ace-herdr 0.3.2 → 0.5.0

data/lib/ace/herdr/organisms/inbox.rb

@@ -1,11 +1,14 @@
 # frozen_string_literal: true
 
+require_relative "../errors"
 require "digest"
 require "json"
 require "time"
 require "securerandom"
-require "openssl"
 require "ace/hitl/contract"
+require_relative "../molecules/native_queue_executor"
+require_relative "inbox_guarded_wake"
+require_relative "../molecules/inbox_direct_effect_binding"
 
 module Ace
   module Herdr
@@ -13,9 +16,12 @@ module Ace
       # Durable event inbox. All transitions for one event are serialized by
       # DeliveryRecordStore; a saved submission intent is never replayed.
       class Inbox
+        include InboxGuardedWake
         class IdentityDriftError < ValidationError; end
+        class MissingEventError < ValidationError; end
 
         EVENT = /\A[A-Za-z0-9][A-Za-z0-9._-]{0,127}\z/
+        TARGET_IDENTITY = %w[session pane terminal_id agent thread thread_kind].freeze
         THREAD_ID = /\A[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}\z/
         PI_PATH = /_([0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12})\.jsonl\z/
         # Single validator for Pi queue event ids, shared by enqueue and
@@ -28,17 +34,148 @@ module Ace
         AGENT_STATUSES = %w[idle busy working blocked done].freeze
         WAKE_STATUSES = %w[idle done].freeze
 
