selector = record.slice("no_effect_challenge", "challenge_generation", "challenge_event_digest")
-          unless selector.keys.sort == %w[no_effect_challenge challenge_generation challenge_event_digest].sort &&
-              selector["no_effect_challenge"].is_a?(String) && selector["no_effect_challenge"].match?(/\A[0-9a-f]{32}\z/) &&
-              selector["challenge_generation"].is_a?(Integer) && selector["challenge_generation"].positive? &&
-              selector["challenge_event_digest"].is_a?(String) && selector["challenge_event_digest"].match?(/\A[0-9a-f]{64}\z/)
-            raise AttemptErrors::EvidenceUnavailable, "canonical challenge selector is invalid"
-          end
-          commit = pending && pending[:commit] || @journal.ref_value
-          events = if pending && pending[:pending_events]
-            pending.fetch(:current_events) + pending.fetch(:pending_events)
-          else
-            service_read_events(record, pending)
-          end
-          unless Models::EvidenceEvent.chain_valid?(events)
-            raise AttemptErrors::EvidenceUnavailable, "canonical challenge chain is corrupt"
-          end
-          selected = events.select { |event| event["digest"] == record.fetch("challenge_event_digest") }
-          unless selected.size == 1 && selected.first["type"] == "service_no_effect_challenge"
-            raise AttemptErrors::EvidenceUnavailable, "canonical challenge event is missing"
-          end
-          challenge = selected.first
-          payload = challenge.fetch("payload")
-          before = events.take_while { |event| event["digest"] != challenge.fetch("digest") }
-          failures = events.select do |event|
-            %w[service_claim service_transition].include?(event["type"]) &&
-              event.dig("payload", "request_id") == record.fetch("request_id") &&
-              %w[uncertain failed].include?(event.dig("payload", "state"))
-          end
-          failure = before.reverse.find { |event| failures.include?(event) }
-          failure_prefix = before.take_while { |event| event["digest"] != failure&.fetch("digest") }
-          generation = failure_prefix.count { |event| event["type"] == "authority_mutation" } + 1
-          unless payload.is_a?(Hash) && payload.keys.sort == CHALLENGE_FIELDS.sort &&
-              payload["version"].is_a?(Integer) && payload["version"] == 1 &&
-              %w[challenge_generation failure_generation].all? { |key| payload[key].is_a?(Integer) && payload[key].positive? } &&
-              payload["no_effect_challenge"].is_a?(String) && payload["no_effect_challenge"].match?(/\A[0-9a-f]{32}\z/) &&
-              %w[request_id input_digest claim_binding dispatch_ticket_id no_effect_challenge challenge_generation].all? { |key| payload[key] == record[key] } &&
-              failure && (!current || failures.last == failure) && before.any? { |event| event["digest"] == failure.fetch("digest") } &&
-              payload["failure_event_digest"] == failure.fetch("digest") && payload["failure_generation"] == generation &&
-              payload["challenge_generation"] == before.count { |event| event["type"] == "authority_mutation" } + 1
-            raise AttemptErrors::EvidenceUnavailable, "canonical challenge or current failure binding differs"
-          end
-          position = events.index(challenge)
-          if pending && pending[:pending_events]&.any? { |event| event["digest"] == challenge.fetch("digest") }
-            unless pending[:operation] == "claim_service_settlement"
-              raise AttemptErrors::EvidenceUnavailable, "pending challenge has no fixed authority owner"
-            end
-          else
-            update, accepted = events.values_at(position + 1, position + 2)
-            expected_params = record.slice("mapping_id", "assignment_id", "attempt_id", "request_id", "candidate_generation").merge(
-              "head" => record.fetch("candidate_head"), "expected_generation" => payload.fetch("challenge_generation") - 1)
-            unless update && update["type"] == "service_challenge" && update.dig("payload", "request_id") == record.fetch("request_id") &&
-                accepted && accepted["type"] == "authority_mutation" && accepted.dig("payload", "operation") == "claim_service_settlement" &&
-                accepted.dig("payload", "assignment_id") == record.fetch("assignment_id") && accepted.dig("payload", "attempt_id") == record.fetch("attempt_id") &&
-                accepted.dig("payload", "parameters_digest") == Atoms::EvidenceDigest.digest(expected_params) &&
-                accepted.dig("payload", "data", "generation").is_a?(Integer) &&
