ace-assign 0.71.0 → 0.73.1

data/lib/ace/assign/cli/commands/attempt/evidence.rb

@@ -1,28 +0,0 @@
-# frozen_string_literal: true
-require_relative "base"
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Attempt
-          class Evidence < Ace::Support::Cli::Command
-            include Attempt::Base
-            desc "Read coordinator-accepted live execution or historical execution authority"
-            option :attempt, required: true, desc: "Accepted execution attempt ID"
-            option :receipt_digest, required: true, desc: "Accepted receipt digest"
-            option :kind, default: "check", desc: "Evidence purpose: check, review-collection or review-approval"
-            option :check_name, default: "tests", desc: "Required check name (tests binds operation test)"
-            option :historical_head, desc: "Exact recorded head for historical authority only (never current-head evidence)"
-            option :format, default: "json", desc: "JSON evidence projection"
-
-            def call(**options)
-              raise Ace::Support::Cli::Error, "evidence supports --format json" unless options[:format] == "json"
-              emit_json(build_coordinator.evidence(attempt_id: options[:attempt], receipt_digest: options[:receipt_digest],
-                kind: options[:kind], check_name: options[:check_name], historical_head: options[:historical_head]))
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/attempt/finish.rb

@@ -1,51 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require_relative "base"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Attempt
-          # Protected completion selects an already submitted canonical result.
-          # Ordinary local completion accepts its structured receipt file.
-          class Finish < Ace::Support::Cli::Command
-            include Ace::Support::Cli::Base
-            include Attempt::Base
-
-            desc "Finish a protected canonical result or an ordinary local receipt"
-
-            option :attempt, desc: "Attempt ID"
-            option :mapping, desc: "Exact installed protected mapping ID"
-            option :assignment, desc: "Exact protected assignment ID"
-            option :mutation, desc: "Stable original authority mutation ID"
-            option :expected_generation, desc: "Original authority mutation generation"
-            option :receipt, desc: "Path to the ordinary local receipt JSON file"
-            option :result, desc: "Already submitted canonical protected result ID"
-            option :head, desc: "Exact canonical candidate head"
-            option :candidate_generation, desc: "Original canonical candidate generation"
-
-            def call(**options)
-              if (context = protected_context(options))
-                raise Ace::Support::Cli::Error, "Protected finish forbids --receipt" unless options[:receipt].to_s.empty?
-                usage = "finish --mapping MAP --assignment ID --attempt ID --result ID --head SHA --candidate-generation N --mutation ID --expected-generation N"
-                client, params, mutation = protected_attempt_request(context, options, usage)
-                params.merge!("result_id" => require_option(options, :result, usage), "head" => require_option(options, :head, usage),
-                  "candidate_generation" => integer_option(options, :candidate_generation, usage, positive: true))
-                emit_json(protected_call(client, "finish", params, mutation))
-                return
-              end
-              attempt_id = require_option(options, :attempt, "finish --attempt ID --receipt FILE")
-              receipt = require_option(options, :receipt, "finish --attempt ID --receipt FILE")
-
-              result = build_coordinator.finish(attempt_id: attempt_id, receipt_path: receipt)
-
-              emit_json(result.projection)
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/attempt/reconcile.rb

@@ -1,49 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require_relative "base"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Attempt
-          # Classify interruptions and resolve uncertainty against verified,
-          # boundary-attributed receipts. Never replays external effects.
-          class Reconcile < Ace::Support::Cli::Command
-            include Ace::Support::Cli::Base
-            include Attempt::Base
-
-            desc "Reconcile an interrupted or uncertain attempt"
-
-            option :attempt, desc: "Attempt ID"
-            option :mapping, desc: "Exact installed protected mapping ID"
-            option :assignment, desc: "Exact protected assignment ID"
-            option :mutation, desc: "Stable original authority mutation ID"
-            option :expected_generation, desc: "Original authority mutation generation"
-            option :receipt, desc: "Path to the receipt JSON file (required to resolve uncertainty)"
-
-            def call(**options)
-              if (context = protected_context(options))
-                raise Ace::Support::Cli::Error, "Protected recovery forbids --receipt" unless options[:receipt].to_s.empty?
-                usage = "reconcile --mapping MAP --assignment ID --attempt ID --mutation ID --expected-generation N"
-                client, params, mutation = protected_attempt_request(context, options, usage)
-                emit_json(protected_call(client, "recover", params, mutation))
-                return
-              end
-              attempt_id = require_option(options, :attempt, "reconcile --attempt ID [--receipt FILE]")
-              receipt = options[:receipt].to_s.strip
-
-              result = build_coordinator.reconcile(
-                attempt_id: attempt_id,
-                receipt_path: receipt.empty? ? nil : receipt
-              )
-
-              emit_json(result.projection)
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/attempt/start.rb

