ace-herdr 0.3.2 → 0.5.0

data/lib/ace/herdr/molecules/inbox_context_service_configuration.rb

@@ -0,0 +1,183 @@
+# frozen_string_literal: true
+
+require "ace/runtime/molecules/protected_artifact_set"
+require "ace/runtime/molecules/execution_unit_installation"
+require_relative "inbox_context_store"
+
+module Ace
+  module Herdr
+    module Molecules
+      # The generated entry's accepted literal stage precedes the final owner.
+      # Fresh key contents remain owned by InboxContextKey, not this snapshot.
+      class InboxContextServiceConfiguration
+        LIMIT = 65_536
+        TOKEN = /\A[A-Za-z0-9][A-Za-z0-9._-]{0,127}\z/
+        MAX_ID = (1 << 32) - 2
+        STAGE_FIELDS = %w[configuration inbox_context_id project_id schema].freeze
+        FIELDS = %w[authority control_socket_path deliveries_dir grants inbox_context_id key native_clients native_mapping_id owner_credentials project_id schema socket_gid state_root].freeze
+        PURPOSES = %w[deliver enqueue maintenance_inventory].freeze
+        ROLES = %w[authority maintenance signer supervisor].freeze
+        attr_reader :data, :reference
+
+        def self.load(stage:, artifacts: Ace::Runtime::Molecules::ProtectedArtifactSet.new)
+          strict!(stage, STAGE_FIELDS)
+          unless stage["schema"] == "ace.herdr.inbox-context-stage/v1" &&
+              %w[project_id inbox_context_id].all? { |key| token?(stage[key]) }
+            raise ValidationError, "context service stage differs"
+          end
+          reference = stage.fetch("configuration")
+          strict!(reference, %w[bytes path sha256])
+          unless path?(reference["path"]) && reference["bytes"].is_a?(Integer) && reference["bytes"].between?(1, LIMIT) &&
+              reference["sha256"].is_a?(String) && reference["sha256"].match?(/\A[0-9a-f]{64}\z/)
+            raise ValidationError, "context service configuration reference differs"
+          end
+          artifacts.with do |reader|
+            data = InboxContextStore.decode(reader.read!(reference), limit: LIMIT)
+            validate!(data)
+            unless data.values_at("project_id", "inbox_context_id") == stage.values_at("project_id", "inbox_context_id")
+              raise ValidationError, "context service configuration association differs"
+            end
+            reader.verify_unchanged!
+            new(data, reference)
+          end
+        rescue KeyError, TypeError, Ace::Runtime::RuntimeUnavailableError
+          raise ValidationError, "context service configuration unavailable"
+        end
+
+        def self.validate!(data)
+          strict!(data, FIELDS)
+          unless data["schema"] == "ace.herdr.inbox-context-service/v1" &&
+              %w[project_id inbox_context_id native_mapping_id].all? { |key| token?(data[key]) } &&
+              %w[control_socket_path state_root deliveries_dir].all? { |key| path?(data[key]) }
+            raise ValidationError, "context service configuration fields differ"
+          end
+          credentials!(data.fetch("owner_credentials"), root: false)
+          native_clients!(data.fetch("native_clients"))
+          authority = data.fetch("authority")
+          strict!(authority, %w[gid groups socket_path uid])
+          credentials!(authority.slice("uid", "gid", "groups"), root: false)
+          raise ValidationError, "context service authority path differs" unless path?(authority["socket_path"])
+          key = data.fetch("key")
+          strict!(key, %w[configuration_path public_key_path])
+          unless key.values.all? { |path| path?(path) } && key.values.uniq.size == 2
+            raise ValidationError, "context service key paths differ"
+          end
+          grants = data.fetch("grants")
+          unless grants.is_a?(Array) && grants.size.between?(1, 64) && grants.all? { |grant| grant.is_a?(Hash) } &&
+              grants.map { |grant| grant["uid"] }.uniq.size == grants.size
+            raise ValidationError, "context service grants overlap or exceed bounds"
+          end
+          grants.each do |grant|
+            strict!(grant, %w[gid groups purposes role uid])
+            credentials!(grant.slice("uid", "gid", "groups"), root: true)
+            unless ROLES.include?(grant["role"]) && grant["purposes"].is_a?(Array) &&
+                grant["purposes"] == grant["purposes"].sort.uniq && (grant["purposes"] - PURPOSES).empty? &&
+                (grant["role"] != "maintenance" || grant["purposes"] == ["maintenance_inventory"])
+              raise ValidationError, "context service grant differs"
+            end
+          end
+          uid = data.fetch("owner_credentials").fetch("uid")
+          if uid == authority.fetch("uid") || grants.any? { |grant| grant.fetch("uid") == uid }
+            raise ValidationError, "context service owner overlaps a caller principal"
+          end
+          gid = data["socket_gid"]
+          unless gid.is_a?(Integer) && gid.between?(1, MAX_ID) &&
+              (data.fetch("owner_credentials").fetch("groups") + [data.fetch("owner_credentials").fetch("gid")]).include?(gid) &&
+              grants.all? { |grant| grant.fetch("uid").zero? || (grant.fetch("groups") + [grant.fetch("gid")]).include?(gid) }