-        def initialize(executor:, native:, deliveries_dir:, receipt_public_key: nil)
+        # The maintained CLI uses the configured durable delivery store.
+        def self.from_config(config: Ace::Herdr.config, root: Dir.pwd,
+          executor: Molecules::HerdrExecutor.new, native: Molecules::NativeQueueExecutor.new)
+          new(executor: executor, native: native,
+            deliveries_dir: File.expand_path(config["deliveries_dir"] || ".ace-local/herdr/deliveries", root))
+        end
+
+        # Enumerate retained event identities through the same store/lock owner.
+        # Unreadable unattributable records cannot be treated as another attempt.
+        def self.retained_events(deliveries_dir:, attempt:)
+          raise ValidationError, "invalid attempt id" unless attempt.is_a?(String) && EVENT.match?(attempt)
+          retained_records(deliveries_dir: deliveries_dir).filter_map do |record|
+            record.event_id if record.inbox.fetch("attempt_id") == attempt
+          end
+        end
+
+        # The same existing per-event locks remain held through the consumer's
+        # complete validation and retirement transaction, not just enumeration.
+        def self.with_retained_records(deliveries_dir:, deadline: nil, &block)
+          stat = File.lstat(deliveries_dir)
+          raise ValidationError, "retained inbox directory is unsafe" unless stat.directory? && !stat.symlink?
+          # An empty retained store needs the coordination lock too. Creating
+          # only this lock never creates a missing context or a delivery record.
+          Molecules::DeliveryRecordStore.with_inventory_lock(deliveries_dir, exclusive: true, create: true, prepare_directory: false, deadline: deadline) do
+            with_retained_records_held(deliveries_dir: deliveries_dir, deadline: deadline, &block)
+          end
+        rescue SystemCallError
+          raise ValidationError, "retained inbox inventory is unavailable"
+        end
+
+        def self.with_retained_records_held(deliveries_dir:, deadline: nil, &block)
+          raise ArgumentError, "retained inbox block is required" unless block
+          roots = [deliveries_dir, Molecules::DeliveryRecordStore.archive_dir(deliveries_dir)]
+          names = lambda do
+            roots.flat_map do |dir|
+              next [] if dir != deliveries_dir && !File.exist?(dir) && !File.symlink?(dir)
+              stat = File.lstat(dir)
+              raise ValidationError, "retained inbox directory is unsafe" unless stat.directory? && !stat.symlink?
+              Dir.children(dir).filter_map { |name| name.delete_suffix(".json") if name.end_with?(".json") }
+            end.uniq.sort
+          end
+          ids = names.call
+          raise ValidationError, "retained inbox inventory exceeds bounds" if ids.size > 100_000
+          held = Thread.current[:ace_herdr_retained_inventory_locks] ||= {}
+          raise ValidationError, "retained inbox inventory already held" if held.key?(deliveries_dir)
+          raise ValidationError, "retained inbox event id is invalid" unless ids.all? { |event| EVENT.match?(event) }
+          Molecules::DeliveryRecordStore.with_locks(deliveries_dir, ids, create: false, deadline: deadline) do
+            raise ValidationError, "retained inbox inventory changed" unless names.call == ids
+            held[deliveries_dir] = ids.freeze
+            begin
+              result = block.call(retained_records(deliveries_dir: deliveries_dir))
+              raise ValidationError, "retained inbox inventory changed" unless names.call == ids
+              result
+            ensure
+              held.delete(deliveries_dir)
+            end
+          end
+        rescue SystemCallError, JSON::ParserError, ArgumentError, KeyError, TypeError
+          raise ValidationError, "retained inbox inventory is unavailable"
+        end
+        private_class_method :with_retained_records_held
+
+        # Exhaustive live and archived inventory: no attempt filter may hide an
+        # unknown record, and live precedence cannot hide conflicting copies.
+        def self.retained_records(deliveries_dir:)
+          directories = [deliveries_dir, Molecules::DeliveryRecordStore.archive_dir(deliveries_dir)]
+          inventory = lambda do
+            directories.flat_map do |dir|
+              next [] if dir != deliveries_dir && !File.exist?(dir) && !File.symlink?(dir)
+              stat = File.lstat(dir)
+              raise ValidationError, "retained inbox directory is unsafe" unless stat.directory? && !stat.symlink?
+              Dir.children(dir).filter_map { |name| name.delete_suffix(".json") if name.end_with?(".json") }
+            end.uniq.sort
+          end
+          ids = inventory.call
+          raise ValidationError, "retained inbox inventory exceeds bounds" if ids.size > 100_000
+          records = ids.map do |event|
+            raise ValidationError, "retained inbox event id is invalid" unless EVENT.match?(event)
+            read_record = lambda do
+              copies = directories.filter_map do |dir|
+                path = Molecules::DeliveryRecordStore.path_for(dir, event)
+                next unless File.exist?(path) || File.symlink?(path)
+                before = File.lstat(path)
+                raise ValidationError, "retained inbox record is unsafe" unless before.file? && !before.symlink? && before.size.between?(1, 1_048_576)
+                File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |handle|
+                  snapshot = ->(stat) { [stat.dev, stat.ino, stat.size, stat.mtime, stat.ctime] }
+                  raise ValidationError, "retained inbox record changed" unless snapshot.call(before) == snapshot.call(handle.stat)
+                  bytes = handle.read(before.size + 1)
+                  raise ValidationError, "retained inbox record changed" unless bytes.bytesize == before.size &&
+                    snapshot.call(before) == snapshot.call(handle.stat) && snapshot.call(before) == snapshot.call(File.lstat(path))
+                  value = JSON.parse(bytes.dup.force_encoding(Encoding::UTF_8), create_additions: false,
+                    max_nesting: 32, allow_duplicate_key: false, allow_comments: false)
+                  record = Models::DeliveryRecord.from_h(value)
+                  unless record.event_id == event && record.inbox && record.inbox.fetch("attempt_id").is_a?(String) &&
+                      EVENT.match?(record.inbox.fetch("attempt_id"))
+                    raise ValidationError, "retained inbox event is unavailable"
+                  end
+                  record
+                end
+              end
+              if copies.empty? || copies.map(&:to_h).uniq.length != 1
+                raise ValidationError, "retained inbox copies conflict"
+              end
+              copies.first
+            end
+            if Thread.current[:ace_herdr_retained_inventory_locks]&.dig(deliveries_dir)&.include?(event)
+              read_record.call
+            else
+              Molecules::DeliveryRecordStore.with_lock(deliveries_dir, event, create: false, &read_record)
+            end
+          end
+          raise ValidationError, "retained inbox inventory changed" unless inventory.call == ids
+          records.freeze
+        rescue SystemCallError, JSON::ParserError, ArgumentError, KeyError, TypeError
+          raise ValidationError, "retained inbox inventory is unavailable"
+        end
+
+        def initialize(executor:, deliveries_dir:, native: Molecules::NativeQueueExecutor.new)
           @executor = executor
           @native = native
           @deliveries_dir = deliveries_dir
-          @receipt_public_key = receipt_public_key
         end
 
-        def enqueue(event:, attempt:, ref:, payload:)
+        # Project the accepted runtime owner before consuming an answer. Native
+        # observation may verify this identity, but cannot choose its replacement.
+        def target_from_owner(owner)
+          unless owner.is_a?(Hash) && owner["runtime"] == "herdr" &&
+              owner["agent_session"].is_a?(Hash) && owner.dig("agent_session", "agent") == owner["agent"]
+            raise ValidationError, "accepted native owner is unavailable"
+          end
+          target = owner.slice("session", "pane", "terminal_id", "agent").merge(
+            "thread" => owner.dig("agent_session", "value"), "thread_kind" => owner.dig("agent_session", "kind"))
+          validate_expected_target!(target)
+          target.transform_values { |value| value.dup.freeze }.freeze
+        end
+
+        def context_root = @deliveries_dir.dup.freeze
+
+
+        def enqueue(event:, attempt:, ref:, payload:, managed_envelope: nil, expected_target: nil, original_context: nil, original_binding_digest: nil)
           validate_id!(event, "event")
           validate_id!(attempt, "attempt")
-          raise ValidationError, "trusted receipt public key is unavailable" unless @receipt_public_key
           payload = payload.to_s
           raise ValidationError, "payload is required" if payload.empty?
           raise ValidationError, "payload contains NUL" if payload.include?("\0")
@@ -49,15 +186,51 @@ module Ace
             raise ValidationError, "payload is not valid UTF-8 text"
           end
 
