ace-herdr 0.4.0 → 0.5.0

data/lib/ace/herdr/molecules/native_source.rb

@@ -0,0 +1,189 @@
+# frozen_string_literal: true
+
+require "json"
+require "digest"
+require "time"
+
+module Ace
+  module Herdr
+    module Molecules
+      # The accepted native producer source shipped by this exact package.
+      # Provenance verifies bytes; deployment authorization stays with its owner.
+      class NativeSource
+        class Error < StandardError; end
+        class ClosedObject < Hash
+          def []=(key, value)
+            raise FrozenError, "frozen native source object" if frozen?
+            raise Error, "duplicate native provenance field" if key?(key)
+            super
+          end
+        end
+
+        ASSETS = File.expand_path("../native_source", __dir__).freeze
+        SOURCE_KEYS = %w[schema repository baseline_commit source_commit source_tree patch_file patch_sha256
+          cargo_lock_sha256 rust_toolchain_sha256 rust_version zig_version native_version protocol committer targets].freeze
+        BUILD_KEYS = %w[target profile rust_version zig_version tools_sha256].freeze
+        RECEIPT_KEYS = %w[schema selection_sha256 source build artifact].freeze
+        TARGETS = %w[x86_64-unknown-linux-musl aarch64-unknown-linux-musl].freeze
+        SHA256 = /\A[0-9a-f]{64}\z/
+        GIT_SHA = /\A[0-9a-f]{40}\z/
+        VERSION = /\A\d+\.\d+\.\d+\z/
+        MAX_ARTIFACT_BYTES = 256 * 1024 * 1024
+
+        attr_reader :selection, :selection_sha256, :selection_path, :patch_path
+
+        def initialize(assets: ASSETS)
+          @selection_path = File.join(File.expand_path(assets), "selection.json")
+          bytes = read_regular(@selection_path, 65_536)
+          @selection = parse(bytes)
+          validate_selection!
+          @patch_path = File.join(File.dirname(@selection_path), @selection.fetch("patch_file"))
+          patch = read_regular(@patch_path, 1_048_576)
+          raise Error, "native source patch digest mismatch" unless digest(patch) == @selection.fetch("patch_sha256")
+          @selection_sha256 = digest(bytes).freeze
+          freeze_data(@selection)
+        end
+
+        def description
+          {"selection_path" => @selection_path, "selection_sha256" => @selection_sha256, "source" => @selection}
+        end
+
+        def verify_artifact(directory:)
+          directory = File.expand_path(directory)
+          info = File.lstat(directory)
+          raise Error, "native artifact directory must be regular" unless info.directory? && !info.symlink?
+          raise Error, "unexpected native artifact files" unless Dir.children(directory).sort == %w[herdr provenance.json]
+          receipt_bytes = read_regular(File.join(directory, "provenance.json"), 65_536)
+          receipt = parse(receipt_bytes)
+          validate_receipt!(receipt)
+          artifact = read_regular(File.join(directory, "herdr"), MAX_ARTIFACT_BYTES)
+          validate_elf!(artifact, receipt.fetch("build").fetch("target"))
+          expected = receipt.fetch("artifact")
+          unless artifact.bytesize == expected.fetch("size") && digest(artifact) == expected.fetch("sha256")
+            raise Error, "native artifact bytes do not match provenance"
+          end
+          freeze_data(receipt)
+          {"provenance_sha256" => digest(receipt_bytes), "selection_sha256" => @selection_sha256,
+           "source" => @selection, "build" => receipt.fetch("build"), "artifact" => expected}
+        rescue JSON::ParserError, SystemCallError, IOError => error
+          raise Error, "native artifact unavailable: #{error.class}"
+        end
+
+        def artifact_record(bytes:, target:)
+          validate_elf!(bytes, target)
+          {"file" => "herdr", "size" => bytes.bytesize, "sha256" => digest(bytes)}
+        end
+
+        def receipt(build:, artifact:)
+          data = {"schema" => "ace.herdr.native-build/v1", "selection_sha256" => @selection_sha256,
+                  "source" => @selection, "build" => build, "artifact" => artifact}
+          validate_receipt!(data)
+          data
+        end
+
+        def read_regular(path, limit)
+          before = File.lstat(path)
+          raise Error, "native source input must be a regular file" unless before.file? && !before.symlink?