@@ -1,45 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require_relative "base"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Attempt
-          # Bind an immutable attempt to an assignment step/subtree.
-          #
-          # Identity is derived from the execution boundary; a repeated
-          # identical start returns the active attempt, and a conflicting
-          # binding fails without launching a second writer.
-          class Start < Ace::Support::Cli::Command
-            include Ace::Support::Cli::Base
-            include Attempt::Base
-
-            desc "Start a scoped attempt for an assignment step"
-
-            option :assignment, desc: "Assignment ID"
-            option :step, desc: "Step or subtree scope (e.g. 010 or 010.01)"
-            option :project, desc: "Project ID the attempt executes in"
-
-            def call(**options)
-              usage = "start --assignment ID --step STEP --project ID"
-              assignment = require_option(options, :assignment, usage)
-              step = require_option(options, :step, usage)
-              project = require_option(options, :project, usage)
-
-              attempt = build_coordinator.start(
-                assignment_id: assignment,
-                step: step,
-                project_id: project
-              )
-
-              emit_json(attempt.projection)
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/attempt/status.rb

@@ -1,54 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require_relative "base"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Attempt
-          # Show attempt state, binding facts, and evidence references.
-          # JSON output carries only state, binding, references, and digests
-          # — never credentials or receipt bytes.
-          class Status < Ace::Support::Cli::Command
-            include Ace::Support::Cli::Base
-            include Attempt::Base
-
-            desc "Show attempt status for an assignment"
-
-            option :assignment, desc: "Assignment ID"
-            option :format, desc: "Output format (json, text)", default: "json"
-
-            def call(**options)
-              assignment = require_option(options, :assignment, "status --assignment ID --format json")
-              projection = build_coordinator.status(assignment)
-
-              if options[:format] == "text"
-                print_text(assignment, projection)
-              else
-                emit_json(projection || {"attempt" => nil})
-              end
-            end
-
-            private
-
-            def print_text(assignment, projection)
-              return puts "No attempts recorded for #{assignment}" if projection.nil?
-
-              puts "Attempt: #{projection['attempt_id']} #{projection['state']} (#{projection['scope']})"
-              puts "Recovery: #{projection['recovery_mode']}"
-              puts "Base head: #{projection['base_head']}"
-              puts "Candidate head: #{projection['candidate_head'] || 'unpinned'}"
-              puts "Evidence ref: #{projection['evidence_git_ref'] || 'local-only'}"
-              puts "Journal commit: #{projection['journal_commit'] || 'none'}"
-              return unless projection["unresolved_effects"].any?
-
-              puts "Unresolved effects: #{projection['unresolved_effects'].join(', ')}"
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/authority/inbox_context_principal.rb

@@ -1,25 +0,0 @@
-# frozen_string_literal: true
-require_relative "../../../authority/prepared_task_context"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Authority
-          class InboxContextPrincipal < Ace::Support::Cli::Command
-            desc "Classify the actual caller through every retained protected owner"
-
-            def call(**options)
-              raise ArgumentError, "fixed inbox context options differ" unless options.empty?
-              consumer = Ace::Assign::Authority::PreparedTaskContext.new(context: @protected_assignment_context)
-              $stdout.write(consumer.inbox_principal())
-              0
-            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
-              raise Ace::Support::Cli::Error, error.message
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/authority/inbox_context_selection.rb

@@ -1,28 +0,0 @@
-# frozen_string_literal: true
-require_relative "../../../authority/prepared_task_context"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Authority
-          class InboxContextSelection < Ace::Support::Cli::Command
-            desc "Read the fixed installed inbox context selection"
-            option :project, required: true, desc: "Installed project ID"
-            option :mapping, required: true, desc: "Installed mapping ID"
-            option :inbox_context, required: true, desc: "Installed inbox context ID"
-
-            def call(**options)
-              raise ArgumentError, "fixed inbox context options differ" unless options.keys.sort == %i[inbox_context mapping project]
-              consumer = Ace::Assign::Authority::PreparedTaskContext.new(context: @protected_assignment_context)
-              $stdout.write(consumer.inbox_selection(**options))
-              0
-            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
-              raise Ace::Support::Cli::Error, error.message
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/authority/launch.rb