+            raise ValidationError, "context service socket group is unavailable"
+          end
+          private_roots = data.values_at("state_root", "deliveries_dir")
+          protected = key.values + [authority.fetch("socket_path"), data.fetch("control_socket_path")]
+          if overlap?(*private_roots) || private_roots.any? { |root| protected.any? { |path| overlap?(root, path) } } ||
+              data.fetch("control_socket_path") == authority.fetch("socket_path")
+            raise ValidationError, "context service private roots overlap"
+          end
+          true
+        rescue KeyError, TypeError, NoMethodError
+          raise ValidationError, "context service configuration malformed"
+        end
+
+        def self.credentials!(value, root:)
+          strict!(value, %w[gid groups uid])
+          minimum = root ? 0 : 1
+          unless value.values_at("uid", "gid").all? { |id| id.is_a?(Integer) && id.between?(minimum, MAX_ID) } &&
+              value["groups"].is_a?(Array) && value["groups"].size <= 64 &&
+              value["groups"].all? { |id| id.is_a?(Integer) && id.between?(0, MAX_ID) } &&
+              value["groups"] == value["groups"].sort.uniq
+            raise ValidationError, "context service credentials differ"
+          end
+        end
+
+        # The accepted release owns executable startup bytes and IPC placement;
+        # no PATH discovery, inherited HOME or ambient queue-client fallback.
+        def self.native_clients!(value)
+          strict!(value, %w[codex cwd dependencies environment herdr pi resources])
+          dependencies = value.fetch("dependencies")
+          unless dependencies.is_a?(Array) && dependencies.size <= 509
+            raise ValidationError, "context native dependency closure exceeds bounds"
+          end
+          refs = value.values_at("codex", "pi", "herdr") + dependencies
+          refs.each do |ref|
+            strict!(ref, %w[bytes path sha256])
+            unless path?(ref["path"]) && ref["bytes"].is_a?(Integer) && ref["bytes"].between?(1, 268_435_456) &&
+                ref["sha256"].is_a?(String) && ref["sha256"].match?(/\A[0-9a-f]{64}\z/)
+              raise ValidationError, "context native executable reference differs"
+            end
+          end
+          unless refs.map { |ref| ref.fetch("path") }.uniq.size == refs.size &&
+              refs.sum { |ref| ref.fetch("bytes") } <= 268_435_456 && path?(value["cwd"])
+            raise ValidationError, "context native closure overlaps or exceeds bounds"
+          end
+          environment = value.fetch("environment")
+          unless environment.is_a?(Hash) && environment.size <= 32 && environment.all? { |name, item|
+            name.is_a?(String) && Ace::Runtime::Molecules::ExecutionUnitInstallation::NATIVE_ENVIRONMENT.include?(name) && item.is_a?(String) &&
+              item.bytesize <= 4096 && item.encoding == Encoding::UTF_8 && item.valid_encoding? && !item.include?("\0")
+          }
+            raise ValidationError, "context native environment differs"
+          end
+          resources = value.fetch("resources")
+          unless resources.is_a?(Array) && resources.size <= 64 && resources.all? { |row|
+            row.is_a?(Hash) && row.keys.sort == %w[access gid kind mode path uid] && path?(row["path"]) &&
+              %w[directory socket].include?(row["kind"]) && %w[read write].include?(row["access"]) &&
+              row.values_at("uid", "gid").all? { |id| id.is_a?(Integer) && id.between?(0, MAX_ID) } &&
+              row["mode"].is_a?(Integer) && row["mode"].between?(0, 0o777)
+          } && resources.map { |row| row.fetch("path") }.uniq.size == resources.size &&
+              resources.any? { |row| row.fetch("path") == value.fetch("cwd") && row.fetch("kind") == "directory" }
+            raise ValidationError, "context native resource selection differs"
+          end
+          true
+        rescue KeyError, TypeError, NoMethodError
+          raise ValidationError, "context native selection is malformed"
+        end
+
+        def self.strict!(value, fields)
+          raise ValidationError, "context service fields differ" unless value.is_a?(Hash) && value.keys.sort == fields
+        end
+
+        def self.token?(value) = value.is_a?(String) && TOKEN.match?(value)
+        def self.path?(value)
+          value.is_a?(String) && value.bytesize.between?(2, 4096) && value.start_with?("/") &&
+            !value.match?(/[\s\0;]/) && File.expand_path(value) == value
+        end
+        def self.overlap?(left, right) = left == right || left.start_with?(right + "/") || right.start_with?(left + "/")
+
+        private
+
+        def initialize(data, reference)
+          @data, @reference = [data, reference].map { |value| immutable(value) }
+          freeze
+        end
+
+        def immutable(value)
+          case value
+          when Hash then value.to_h { |key, item| [key.dup.freeze, immutable(item)] }.freeze
+          when Array then value.map { |item| immutable(item) }.freeze
+          when String then value.dup.freeze
+          else value.freeze
+          end
+        end
+        private_class_method :new
+      end
+    end
+  end
+end