+          if original_context
+            Molecules::InboxDirectEffectBinding.original!(original_context)
+            unless original_binding_digest.is_a?(String) && Molecules::InboxDirectEffectBinding::SHA.match?(original_binding_digest)
+              raise ValidationError, "original launch record digest differs"
+            end
+          elsif original_binding_digest
+            raise ValidationError, "original digest requires its context association"
+          end
           address = address_for(ref)
           digest = Digest::SHA256.hexdigest(payload)
+          envelope = if managed_envelope
+            Ace::Hitl::Contract::ManagedEnvelope.load(managed_envelope, expected: {
+              attempt_id: attempt, payload_sha256: digest,
+              reverse: {"schema" => Ace::Hitl::Providers::Ref::SCHEMA, "session" => address.session, "pane" => address.pane}
+            })
+          end
+          if envelope && Ace::Hitl::Contract::SecretGate::PATTERN.match?(payload)
+            raise ValidationError, "secret-bearing managed native answers are prohibited"
+          end
+          if envelope && expected_target.nil?
+            raise ValidationError, "managed native delivery requires the accepted original target"
+          end
+          unless expected_target.nil?
+            validate_expected_target!(expected_target)
+            expected_target = expected_target.slice(*TARGET_IDENTITY)
+            unless expected_target.values_at("session", "pane") == [address.session, address.pane]
+              raise ValidationError, "accepted original target differs from reverse address"
+            end
+          end
           with_event(event) do |record|
             if record
               validate_match!(record, attempt, address, digest)
+              unless record.inbox["managed_envelope"] == envelope && record.inbox["original_context"] == original_context && record.inbox["original_binding_digest"] == original_binding_digest
+                raise ValidationError, "managed envelope conflicts with immutable inbox event"
+              end
+              if expected_target && record.inbox["origin_target"] != expected_target
+                raise IdentityDriftError, "original native target conflicts with immutable inbox event"
+              end
               next public_record(record)
             end
 
-            target = observe_target(address.session, address.pane)
+            target = observe_target(address.session, address.pane, target: expected_target)
+            if expected_target && !TARGET_IDENTITY.all? { |key| target[key] == expected_target[key] }
+              raise IdentityDriftError, "native target differs from accepted original owner"
+            end
             if target["agent"] == "pi" && !PI_EVENT_ID.match?(event)
               raise ValidationError,
                 "Pi queue requires an inbox (inb-) or wake (wnk-) event id with at " \
@@ -65,7 +238,7 @@ module Ace
             end
             payload_limit = target["agent"] == "pi" ?
               Molecules::NativeQueueExecutor::PI_PAYLOAD_LIMIT_BYTES :
-              Molecules::NativeQueueExecutor::MAX_ARG_PAYLOAD_BYTES
+              Molecules::NativeQueueExecutor::CODEX_PAYLOAD_LIMIT_BYTES
             if payload.bytesize > payload_limit
               raise ValidationError,
                 "payload exceeds the #{target['agent']} native queue limit " \
@@ -75,30 +248,170 @@ module Ace
               event_id: event, session: address.session, pane: address.pane,
               answer_digest: digest, answer: payload, state: "queued",
               inbox: {"attempt_id" => attempt, "claim_generation" => 0,
-                "receipt_key_sha256" => key_fingerprint,
+                "managed_envelope" => envelope, "original_context" => original_context, "original_binding_digest" => original_binding_digest,
+                "origin_target" => target.slice(*TARGET_IDENTITY),
                 "target" => target, "binding" => target.merge("payload_sha256" => digest)}
             )
             save(record)
             public_record(record)
           end
+        rescue Ace::Hitl::Contract::InvalidEnvelope => e
+          raise ValidationError, e.message
         end
 
         def status(event:)
           validate_id!(event, "event")
           with_event(event) do |record|
-            raise ValidationError, "unknown inbox event: #{event}" unless record&.inbox
+            raise MissingEventError, "unknown inbox event: #{event}" unless record&.inbox
 