@@ -1,97 +0,0 @@
-# frozen_string_literal: true
-require "json"
-require_relative "../../../authority/launch_driver"
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Authority
-          class Launch < Ace::Support::Cli::Command
-            desc "Launch one mapped worker and retain its original foreground control channel"
-            READY_FIELDS = %w[assignment_id attempt_id generation journal_commit mapping_id original_binding_digest type version].freeze
-            READY_LIMIT = 16_384
-            option :mapping, required: true, desc: "Installed launch mapping ID"
-            option :assignment, desc: "Managed assignment ID"
-            option :definition, desc: "Retained final prepared assignment definition JSON file"
-            option :prepared_bundle, desc: "Retained original prepared input Git bundle"
-            option :step, desc: "Assignment subtree scope"
-            option :base_head, desc: "Exact base commit SHA"
-            option :mutation, desc: "Stable invocation ID for safe replay"
-            option :dry_run, type: :boolean, default: false, desc: "Verify installed boundary without mutation or creation"
-            def call(**options)
-              driver = build_driver(options.fetch(:mapping))
-              result = if options[:dry_run]
-                driver.preflight
-              else
-                %i[assignment definition prepared_bundle step base_head].each do |key|
-                  raise ArgumentError, "Missing --#{key.to_s.tr('_', '-')}" unless options[key].is_a?(String) && !options[key].empty?
-                end
-                definition = retained_input(options[:definition], 32_768).force_encoding(Encoding::UTF_8)
-                raise ArgumentError, "assignment definition is not UTF-8" unless definition.valid_encoding?
-                bundle = retained_input(options[:prepared_bundle], Ace::Assign::Authority::CandidateTransfer::MAX_BYTES)
-                args = {prepared_bundle: bundle, assignment_id: options[:assignment], definition_bytes: definition,
-                  scope: options[:step], base_head: options[:base_head]}
-                args[:mutation_id] = options[:mutation] if options[:mutation]
-                driver.launch(**args)
-              end
-              if !options[:dry_run] && result["phase"] == "issued"
-                retaining_control = true
-                announced = false
-                driver.serve_control!(state: result) do |ready|
-                  raise ArgumentError, "original launch readiness was already announced" if announced
-                  line = readiness_line(ready, result, options)
-                  $stdout.write(line)
-                  $stdout.flush
-                  announced = true
-                end
-                raise ArgumentError, "original control ended before authenticated readiness" unless announced
-              else
-                puts JSON.generate(result)
-              end
-            rescue ArgumentError, SystemCallError, Ace::Runtime::Error, Ace::Assign::Error => error
-              raise Ace::Support::Cli::Error, error.message
-            ensure
-              # Local foreground-loop cancellation is not a stopped/settled proof.
-              driver.request_control_cancel if retaining_control
-            end
-            private
-            def retained_input(path, limit)
-              File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
-                before = file.stat
-                unless before.file? && before.size.between?(1, limit)
-                  raise ArgumentError, "retained launch input is not a bounded regular file"
-                end
-                bytes = (file.read(limit + 1) || "").b
-                after = file.stat
-                identity = ->(stat) { [stat.dev, stat.ino, stat.size, stat.mtime, stat.ctime] }
-                unless bytes.bytesize == before.size && bytes.bytesize <= limit && identity.call(before) == identity.call(after)
-                  raise ArgumentError, "retained launch input changed while reading"
-                end
-                bytes
-              end
-            end
-
-            def readiness_line(ready, result, options)
-              unless ready.is_a?(Hash) && ready.keys.all? { |key| key.is_a?(String) } && ready.keys.sort == READY_FIELDS &&
-                  ready["version"].is_a?(Integer) && ready["version"] == 1 && ready["type"] == "launch_ready" &&
-                  ready.values_at("mapping_id", "assignment_id", "attempt_id") ==
-                    [options.fetch(:mapping), options.fetch(:assignment), result.fetch("attempt_id")] &&
-                  ready["generation"].is_a?(Integer) && ready["generation"].positive? &&
-                  ready["journal_commit"].is_a?(String) && ready["journal_commit"].match?(/\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/) &&
-                  ready["original_binding_digest"].is_a?(String) && ready["original_binding_digest"].match?(/\A[0-9a-f]{64}\z/)
-                raise ArgumentError, "original launch readiness is malformed or mismatched"
-              end
-              line = JSON.generate(ready) + "\n"
-              raise ArgumentError, "original launch readiness is oversized" if line.bytesize > READY_LIMIT
-              line
-            end
-
-            def build_driver(mapping)
-              Ace::Assign::Authority::LaunchDriver.new(mapping_id: mapping)
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/authority/serve.rb