data/lib/ace/herdr/molecules/inbox_context_store.rb

@@ -0,0 +1,159 @@
+# frozen_string_literal: true
+
+require_relative "../errors"
+require "json"
+require "securerandom"
+require "ace/runtime/molecules/protected_socket"
+
+module Ace
+  module Herdr
+    module Molecules
+      # Operational admission metadata only; DeliveryRecord remains the event ledger.
+      class InboxContextStore
+        LIMIT = 1_048_576
+        class AlreadyProvisioned < ValidationError; end
+        class ClosedObject < Hash
+          def []=(key, value)
+            raise ValidationError, "duplicate context field" if key?(key)
+            super
+          end
+        end
+
+        def self.decode(bytes, limit: LIMIT)
+          raise ValidationError, "context bytes exceed bounds" unless bytes.is_a?(String) && bytes.bytesize.between?(1, limit)
+          text = bytes.dup.force_encoding(Encoding::UTF_8)
+          raise ValidationError, "context bytes are not UTF-8" unless text.valid_encoding?
+          decoded = JSON.parse(text, object_class: ClosedObject, create_additions: false, max_nesting: 16,
+            allow_nan: false, allow_comments: false, allow_duplicate_key: false)
+          # ClosedObject detects duplicates while decoding, not subsequent CAS updates.
+          JSON.parse(JSON.generate(decoded), create_additions: false)
+        rescue JSON::ParserError, JSON::NestingError
+          raise ValidationError, "context metadata is malformed"
+        end
+
+        def initialize(root:, uid:, protection: Ace::Runtime::Molecules::ProtectedSocket)
+          @root, @uid, @protection = root, uid, protection
+          @mutex = Mutex.new
+          verify_root!
+          @lease = open_private(".context-owner.lock", create: true)
+          unless @lease.flock(File::LOCK_EX | File::LOCK_NB)
+            @lease.close
+            raise ValidationError, "context owner is already active"
+          end
+        end
+
+        # Explicit installer/bootstrap operation. Restart never initializes a missing file.
+        def provision!(data)
+          @mutex.synchronize do
+            ensure_open!
+            bytes = encode(data)
+            File.open(path, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0o600) do |file|
+              file.write(bytes)
+              file.flush
+              file.fsync
+            end
+            fsync_root!
+          end
+        rescue Errno::EEXIST
+          raise AlreadyProvisioned, "context metadata already exists"
+        rescue SystemCallError
+          raise ValidationError, "context metadata provisioning refused"
+        end
+
+        def transaction
+          @mutex.synchronize do
+            ensure_open!
+            verify_root!
+            state = read!
+            before = JSON.generate(state)
+            result = yield state
+            persist!(state) unless JSON.generate(state) == before
+            result
+          end
+        rescue SystemCallError, IOError
+          raise ValidationError, "context metadata is unavailable"
+        end
+
+        def close
+          @mutex.synchronize do
+            @lease&.close
+            @lease = nil
+          end
+        end
+
+        private
+
+        def ensure_open!
+          raise ValidationError, "context owner is closed" unless @lease && !@lease.closed?
+          unless identity(@lease.stat) == identity(File.lstat(File.join(@root, ".context-owner.lock")))
+            raise ValidationError, "context owner lock changed"
+          end
+        end
+
+        def verify_root!
+          @protection.root_path!(@root, directory: true, owner: @uid)
+          stat = File.lstat(@root)
+          unless stat.directory? && !stat.symlink? && stat.uid == @uid && (stat.mode & 0o077).zero?
+            raise ValidationError, "context state root is not private"
+          end
+          current = [stat.dev, stat.ino, stat.uid, stat.mode]
+          raise ValidationError, "context state root changed" if @root_identity && current != @root_identity
+          @root_identity ||= current
+        end
+
+        def path = File.join(@root, ".context-control.json")
+
+        def open_private(name, create: false)
+          flags = File::RDWR | File::NOFOLLOW | File::NONBLOCK | (create ? File::CREAT : 0)
+          file = File.open(File.join(@root, name), flags, 0o600)
+          begin
+            file.close_on_exec = true
+            stat = file.stat
+            unless stat.file? && stat.uid == @uid && (stat.mode & 0o077).zero? &&
+                identity(stat) == identity(File.lstat(File.join(@root, name)))
+              raise ValidationError, "context metadata file is unsafe"
+            end
+            file
+          rescue Exception
+            file.close
+            raise
+          end
+        end
+
+        def read!
+          file = open_private(".context-control.json")
+          self.class.decode(file.read(LIMIT + 1))
+        ensure
+          file&.close
+        end
+
+        def encode(data)
+          bytes = JSON.generate(data)
+          raise ValidationError, "context metadata exceeds bounds" unless bytes.bytesize.between?(1, LIMIT)
+          bytes
+        end
+
+        def persist!(data)
+          bytes = encode(data)
+          temporary = File.join(@root, ".context-control.#{SecureRandom.hex(16)}.tmp")
+          File.open(temporary, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0o600) do |file|
+            file.write(bytes)
+            file.flush
+            file.fsync
+          end
+          verify_root!
+          File.rename(temporary, path)
+          fsync_root!
+        ensure
+          File.unlink(temporary) if temporary && File.exist?(temporary)
+        end
+
+        def fsync_root!
+          File.open(@root, File::RDONLY | File::NOFOLLOW) { |directory| directory.fsync }
+        end
+
+        def identity(stat) = [stat.dev, stat.ino, stat.uid, stat.mode]
+      end
+    end
+  end
+end