             public_record(record)
           end
         end
 
-        def deliver(event:)
+        # Direct completion readback uses the existing event lock and immutable ledger.
+        def verify_direct_enqueue(binding)
+          selection = binding.fetch("selection")
+          address = address_for(selection.fetch("reverse"))
+          with_event(binding.fetch("event_id"), create_lock: false) do |record|
+            raise ValidationError, "direct enqueue record is unavailable" unless record&.inbox
+            validate_match!(record, binding.fetch("attempt_id"), address, selection.fetch("payload_sha256"))
+            origin = record.inbox.fetch("origin_target")
+            validate_expected_target!(origin)
+            unless record.answer.bytesize == selection.fetch("payload_bytes") &&
+                record.inbox.fetch("original_context") == binding.slice(*Molecules::InboxDirectEffectBinding::ORIGINAL_FIELDS) &&
+                record.inbox["original_binding_digest"].is_a?(String) && Molecules::InboxDirectEffectBinding::SHA.match?(record.inbox.fetch("original_binding_digest")) &&
+                origin.values_at("session", "pane") == [address.session, address.pane] &&
+                record.inbox.fetch("binding").fetch("payload_sha256") == record.answer_digest
+              raise ValidationError, "direct enqueue retained association differs"
+            end
+            public_record(record)
+          end
+        rescue KeyError, TypeError, SystemCallError
+          raise ValidationError, "direct enqueue retained record is unavailable"
+        end
+
+        def verify_direct_delivery(binding, require_idle: false)
+          with_event(binding.fetch("event_id"), create_lock: false) do |record|
+            unless record&.inbox && record.inbox.fetch("attempt_id") == binding.fetch("attempt_id") &&
+                record.inbox.fetch("original_context") == binding.slice(*Molecules::InboxDirectEffectBinding::ORIGINAL_FIELDS) &&
+                record.inbox["original_binding_digest"].is_a?(String) && Molecules::InboxDirectEffectBinding::SHA.match?(record.inbox.fetch("original_binding_digest"))
+              raise ValidationError, "direct delivery retained association differs"
+            end
+            validate_expected_target!(record.inbox.fetch("origin_target"))
+            unless record.inbox.fetch("origin_target").values_at("session", "pane") == [record.session, record.pane] &&
+                record.inbox.fetch("binding").fetch("payload_sha256") == record.answer_digest
+              raise ValidationError, "direct delivery retained target differs"
+            end
+            expected = binding.fetch("selection").fetch("expected_claim_generation")
+            generation = record.inbox.fetch("claim_generation")
+            raise ValidationError, "direct delivery retained generation differs" unless generation >= expected
+            idle = case record.state
+            when "queued"
+              !record.inbox["submission_intent"] && (generation.zero? || record.history.last&.fetch("action", nil) == "pre-submit-rejection")
+            when "delivered"
+              guarded_queue_record!(record, binding, record.inbox.slice("claim_generation", "claim_owner"))
+              receipt = record.inbox["receipt"]
+              receipt.is_a?(Hash) && receipt.slice("event_id", "attempt_id", "claim_generation", "payload_sha256", "binding") ==
+                {"event_id" => record.event_id, "attempt_id" => binding.fetch("attempt_id"), "claim_generation" => generation,
+                  "payload_sha256" => record.answer_digest, "binding" => record.inbox.fetch("binding")} &&
+                %w[none sent pending not_issued].include?(record.inbox.dig("wake", "status"))
+            else
+              false
+            end
+            raise ValidationError, "direct delivery completion is not retained" if require_idle && !idle
+            {"record" => public_record(record), "idle" => !!idle}
+          end
+        rescue KeyError, TypeError, SystemCallError
+          raise ValidationError, "direct delivery retained record is unavailable"
+        end
+
+        # Protected canonical reads only use an already registered event's lock.
+        # Missing retention is unavailable evidence, never query-time repair.
+        def retained_status(event:, deadline: nil)
+          validate_id!(event, "event")
+          with_event(event, create_lock: false, deadline: deadline) do |record|
+            raise MissingEventError, "unknown inbox event: #{event}" unless record&.inbox
+            public_record(record)
+          end
+        rescue SystemCallError, Molecules::DeliveryRecordStore::LockUnavailable
+          raise ValidationError, "retained inbox lock is unavailable"
+        end
+
+        # Called while the fixed context owner holds its admission transaction.
+        # Only the event claim is written here; no native observation or effect.
+        def prepare_direct_delivery(event:, expected_claim_generation:, expected_attempt:, claim_owner:, operation_id:, key_generation:, effect_binding:)
+          validate_id!(event, "event")
+          unless claim_owner.is_a?(String) && claim_owner.match?(/\A[0-9a-f]{64}\z/)
+            raise ValidationError, "direct claim owner differs"
+          end
+          with_event(event) do |record|
+            unless record&.inbox && record.inbox.fetch("attempt_id") == expected_attempt &&
+                expected_claim_generation.is_a?(Integer) && expected_claim_generation >= 0
+              raise ValidationError, "direct claim original association differs"
+            end