@@ -1,31 +0,0 @@
-# frozen_string_literal: true
-require_relative "../../../authority/server"
-require_relative "../../../authority/router"
-require_relative "../../../authority/launch_lifecycle"
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Authority
-          class Serve < Ace::Support::Cli::Command
-            desc "Serve the installed protected assignment authority"
-            option :authority, required: true, desc: "Installed authority ID"
-            def call(**options)
-              deployment = Ace::Assign::Authority::Deployment.load
-              history = Ace::Assign::Authority::DeploymentHistory.load
-              launch = Ace::Assign::Authority::LaunchLifecycle.new(deployment: deployment, deployment_history: history)
-              router = Ace::Assign::Authority::Router.new(launch: launch)
-              server = Ace::Assign::Authority::Server.new(authority_id: options.fetch(:authority), deployment: deployment, lifecycle: router)
-              signals = %w[INT TERM].to_h { |signal| [signal, Signal.trap(signal) { server.request_stop }] }
-              server.serve
-            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
-              raise Ace::Support::Cli::Error, error.message
-            ensure
-              signals&.each { |signal, handler| Signal.trap(signal, handler) }
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/authority/status.rb

@@ -1,26 +0,0 @@
-# frozen_string_literal: true
-require "json"
-require_relative "../../../authority/client"
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Authority
-          class Status < Ace::Support::Cli::Command
-            desc "Inspect canonical protected launch ownership"
-            option :mapping, required: true, desc: "Installed launch mapping ID"
-            option :assignment, required: true, desc: "Assignment ID"
-            option :attempt, required: true, desc: "Attempt ID"
-            def call(**options)
-              reply = Ace::Assign::Authority::Client.new(mapping_id: options.fetch(:mapping)).call("attempt_status",
-                {"assignment_id" => options.fetch(:assignment), "attempt_id" => options.fetch(:attempt), "result_candidate_generation" => nil})
-              puts JSON.generate(reply.data)
-            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
-              raise Ace::Support::Cli::Error, error.message
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/authority/task_context.rb

@@ -1,31 +0,0 @@
-# frozen_string_literal: true
-require_relative "../../../authority/prepared_task_context"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Authority
-          class TaskContext < Ace::Support::Cli::Command
-            desc "Return the captured original task context through the fixed selected entry"
-            option :mapping, required: true, desc: "Installed original mapping ID"
-            option :assignment, required: true, desc: "Original assignment ID@SCOPE"
-            option :attempt, required: true, desc: "Original protected attempt ID"
-            option :task, required: true, desc: "Captured canonical task ID"
-
-            def call(**options)
-              unless options.keys.sort == %i[assignment attempt mapping task]
-                raise ArgumentError, "fixed task-context accepts only its four selectors"
-              end
-              consumer = Ace::Assign::Authority::PreparedTaskContext.new(context: @protected_assignment_context)
-              $stdout.write(consumer.call(**options))
-              0
-            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
-              raise Ace::Support::Cli::Error, error.message
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/authority/task_context_principal.rb

@@ -1,25 +0,0 @@
-# frozen_string_literal: true
-require_relative "../../../authority/prepared_task_context"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Authority
-          class TaskContextPrincipal < Ace::Support::Cli::Command
-            desc "Classify this actual caller through the installed and retained protected owners"
-
-            def call(**options)
-              raise ArgumentError, "fixed task-context-principal accepts no options" unless options.empty?
-              consumer = Ace::Assign::Authority::PreparedTaskContext.new(context: @protected_assignment_context)
-              $stdout.write(consumer.principal)
-              0
-            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
-              raise Ace::Support::Cli::Error, error.message
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/authority/task_context_selection.rb

@@ -1,30 +0,0 @@
-# frozen_string_literal: true
-require_relative "../../../authority/prepared_task_context"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Authority
-          class TaskContextSelection < Ace::Support::Cli::Command
-            desc "Return the authenticated original task-context entry without captured text"
-            option :mapping, required: true, desc: "Installed original mapping ID"
-            option :assignment, required: true, desc: "Original assignment ID@SCOPE"
-            option :attempt, required: true, desc: "Original protected attempt ID"
-
-            def call(**options)
-              unless options.keys.sort == %i[assignment attempt mapping]
-                raise ArgumentError, "fixed task-context-selection accepts only its three selectors"
-              end
-              consumer = Ace::Assign::Authority::PreparedTaskContext.new(context: @protected_assignment_context)
-              $stdout.write(consumer.selection(**options))
-              0
-            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
-              raise Ace::Support::Cli::Error, error.message
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/authority/terminate.rb