data/lib/ace/herdr/molecules/inbox_context_wire.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require_relative "inbox_context_store"
+require "ace/runtime/molecules/protected_socket"
+
+module Ace
+  module Herdr
+    module Molecules
+      module InboxContextWire
+        LIMIT = 16_384
+        DEADLINE = 30
+        module_function
+
+        def read(socket, deadline:)
+          bytes = +""
+          loop do
+            remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            unless remaining.positive? && IO.select([socket], nil, nil, remaining)
+              raise ValidationError, "context deadline reports blocked"
+            end
+            chunk = socket.read_nonblock(1, exception: false)
+            next if chunk == :wait_readable
+            raise ValidationError, "context frame was not completed" unless chunk
+            bytes << chunk
+            raise ValidationError, "context frame exceeds bounds" if bytes.bytesize > LIMIT
+            break if chunk == "\n"
+          end
+          InboxContextStore.decode(bytes, limit: LIMIT)
+        end
+
+        def write(socket, value, deadline:)
+          Ace::Runtime::Molecules::ProtectedSocket.write(socket, value, deadline: deadline, limit: LIMIT)
+        end
+
+        def read_payload(socket, size:, deadline:)
+          unless size.is_a?(Integer) && size.between?(1, 65_536)
+            raise ValidationError, "context payload byte count differs"
+          end
+          bytes = +"".b
+          while bytes.bytesize < size
+            remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            unless remaining.positive? && IO.select([socket], nil, nil, remaining)
+              raise ValidationError, "context payload upload deadline expired"
+            end
+            part = socket.read_nonblock([size - bytes.bytesize, 4096].min, exception: false)
+            next if part == :wait_readable
+            raise ValidationError, "context payload upload was not completed" unless part
+            bytes << part
+          end
+          text = bytes.force_encoding(Encoding::UTF_8)
+          raise ValidationError, "context payload encoding differs" unless text.valid_encoding? && !text.include?("\0")
+          text.freeze
+        end
+
+
+
+
+
+        def require_eof!(socket, deadline:)
+          loop do
+            remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            unless remaining.positive? && IO.select([socket], nil, nil, remaining)
+              raise ValidationError, "context request upload was not completed"
+            end
+            byte = socket.read_nonblock(1, exception: false)
+            next if byte == :wait_readable
+            raise ValidationError, "context request has extra bytes" if byte
+            return
+          end
+        end
+
+        def deadline = Ace::Runtime::Molecules::ProtectedSocket.deadline(DEADLINE)
+      end
+    end
+  end
+end