+            verified = Molecules::InboxDirectEffectBinding.verify!(effect_binding, key_generation: key_generation)
+            unless verified.fetch("selection") == {"expected_claim_generation" => expected_claim_generation} && verified.fetch("event_id") == event &&
+                verified.fetch("attempt_id") == expected_attempt && verified.slice(*Molecules::InboxDirectEffectBinding::ORIGINAL_FIELDS) == record.inbox.fetch("original_context") &&
+                operation_id.is_a?(String) && operation_id.match?(/\A[0-9a-f]{32}\z/) &&
+                claim_owner == Digest::SHA256.hexdigest(JSON.generate([record.inbox.fetch("original_context").fetch("inbox_context_id"), operation_id]))
+              raise ValidationError, "direct queue issuer association differs"
+            end
+            current = record.inbox.fetch("claim_generation")
+            raise ValidationError, "direct claim expected generation is future" if expected_claim_generation > current
+            if record.state == "delivered" && expected_claim_generation == current && %w[pending not_issued].include?(record.inbox.dig("wake", "status"))
+              claim = record.inbox.slice("claim_generation", "claim_owner").merge("kind" => "wake")
+              guarded_queue_record!(record, effect_binding, claim)
+              unless record.inbox.fetch("queue_issuer").fetch("key_generation") == key_generation
+                raise ValidationError, "guarded wake key generation differs"
+              end
+              wake = record.inbox.fetch("wake").reject { |key, _| key == "code" }.merge("status" => "pending",
+                "operation_id" => operation_id, "input_sha256" => effect_binding.fetch("input_sha256"))
+              save(record.advance_inbox(state: "delivered", inbox: record.inbox.merge("wake" => wake),
+                detail: {"action" => "wake-adopt"}, timestamp: Time.now.utc.iso8601))
+              next claim
+            end
+            next nil if expected_claim_generation < current || %w[delivered completed uncertain].include?(record.state)
+            unless record.state == "queued" && !record.inbox["submission_intent"] &&
+                (current.zero? || record.history.last&.fetch("action", nil) == "pre-submit-rejection")
+              raise ValidationError, "direct claim is not known pre-submission"
+            end
+            claim = record.inbox.reject { |key, _| key == "canonical_completion" }.merge("claim_owner" => claim_owner, "claim_generation" => current + 1,
+              "queue_issuer" => {"operation_id" => operation_id, "key_generation" => key_generation, "input_sha256" => verified.fetch("input_sha256")})
+            save(record.advance_inbox(state: "claimed", inbox: claim,
+              detail: {"action" => "claim", "claim_generation" => current + 1, "claim_owner" => claim_owner}, timestamp: Time.now.utc.iso8601))
+            {"kind" => "queue", "claim_generation" => current + 1, "claim_owner" => claim_owner}
+          end
+        end
+
+        def deliver(event:, expected_claim_generation: nil, expected_attempt: nil, prepared_claim: nil, &guarded_submission)
           validate_id!(event, "event")
           with_event(event) do |record|
             raise ValidationError, "unknown inbox event: #{event}" unless record&.inbox
-            next retry_wake(record) if record.state == "delivered" && wake_pending?(record)
+            if prepared_claim
+              unless prepared_claim.is_a?(Hash) && prepared_claim.keys.sort == %w[claim_generation claim_owner] &&
+                  record.state == "claimed" && !record.inbox["submission_intent"] &&
+                  record.inbox.slice("claim_generation", "claim_owner") == prepared_claim &&
+                  record.inbox.fetch("attempt_id") == expected_attempt &&
+                  expected_claim_generation.is_a?(Integer) && prepared_claim.fetch("claim_generation") == expected_claim_generation + 1
+                raise ValidationError, "prepared direct claim changed"
+              end
+            elsif !expected_claim_generation.nil?
+              unless expected_claim_generation.is_a?(Integer) && expected_claim_generation >= 0 &&
+                  expected_attempt.is_a?(String) && EVENT.match?(expected_attempt) &&
+                  record.inbox.fetch("attempt_id") == expected_attempt
+                raise ValidationError, "protected delivery original association differs"
+              end
+              current = record.inbox.fetch("claim_generation")
+              raise ValidationError, "protected delivery expected generation is future" if expected_claim_generation > current
+              next public_record(record) if expected_claim_generation < current || %w[delivered completed uncertain].include?(record.state)
+              unless record.state == "queued" && !record.inbox["submission_intent"] &&
+                  (current.zero? || record.history.last&.fetch("action", nil) == "pre-submit-rejection")
+                raise ValidationError, "protected delivery is not known pre-submission"
+              end
+            end
+            next retry_wake(record) if record.state == "delivered" && wake_pending?(record) && !record.inbox["original_context"]
             next public_record(record) if %w[delivered completed uncertain].include?(record.state)
-            unless record.state == "queued"
+            unless record.state == "queued" || prepared_claim
               if record.inbox["submission_intent"]
                 # A previous owner crashed after saving submission intent:
                 # the submission boundary is unknown to a new process.
@@ -114,12 +427,14 @@ module Ace
               next public_record(record)
             end
 