-                accepted.dig("payload", "data", "generation") == payload.fetch("challenge_generation") &&
-                accepted.dig("payload", "data", "reconciliation_challenge", "challenge_generation").is_a?(Integer) &&
-                accepted.dig("payload", "data", "request_id") == record.fetch("request_id") &&
-                accepted.dig("payload", "data", "reconciliation_challenge") == record.slice("no_effect_challenge", "challenge_generation", "challenge_event_digest")
-              raise AttemptErrors::EvidenceUnavailable, "canonical challenge lacks its accepted authority mutation"
-            end
-            commits = service_read_introductions(record,
-              [challenge.fetch("digest"), failure.fetch("digest"), update.fetch("digest"), accepted.fetch("digest")], pending)
-            unless commits.fetch(challenge.fetch("digest")) == commits.fetch(update.fetch("digest")) &&
-                commits.fetch(challenge.fetch("digest")) == commits.fetch(accepted.fetch("digest"))
-              raise AttemptErrors::EvidenceUnavailable, "challenge record and authority acceptance were not atomic"
-            end
-            original = @journal.service_request(record.fetch("request_id"), commit: commits.fetch(challenge.fetch("digest")))
-            unless original && %w[uncertain failed].include?(original["state"]) &&
-                update.dig("payload", "record_digest") == Atoms::EvidenceDigest.digest(original) &&
-                (FIELDS + %w[mapping_id service_id caller_uid authorization worker_process_binding launch_ticket reservation_generation dispatch_phase]).all? { |key| original[key] == record[key] } &&
-                original.slice("no_effect_challenge", "challenge_generation", "challenge_event_digest") ==
-                  record.slice("no_effect_challenge", "challenge_generation", "challenge_event_digest")
-              raise AttemptErrors::EvidenceUnavailable, "challenge accepted record differs from original binding"
-            end
-          end
-          challenge
-        rescue KeyError, TypeError, NoMethodError
-          raise AttemptErrors::EvidenceUnavailable, "canonical challenge binding is incomplete"
-        end
-
-        def inspection!(content, record, challenge)
-          unless content.is_a?(String) && content.bytesize <= Molecules::CanonicalEvidence::MAX_ARTIFACT_BYTES
-            raise AttemptErrors::EvidenceUnavailable, "no-effect inspection exceeds artifact bounds"
-          end
-          text = content.dup.force_encoding(Encoding::UTF_8)
-          raise AttemptErrors::EvidenceUnavailable, "no-effect inspection is invalid UTF8" unless text.valid_encoding?
-          lines = text.lines.filter_map { |line| line.delete_prefix("ace-service-no-effect ").chomp if line.start_with?("ace-service-no-effect ") }
-          raise AttemptErrors::EvidenceUnavailable, "no-effect inspection is missing or repeated" unless lines.size == 1
-          inspection = JSON.parse(lines.first, create_additions: false, max_nesting: 8,
-            allow_duplicate_key: false, allow_comments: false)
-          inspection_projection!(inspection, record, challenge)
-        rescue JSON::ParserError, KeyError, TypeError
-          raise AttemptErrors::EvidenceUnavailable, "no-effect inspection is malformed"
-        end
-
-        def inspection_projection!(inspection, record, challenge)
-          expected = challenge.fetch("payload").slice("request_id", "input_digest", "claim_binding", "no_effect_challenge",
-            "challenge_generation", "failure_event_digest", "failure_generation").merge("version" => 1,
-              "challenge_event_digest" => challenge.fetch("digest"), "target" => record.fetch("target"),
-              "dispatch_phase" => record.fetch("dispatch_phase"), "effect_absent" => true,
-              "handler_terminated" => true, "writers_absent" => true)
-          unless inspection.is_a?(Hash) && inspection.keys.sort == INSPECTION_FIELDS.sort &&
-              %w[version challenge_generation failure_generation].all? { |key| inspection[key].is_a?(Integer) } &&
-              inspection == expected
-            raise AttemptErrors::EvidenceUnavailable, "no-effect inspection differs from original challenge"
-          end
-          true
-        rescue KeyError, TypeError
-          raise AttemptErrors::EvidenceUnavailable, "no-effect inspection is malformed"
-        end
-
-        def call(reference, record, state, pending)
-          if reference.is_a?(Array)
-            return publication_collection!(reference, record, state, pending) if record["operation"] == "publish"