data/lib/ace/herdr/molecules/inbox_direct_effect_binding.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+require "digest"
+require "ace/hitl/contract"
+require_relative "inbox_context_store"
+
+module Ace
+  module Herdr
+    module Molecules
+      # Original selectors only; DeliveryRecord is the sole effect ledger.
+      module InboxDirectEffectBinding
+        SCHEMA = "ace.herdr.inbox-direct-effect/v2"
+        ORIGINAL_FIELDS = %w[project_id assignment_id mapping_id inbox_context_id].freeze
+        TOKEN = /\A[A-Za-z0-9][A-Za-z0-9._-]{0,127}\z/
+        SHA = /\A[0-9a-f]{64}\z/
+        module_function
+
+        def build(purpose:, event_id:, attempt_id:, key_generation:, selection:, original:)
+          value = {"schema" => SCHEMA, "purpose" => purpose, "event_id" => event_id,
+            "attempt_id" => attempt_id, "selection" => selection}
+          original!(original)
+          value.merge!(original)
+          value["input_sha256"] = digest_input(value, key_generation)
+          verify!(value, key_generation: key_generation)
+        end
+
+        def verify!(value, key_generation:)
+          object!(value, %w[schema purpose event_id attempt_id selection input_sha256] + ORIGINAL_FIELDS)
+          original!(value.slice(*ORIGINAL_FIELDS))
+          unless value["schema"] == SCHEMA && %w[enqueue deliver].include?(value["purpose"]) &&
+              %w[event_id attempt_id].all? { |key| value[key].is_a?(String) && TOKEN.match?(value[key]) } &&
+              key_generation.is_a?(Integer) && key_generation.between?(1, (1 << 63) - 1)
+            raise ValidationError, "direct context binding differs"
+          end
+          selection = value.fetch("selection")
+          if value.fetch("purpose") == "enqueue"
+            object!(selection, %w[reverse payload_bytes payload_sha256])
+            reverse!(selection.fetch("reverse"))
+            unless selection["payload_bytes"].is_a?(Integer) && selection["payload_bytes"].between?(1, 65_536) &&
+                selection["payload_sha256"].is_a?(String) && SHA.match?(selection["payload_sha256"])
+              raise ValidationError, "direct payload selection differs"
+            end
+          else
+            object!(selection, %w[expected_claim_generation])
+            unless selection["expected_claim_generation"].is_a?(Integer) && selection["expected_claim_generation"] >= 0
+              raise ValidationError, "direct claim generation differs"
+            end
+          end
+          unless value["input_sha256"].is_a?(String) && SHA.match?(value["input_sha256"]) &&
+              value["input_sha256"] == digest_input(value, key_generation)
+            raise ValidationError, "direct context input digest differs"
+          end
+          JSON.parse(JSON.generate(value))
+        end
+
+        def original!(value)
+          object!(value, ORIGINAL_FIELDS)
+          unless ORIGINAL_FIELDS.all? { |key| value[key].is_a?(String) && TOKEN.match?(value[key]) }
+            raise ValidationError, "direct original context selection differs"
+          end
+          value
+        end
+
+        def reverse!(value)
+          object!(value, %w[schema session pane])
+          raise ValidationError, "direct reverse schema differs" unless value["schema"] == Ace::Hitl::Providers::Ref::SCHEMA
+          Ace::Hitl::Providers::Ref.new(session: value["session"], pane: value["pane"], canonical: true)
+          value
+        rescue Ace::Hitl::Providers::InvalidRefError
+          raise ValidationError, "direct reverse address differs"
+        end
+
+        def digest_input(value, generation)
+          selection = value.fetch("selection")
+          normalized = if value.fetch("purpose") == "enqueue"
+            {"reverse" => selection.fetch("reverse").slice("schema", "session", "pane"),
+              "payload_bytes" => selection.fetch("payload_bytes"), "payload_sha256" => selection.fetch("payload_sha256")}
+          else
+            {"expected_claim_generation" => selection.fetch("expected_claim_generation")}
+          end
+          Digest::SHA256.hexdigest(JSON.generate(value.slice("purpose", "event_id", "attempt_id", *ORIGINAL_FIELDS)
+            .merge("key_generation" => generation, "selection" => normalized)))
+        rescue KeyError, TypeError, NoMethodError
+          raise ValidationError, "direct context selectors differ"
+        end
+
+        def object!(value, fields)
+          raise ValidationError, "direct context fields differ" unless value.is_a?(Hash) && value.keys.sort == fields.sort
+        end
+      end
+    end
+  end
+end