-            claim = record.inbox.merge(
+            claim = prepared_claim ? record.inbox : record.inbox.reject { |key, _| key == "canonical_completion" }.merge(
               "claim_owner" => "#{Process.pid}:#{SecureRandom.hex(8)}",
               "claim_generation" => record.inbox.fetch("claim_generation", 0) + 1
             )
-            record = transition(record, "claimed", claim, "claim")
-            save(record)
+            unless prepared_claim
+              record = transition(record, "claimed", claim, "claim")
+              save(record)
+            end
 
             begin
               binding = observe(record)
@@ -141,7 +456,7 @@ module Ace
             record = transition(record, "uncertain", intent, "submit-intent")
             save(record)
 
-            result = submit(record, binding)
+            result = submit(record, binding, guarded_submission)
             if result["pre_submit"]
               # Missing executable is the only proven pre-submission error.
               record = transition(record, "queued", bound.merge("last_error" => result["error"]),
@@ -155,18 +470,26 @@ module Ace
               # but its DECISION rides the first delivered transition: a crash
               # between saves must never leave the wake field missing (which
               # later reads as pending) for a busy target.
-              wake = if WAKE_STATUSES.include?(binding["agent_status"])
+              wake = if binding.fetch("agent") == "codex"
+                {"status" => "none", "reason" => "terminal prompt was submitted"}
+              elsif WAKE_STATUSES.include?(binding["agent_status"])
                 {"status" => "pending"}
               else
                 {"status" => "none", "reason" => "busy target uses the native queue form"}
               end
+              if record.inbox["original_context"]
+                issuer = queue_issuer!(record)
+                wake = {"status" => wake.fetch("status"), "claim_generation" => intent.fetch("claim_generation"),
+                  "binding_digest" => intent.fetch("original_binding_digest"), "operation_id" => issuer.fetch("operation_id"),
+                  "input_sha256" => issuer.fetch("input_sha256")}
+              end
               record = transition(record, "delivered",
                 intent.merge("receipt" => receipt).merge("wake" => wake), "accepted")
               save(record)
               # A pending wake is attempted after the decision is durable, so
               # a crash or transient failure can be recovered by a later
               # deliver call without ever resubmitting the message.
-              record = attempt_wake(record, binding) if wake["status"] == "pending"
+              record = attempt_wake(record, binding) if wake["status"] == "pending" && !record.inbox["original_context"]
             else
               record = transition(record, "uncertain", intent.merge("last_error" => result["error"]),
                 "submission-uncertain", result["error"])
@@ -176,122 +499,21 @@ module Ace
           end
         end
 
-        def reconcile(event:, receipt:, signed_bytes: nil, signature: nil)
-          validate_id!(event, "event")
-          with_event(event) do |record|
-            raise ValidationError, "unknown inbox event: #{event}" unless record&.inbox
-            # `delivered` only proves native queue acceptance: the message may
-            # still be consumed or evicted afterwards, so a signed observation
-            # can reconcile it exactly like an uncertain outcome.
-            unless %w[uncertain delivered].include?(record.state)
-              raise ValidationError, "event is not reconcilable from state #{record.state}"
-            end
-            binding = record.inbox["binding"]
-            matches = receipt.is_a?(Hash) && receipt["event_id"] == event &&
-              receipt["attempt_id"] == record.inbox["attempt_id"] &&
-              receipt["claim_generation"] == record.inbox["claim_generation"] &&
-              receipt["payload_sha256"] == record.answer_digest &&
-              receipt["binding"] == binding
-            refusal = if !binding
-              "event has no verified binding"
-            elsif !matches
-              "reconciliation receipt does not match bound event"
-            end
-            refusal ||= proof_refusal(receipt) if receipt.is_a?(Hash)
-            refusal ||= signature_refusal(record, receipt, signed_bytes, signature)
-            replacement = nil
-            if !refusal && receipt["outcome"] == "superseded" && receipt.key?("replacement_target")
-              replacement = receipt["replacement_target"]
-              observed = begin
-                raise ValidationError, "replacement target must be an object" unless replacement.is_a?(Hash)
-
-                address = address_for(replacement)
-                observe_target(address.session, address.pane)
-              rescue ValidationError, ExecutorError, Ace::Hitl::Providers::InvalidRefError => e
-                refusal = "replacement target cannot be verified: #{e.message}"
-                nil
-              end
-              stable = %w[session pane terminal_id agent thread thread_kind]
-              unless replacement.is_a?(Hash) && observed &&
-                  stable.all? { |key| replacement[key] == observed[key] }
-                refusal ||= "replacement target does not match the live native session"
-              end
-              # The replacement agent's own delivery rules must admit this
-              # event: its immutable-id requirement and payload bound.
-              if observed
-                if observed["agent"] == "pi" && !PI_EVENT_ID.match?(event)
-                  refusal ||= "replacement pi target requires an inbox (inb-) or wake (wnk-) event id"
-                end
-                payload_limit = observed["agent"] == "pi" ?
-                  Molecules::NativeQueueExecutor::PI_PAYLOAD_LIMIT_BYTES :
-                  Molecules::NativeQueueExecutor::MAX_ARG_PAYLOAD_BYTES
-                if record.answer.to_s.bytesize > payload_limit
-                  refusal ||= "payload exceeds the replacement agent's native queue limit"
-                end
-              end
-            end
-            next public_record(record).merge("reconciliation_refusal" => refusal) if refusal
-
-            outcome = receipt["outcome"]
-            state = outcome == "consumed" ? "completed" : "queued"
-            inbox = record.inbox.merge("reconciliation" => receipt)
-            if state == "queued"
-              inbox = inbox.reject do |key, _|
-                %w[submission_intent claim_owner receipt].include?(key)
-              end
-              inbox = inbox.merge("target" => replacement) if replacement
-            end
-            record = transition(record, state, inbox, "reconcile-#{outcome}")
-            save(record)
-            public_record(record)
-          end
-        end
-
         private
 