@@ -1,29 +0,0 @@
-# frozen_string_literal: true
-require "json"
-require_relative "../../../authority/launch_driver"
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Authority
-          class Terminate < Ace::Support::Cli::Command
-            desc "Close the original gated native child and request proven abort"
-            option :mapping, required: true, desc: "Installed launch mapping ID"
-            option :assignment, required: true, desc: "Assignment ID"
-            option :attempt, required: true, desc: "Attempt ID"
-            def call(**options)
-              client = Ace::Assign::Authority::Client.new(mapping_id: options.fetch(:mapping))
-              state = client.call("inspect_launch", {"assignment_id" => options.fetch(:assignment), "attempt_id" => options.fetch(:attempt)}).data
-              binding = state.fetch("process_binding") { raise ArgumentError, "no positively recorded original child; supervisor inspection required" }
-              result = Ace::Assign::Authority::LaunchDriver.new(mapping_id: options.fetch(:mapping)).terminate(
-                state: state, binding: binding, evidence: "protected exact-child termination requested")
-              puts JSON.generate(result)
-            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
-              raise Ace::Support::Cli::Error, error.message
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/authority/worker.rb

@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-require_relative "../../../authority/prepared_worker"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Authority
-          class Worker < Ace::Support::Cli::Command
-            desc "Consume the original authenticated prepared subtree as its fixed worker"
-
-            def call(**options)
-              raise ArgumentError, "fixed worker accepts no options" unless options.empty?
-              Ace::Assign::Authority::PreparedWorker.new.run
-            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
-              raise Ace::Support::Cli::Error, error.message
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/campaign_export_result.rb

@@ -1,55 +0,0 @@
-# frozen_string_literal: true
-require_relative "protected_submission"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        class CampaignExportResult < Ace::Support::Cli::Command
-          include Ace::Support::Cli::Base
-          include ProtectedSubmission
-          desc "Download a verified accepted campaign result through its original authority"
-          option :mapping, desc: "Original installed parent mapping"
-          option :assignment, desc: "Original parent assignment"
-          option :attempt, desc: "Original parent attempt"
-          option :head, desc: "Exact parent candidate head"
-          option :candidate_generation, desc: "Exact parent candidate counter"
-          option :output, desc: "Result byte file (created once, exact retries allowed)"
-
-          def call(**options)
-            usage = "campaign-export-result with original parent selectors and --output FILE"
-            context = protected_context(options)
-            raise AttemptErrors::EvidenceUnavailable, "Campaign export requires installed authority" unless context
-            params = {"assignment_id" => require_option(options, :assignment, usage),
-              "attempt_id" => require_option(options, :attempt, usage), "head" => require_option(options, :head, usage),
-              "candidate_generation" => integer_option(options, :candidate_generation, usage, positive: true)}
-            raise Ace::Support::Cli::Error, "Campaign head must be an exact SHA-1" unless params["head"].match?(/\A[0-9a-f]{40}\z/)
-            context.verify_attempt_hints!(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"))
-            path = require_option(options, :output, usage)
-            reply = context.client(options: options).call("campaign_export_result", params, download: true, purpose: :artifacts, timeout: 30)
-            bytes = reply.parts&.first
-            unless reply.parts&.size == 1 && bytes.is_a?(String) && bytes.bytesize <= 64 * 1024 &&
-                reply.data.values_at("head", "candidate_generation", "bytes", "sha256") ==
-                  [params.fetch("head"), params.fetch("candidate_generation"), bytes.bytesize, Digest::SHA256.hexdigest(bytes)]
-              raise AttemptErrors::EvidenceUnavailable, "Campaign result download differs"
-            end
-            begin
-              File.open(path, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0o600) do |file|
-                file.write(bytes)
-                file.flush
-                file.fsync
-              end
-            rescue Errno::EEXIST
-              raise Ace::Support::Cli::Error, "Existing campaign result file differs" unless input_bytes(path, limit: 64 * 1024) == bytes
-            end
-            emit_json(reply.data.except("transfer").merge("path" => path))
-          rescue SecurityError, Ace::Runtime::RuntimeUnavailableError
-            protected_transport_unavailable!
-          rescue SystemCallError, IOError
-            raise Ace::Support::Cli::Error, "Campaign result file or transport is unavailable"
-          end
-        end
-      end
-    end
-  end
-end