data/lib/ace/herdr/molecules/inbox_direct_result.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+require_relative "inbox_direct_effect_binding"
+
+module Ace
+  module Herdr
+    module Molecules
+      module InboxDirectResult
+        SCHEMA = "ace.herdr.inbox-direct-result/v1"
+        RECORD_FIELDS = %w[event_id attempt_id payload_sha256 claim_generation state original_context original_binding_digest origin_target target binding session pane submission_intent wake].freeze
+        module_function
+
+        def build(operation:, record:, admission_state: nil)
+          projected = record.slice(*RECORD_FIELDS)
+          projected["wake"] = record["wake"].is_a?(Hash) ? record.fetch("wake").slice("status") : nil
+          result = {"schema" => SCHEMA, "operation" => operation, "record" => projected}
+          result["admission_state"] = admission_state unless operation == "status_context"
+          verify!(result, operation: operation, event_id: record.fetch("event_id"), attempt_id: record.fetch("attempt_id"), original: record.fetch("original_context"))
+        end
+
+        def verify!(value, operation:, event_id:, attempt_id:, original:)
+          fields = %w[schema operation record]
+          fields << "admission_state" unless operation == "status_context"
+          InboxDirectEffectBinding.object!(value, fields)
+          unless value["schema"] == SCHEMA && value["operation"] == operation &&
+              %w[enqueue_context deliver_context status_context].include?(operation) &&
+              (operation == "status_context" || %w[idle unknown].include?(value["admission_state"])) &&
+              (operation != "enqueue_context" || value["admission_state"] == "idle")
+            raise ValidationError, "direct context result differs"
+          end
+          record = value.fetch("record")
+          InboxDirectEffectBinding.object!(record, RECORD_FIELDS)
+          InboxDirectEffectBinding.original!(record.fetch("original_context"))
+          raise ValidationError, "direct result original selection differs" unless record.fetch("original_context") == original
+          raise ValidationError, "direct result original record differs" unless record["original_binding_digest"].is_a?(String) && InboxDirectEffectBinding::SHA.match?(record["original_binding_digest"])
+          unless record.values_at("event_id", "attempt_id") == [event_id, attempt_id] &&
+              %w[payload_sha256].all? { |key| record[key].is_a?(String) && InboxDirectEffectBinding::SHA.match?(record[key]) } &&
+              record["claim_generation"].is_a?(Integer) && record["claim_generation"] >= 0 &&
+              %w[queued claimed uncertain delivered completed].include?(record["state"]) &&
+              [true, false].include?(record["submission_intent"])
+            raise ValidationError, "direct context retained result association differs"
+          end
+          Ace::Hitl::Providers::Ref.new(session: record["session"], pane: record["pane"], canonical: true)
+          %w[origin_target target binding].each do |key|
+            target = record[key]
+            base = %w[session pane terminal_id agent thread thread_kind]
+            allowed = base + (key == "binding" ? %w[agent_status payload_sha256] : key == "target" ? %w[agent_status] : [])
+            unless target.is_a?(Hash) && (target.keys - allowed).empty? && (base - target.keys).empty? &&
+                target.values.all? { |item| item.is_a?(String) && item.valid_encoding? && item.bytesize.between?(1, 1024) && !item.include?("\0") } &&
+                %w[codex pi].include?(target["agent"]) && target["thread_kind"] == "id" &&
+                (key != "binding" || target["payload_sha256"] == record["payload_sha256"])
+              raise ValidationError, "direct context result target differs"
+            end
+          end
+          if record["wake"]
+            InboxDirectEffectBinding.object!(record["wake"], %w[status])
+            raise ValidationError, "direct context wake observation differs" unless %w[none sent pending issuing uncertain not_issued].include?(record.dig("wake", "status"))
+          end
+          value
+        rescue KeyError, TypeError, Ace::Hitl::Providers::InvalidRefError
+          raise ValidationError, "direct context result is unavailable"
+        end
+      end
+    end
+  end
+end