-        def key_fingerprint
-          Digest::SHA256.hexdigest(@receipt_public_key.public_to_der)
-        end
 
-        def signature_refusal(record, receipt, signed_bytes, signature)
-          return "trusted receipt public key is unavailable" unless @receipt_public_key
-          unless record.inbox["receipt_key_sha256"] == key_fingerprint
-            return "trusted receipt public key differs from the enqueued event"
-          end
-          return "receipt signature is missing" unless signed_bytes.is_a?(String) && signature.is_a?(String)
-          return "signed receipt content differs from parsed receipt" unless JSON.parse(signed_bytes) == receipt
-          return "receipt signature is invalid" unless @receipt_public_key.verify(
-            OpenSSL::Digest::SHA256.new, signature, signed_bytes)
 
-          nil
-        rescue JSON::ParserError, OpenSSL::PKey::PKeyError
-          "receipt signature is invalid"
-        end
 
-        # The receipt is an explicit operator or supervisor attestation of a
-        # native outcome. Native queue submission alone cannot prove consumption
-        # or nonconsumption; an absent or incomplete attestation is never retried.
-        def proof_refusal(receipt)
-          return "invalid reconciliation outcome" unless %w[consumed superseded].include?(receipt["outcome"])
-          observer = receipt["observer"]
-          unless observer.is_a?(Hash) && %w[operator supervisor].include?(observer["role"]) &&
-              observer["id"].is_a?(String) && !observer["id"].strip.empty?
-            return "receipt requires an identified operator or supervisor"
-          end
-          evidence = receipt["evidence"]
-          kinds = receipt["outcome"] == "consumed" ? %w[consumed_acknowledged] :
-            %w[queue_evicted queue_expired thread_replaced]
-          unless evidence.is_a?(Hash) && kinds.include?(evidence["kind"]) &&
-              evidence["native_reference"].is_a?(String) && !evidence["native_reference"].strip.empty? &&
-              evidence["observation"].is_a?(String) && !evidence["observation"].strip.empty?
-            return "receipt requires a native outcome observation and reference"
-          end
-          nil
-        end
 
-        def with_event(event)
-          Molecules::DeliveryRecordStore.with_lock(@deliveries_dir, event) do
-            yield Molecules::DeliveryRecordStore.load(@deliveries_dir, event)
+
+
+        def with_event(event, create_lock: true, deadline: nil)
+          Molecules::DeliveryRecordStore.with_lock(@deliveries_dir, event, create: create_lock, deadline: deadline) do
+            record = Molecules::DeliveryRecordStore.load(@deliveries_dir, event)
+            if record
+              Ace::Hitl::Providers::Ref.new(session: record.session, pane: record.pane, canonical: true)
+            end
+            yield record
           end
         end
 
@@ -313,13 +535,20 @@ module Ace
           hash = ref.is_a?(Hash) ? ref : JSON.parse(File.read(ref))
           raise ValidationError, "invalid ref: expected a JSON object" unless hash.is_a?(Hash)
           Ace::Hitl::Providers::Ref.new(
-            session: Ace::Hitl::Providers::Ref.validate!(hash.fetch("session"), "session"),
-            pane: Ace::Hitl::Providers::Ref.validate!(hash.fetch("pane"), "pane")
+            session: hash.fetch("session"), pane: hash.fetch("pane"), canonical: !ref.is_a?(Hash)
           )
         rescue Errno::ENOENT, JSON::ParserError, KeyError, TypeError => e
           raise ValidationError, "invalid ref: #{e.message}"
         end
 