-            return cleanup_collection!(reference, record, state, pending)
-          end
-          no_effect = state == "failed-settled"
-          expected = context(record, no_effect: no_effect, pending: pending)
-          bytes = if pending && pending[:pending_events]
-            @canonical.read_pending(reference, **expected, **pending.slice(:current_events, :pending_events, :blobs, :commit))
-          else
-            @canonical.read(reference, **expected, commit: pending && pending[:commit] || @journal.ref_value)
-          end
-          if no_effect
-            challenge = challenge!(record, pending: pending)
-            inspection!(bytes, record, challenge)
-          end
-          bytes
-        end
-
-        private
-
-        def settlement_projection(record, pending, challenge, proof)
-          selected = nil
-          if challenge
-            latest_failure = service_read_events(record, pending).reverse.find do |event|
-              event["attempt_id"] == record.fetch("attempt_id") &&
-                %w[service_claim service_transition].include?(event["type"]) &&
-                event.dig("payload", "request_id") == record.fetch("request_id") &&
-                %w[uncertain failed].include?(event.dig("payload", "state"))
-            end
-            if latest_failure && latest_failure.fetch("digest") == challenge.dig("payload", "failure_event_digest")
-              selected = challenge.fetch("payload").slice("request_id", "input_digest", "claim_binding",
-                "no_effect_challenge", "challenge_generation", "failure_event_digest", "failure_generation")
-                .merge("challenge_event_digest" => challenge.fetch("digest"))
-            end
-          end
-          execution = record.slice("mapping_id", "candidate_generation", "claim_binding", "dispatch_phase")
-            .merge("head" => record.fetch("candidate_head"))
-          if record["operation"] == "prune-preserved-workspace" && record["dispatch_phase"] == "dispatch_started"
-            execution.merge!(record.slice("operation_owner_binding", "executor_process_binding"))
-            execution.merge!(proof.slice("request_event_digest", "dispatch_event_digest"))
-          end
-          value = {"version" => 1, "request" => record.slice(*Molecules::EvidenceJournal::TERMINAL_BINDING_FIELDS),
-            "execution" => execution, "challenge" => selected}
-          freeze_projection(JSON.parse(JSON.generate(value)))
-        end
-
-        def context_for_challenge(record, selection)
-          expected = context(record)
-          binding = expected.fetch(:binding)
-          binding.merge!(record.slice("no_effect_challenge", "challenge_generation", "challenge_event_digest"))
-          binding.merge!(selection.fetch("payload").slice("failure_event_digest", "failure_generation"))
-          binding["dispatch_phase"] = record.fetch("dispatch_phase")
-          expected
-        end
-
-        def service_read_view(pending)
-          view = pending && pending[:service_read_view]
-          return nil unless view
-          unless view.is_a?(Molecules::EvidenceJournal::ServiceReadView) && view.journal.equal?(@journal) &&
-              view.commit == pending.fetch(:commit) && view.inventory.fetch("commit") == view.commit
-            raise AttemptErrors::EvidenceUnavailable, "service read view differs from its selected owner"
-          end
-          view
-        end
-
-        def service_read_events(record, pending)
-          view = service_read_view(pending)
-          selected = view ? view.inventory.fetch("events").fetch(record.fetch("assignment_id")) :
-            @journal.read_events(record.fetch("assignment_id"), commit: pending && pending[:commit] || @journal.ref_value)
-          selected.select { |event| event.fetch("attempt_id") == record.fetch("attempt_id") }
-        end
-
-        def service_read_introductions(record, selectors, pending)
-          view = service_read_view(pending)
-          return @journal.event_commits!(assignment_id: record.fetch("assignment_id"), event_digests: selectors,
-            commit: pending && pending[:commit] || @journal.ref_value) unless view
-          facts = view.inventory.fetch("introductions").fetch(record.fetch("assignment_id"))
-          selectors.to_h { |selector| [selector, facts.fetch(selector)] }.freeze
-        end
-
-        def freeze_projection(value)
-          value.each_value { |child| freeze_projection(child) } if value.is_a?(Hash)
-          value.each { |child| freeze_projection(child) } if value.is_a?(Array)
-          value.freeze
-        end
-      end
-    end
-  end
-end