data/lib/ace/herdr/molecules/native_queue_executor.rb

@@ -1,7 +1,9 @@
 # frozen_string_literal: true
 
+require_relative "../errors"
 require "json"
 require "timeout"
+require_relative "bounded_process"
 
 module Ace
   module Herdr
@@ -17,21 +19,17 @@ module Ace
       class NativeQueueExecutor
         DEFAULT_SUBMIT_TIMEOUT_S = 60
         DEFAULT_IDENTITY_TIMEOUT_S = 20
-        # Codex payloads ride in argv; a single argument beyond the OS
-        # per-argument limit fails at exec with E2BIG — before any client
-        # code ran — so the payload is bounded pre-launch and any E2BIG
-        # escape is classified as a proven pre-submission rejection.
-        MAX_ARG_PAYLOAD_BYTES = 65_536
+        CODEX_PAYLOAD_LIMIT_BYTES = 65_536
         PI_PAYLOAD_LIMIT_BYTES = 65_536
 
         # runner: test seam. Callable (argv, stdin_data:, timeout_s:) ->
         # [stdout, stderr, status]. Defaults to the bounded runner.
-        def initialize(codex: "codex", pi_client: nil, runner: nil,
+        def initialize(pi_client: nil, runner: nil, process: BoundedProcess,
           submit_timeout_s: DEFAULT_SUBMIT_TIMEOUT_S,
           identity_timeout_s: DEFAULT_IDENTITY_TIMEOUT_S)
-          @codex = codex
           @pi_client = pi_client || ENV["ACE_HERDR_PI_QUEUE_CLIENT"] || "pi-overseer-queue-client"
           @runner = runner
+          @process = process
           @submit_timeout_s = submit_timeout_s
           @identity_timeout_s = identity_timeout_s
         end
@@ -54,21 +52,12 @@ module Ace
         end
 
         def submit(agent:, thread:, event_id:, digest:, payload:)
-          if agent == "pi" && (payload.empty? || payload.bytesize > PI_PAYLOAD_LIMIT_BYTES)
+          raise ValidationError, "unsupported native queue agent: #{agent}" unless agent == "pi"
+          if payload.empty? || payload.bytesize > PI_PAYLOAD_LIMIT_BYTES
             return {"accepted" => false, "pre_submit" => true, "error" => "Pi payload must be 1..65536 bytes"}
           end
-          if agent == "codex" && payload.bytesize > MAX_ARG_PAYLOAD_BYTES
-            return {"accepted" => false, "pre_submit" => true,
-                    "error" => "Codex payload must be at most #{MAX_ARG_PAYLOAD_BYTES} bytes for argv delivery"}
-          end
-          argv = if agent == "codex"
-            [@codex, "queue", "--thread", thread, "--message", payload]
-          elsif agent == "pi"
-            [@pi_client, "--delivery", event_id, "--session-id", thread,
-              "--payload-sha256", digest, "--payload-bytes", payload.bytesize.to_s]
-          else
-            raise ValidationError, "unsupported native queue agent: #{agent}"
-          end
+          argv = [@pi_client, "--delivery", event_id, "--session-id", thread,
+            "--payload-sha256", digest, "--payload-bytes", payload.bytesize.to_s]
           result = execute(argv, stdin_data: agent == "pi" ? payload : "",
             timeout_s: @submit_timeout_s)
           raise ExecutorError, "native queue output exceeded the retained limit" if result.oversized
@@ -103,7 +92,7 @@ module Ace
             return BoundedProcess::Result.new(stdout, stderr, status, false)
           end
 
-          BoundedProcess.call(argv, stdin_data: stdin_data, timeout_s: timeout_s)
+          @process.call(argv, stdin_data: stdin_data, timeout_s: timeout_s)
         rescue SystemCallError => e
           # popen3 raises spawn failures before the child exists, so no
           # submission can have begun: proven pre-launch, retryable.