+        def validate_expected_target!(target)
+          unless target.is_a?(Hash) && TARGET_IDENTITY.all? { |key| target[key].is_a?(String) && !target[key].empty? } &&
+              %w[codex pi].include?(target["agent"]) && target["thread_kind"] == "id" &&
+              THREAD_ID.match?(target["thread"]) && target["terminal_id"].bytesize <= 64
+            raise ValidationError, "accepted original native target is incomplete or invalid"
+          end
+        end
+
         def validate_match!(record, attempt, address, digest)
           unless record.inbox && record.inbox["attempt_id"] == attempt &&
               record.session == address.session && record.pane == address.pane &&
@@ -335,9 +564,9 @@ module Ace
           # Target drift is classified BEFORE agent-specific event id rules:
           # a bound event whose pane changed agent (e.g. codex -> pi) must
           # reconcile, not loop on a pre-send validation error.
-          stable = %w[session pane terminal_id agent thread thread_kind]
+          stable = TARGET_IDENTITY
           if target && !stable.all? { |key| target[key] == binding[key] }
-            raise IdentityDriftError, "target identity changed since enqueue; reconciliation is required"
+            raise IdentityDriftError, "target identity changed since enqueue; delivery remains uncertain"
           end
           if binding["agent"] == "pi" && !PI_EVENT_ID.match?(record.event_id)
             raise ValidationError, "Pi queue requires an inbox or wake event ID"
@@ -360,7 +589,7 @@ module Ace
           # An agent change is target drift: classify it as reconciliation-
           # worthy before any agent-specific validation can mask it.
           if target && target["agent"] != agent
-            raise IdentityDriftError, "target identity changed since enqueue; reconciliation is required"
+            raise IdentityDriftError, "target identity changed since enqueue; delivery remains uncertain"
           end
           raise ValidationError, "unsupported native agent" unless %w[codex pi].include?(agent)
           session = pane["agent_session"]
@@ -399,9 +628,23 @@ module Ace
            "agent_status" => status}
         end
 
-        def submit(record, binding)
-          @native.submit(agent: binding["agent"], thread: binding["thread"],
+        def submit(record, binding, guarded_submission)
+          if binding.fetch("agent") == "codex"
+            if record.inbox["original_context"]
+              raise ValidationError, "original terminal submission owner is unavailable" unless guarded_submission
+              result = guarded_submission.call(record.answer)
+              return {"accepted" => true} if result["outcome"] == "submitted"
+              return {"accepted" => false, "pre_submit" => true, "error" => result.fetch("code")} if result["outcome"] == "not_issued"
+              return {"accepted" => false, "error" => "original terminal submission outcome unknown"}
+            end
+            result = @executor.agent_prompt_bounded(pane: binding.fetch("pane"), text: record.answer,
+              timeout_ms: 10_000)
+            return {"accepted" => true, "stdout" => result.stdout}
+          end
+          @native.submit(agent: binding.fetch("agent"), thread: binding.fetch("thread"),
             event_id: record.event_id, digest: record.answer_digest, payload: record.answer)
+        rescue ExecutorUnavailableError => e
+          {"accepted" => false, "pre_submit" => true, "error" => e.message}
         rescue ExecutorError => e
           {"accepted" => false, "error" => e.message}
         end
@@ -438,6 +681,7 @@ module Ace
         end
 
         def wake_pending?(record)
+          return false if record.inbox.dig("binding", "agent") == "codex"
           wake = record.inbox["wake"]
           wake.nil? || wake["status"] == "pending"
         end
@@ -457,6 +701,7 @@ module Ace
         end
 
         def wake_idle(binding)
+          raise ValidationError, "Codex native queue has no terminal wake operation" unless binding.fetch("agent") == "pi"
           @executor.agent_prompt_bounded(pane: binding["pane"],
             text: "Check your native queued messages.", timeout_ms: 10_000)
           nil
@@ -468,13 +713,15 @@ module Ace
           {"event_id" => record.event_id, "attempt_id" => record.inbox["attempt_id"],
            "session" => record.session, "pane" => record.pane,
            "payload_sha256" => record.answer_digest, "state" => record.state,
-           "receipt_key_sha256" => record.inbox["receipt_key_sha256"],
+           "managed_envelope" => record.inbox["managed_envelope"],
+           "original_context" => record.inbox["original_context"],
+           "original_binding_digest" => record.inbox["original_binding_digest"],
            "claim_generation" => record.inbox["claim_generation"],
            "claim_owner" => record.inbox["claim_owner"],
            "submission_intent" => !!record.inbox["submission_intent"],
+           "origin_target" => record.inbox["origin_target"],
            "target" => record.inbox["target"],
            "binding" => record.inbox["binding"], "receipt" => record.inbox["receipt"],
-           "reconciliation" => record.inbox["reconciliation"],
            "wake" => record.inbox["wake"],
            "last_error" => record.inbox["last_error"]}
         end