+          File.open(path, File::RDONLY | File::NOFOLLOW) do |input|
+            opened = input.stat
+            unless opened.file? && [opened.dev, opened.ino] == [before.dev, before.ino]
+              raise Error, "native source input changed while opening"
+            end
+            bytes = input.read(limit + 1)
+            raise Error, "native source input exceeds bound" if bytes.bytesize > limit
+            after = input.stat
+            unless [opened.size, opened.mtime, opened.ctime] == [after.size, after.mtime, after.ctime]
+              raise Error, "native source input changed while reading"
+            end
+            bytes
+          end
+        rescue SystemCallError, IOError => error
+          raise Error, "native source input unavailable: #{error.class}"
+        end
+
+        def digest(bytes)
+          Digest::SHA256.hexdigest(bytes)
+        end
+
+        private
+
+        def parse(bytes)
+          text = bytes.dup.force_encoding(Encoding::UTF_8)
+          raise Error, "invalid native source UTF-8" unless text.valid_encoding?
+          JSON.parse(text, object_class: ClosedObject, create_additions: false,
+            max_nesting: 16, allow_comments: false, allow_duplicate_key: false)
+        rescue JSON::ParserError, EncodingError
+          raise Error, "invalid native source JSON"
+        end
+
+        def fields!(data, expected)
+          unless data.is_a?(Hash) && data.keys.sort == expected.sort
+            raise Error, "invalid native source fields"
+          end
+        end
+
+        def string!(value, pattern)
+          raise Error, "invalid native source value" unless value.is_a?(String) && pattern.match?(value)
+        end
+
+        def validate_selection!(selection = @selection)
+          fields!(selection, SOURCE_KEYS)
+          raise Error, "unsupported native source schema" unless selection["schema"] == "ace.herdr.native-source/v1"
+          unless selection["repository"] == "https://github.com/herdrdev/herdr.git" && selection["patch_file"] == "guarded-prompt.patch"
+            raise Error, "unsupported native source selection"
+          end
+          %w[baseline_commit source_commit source_tree].each { |key| string!(selection[key], GIT_SHA) }
+          %w[patch_sha256 cargo_lock_sha256 rust_toolchain_sha256].each { |key| string!(selection[key], SHA256) }
+          %w[rust_version zig_version native_version].each { |key| string!(selection[key], VERSION) }
+          unless selection["protocol"].is_a?(Integer) && selection["protocol"].positive? && selection["targets"] == TARGETS
+            raise Error, "unsupported native target/protocol"
+          end
+          committer = selection["committer"]
+          fields!(committer, %w[name email date])
+          %w[name email].each { |key| string!(committer[key], /\A[^\x00-\x1f\x7f]{1,255}\z/) }
+          string!(committer["date"], /\A\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d[+-]\d\d:\d\d\z/)
+          Time.iso8601(committer["date"])
+        rescue ArgumentError
+          raise Error, "invalid native source committer date"
+        end
+
+        def validate_elf!(bytes, target)
+          raise Error, "unsupported native artifact target" unless TARGETS.include?(target)
+          machine = target.start_with?("x86_64-") ? 62 : 183
+          unless bytes.bytesize >= 64 && bytes.byteslice(0, 7) == "\x7fELF\x02\x01\x01".b &&
+              [2, 3].include?(bytes.byteslice(16, 2).unpack1("v")) && bytes.byteslice(18, 2).unpack1("v") == machine
+            raise Error, "native artifact is not the selected Linux executable architecture"
+          end
+        end
+
+        def validate_receipt!(data)
+          fields!(data, RECEIPT_KEYS)
+          validate_selection!(data["source"])
+          unless data["schema"] == "ace.herdr.native-build/v1" && data["selection_sha256"] == @selection_sha256 && data["source"] == @selection
+            raise Error, "native build source selection mismatch"
+          end
+          build = data["build"]
+          fields!(build, BUILD_KEYS)
+          unless @selection["targets"].include?(build["target"]) && build["profile"] == "release" &&
+              build["rust_version"] == @selection["rust_version"] && build["zig_version"] == @selection["zig_version"]
+            raise Error, "native build toolchain/target mismatch"
+          end
+          fields!(build["tools_sha256"], %w[cargo rustc zig linker])
+          build["tools_sha256"].each_value { |value| string!(value, SHA256) }
+          artifact = data["artifact"]
+          fields!(artifact, %w[file size sha256])
+          unless artifact["file"] == "herdr" && artifact["size"].is_a?(Integer) && artifact["size"].positive? && artifact["size"] <= MAX_ARTIFACT_BYTES
+            raise Error, "invalid native build artifact"
+          end
+          string!(artifact["sha256"], SHA256)
+        end
+
+        def freeze_data(value)
+          value.each { |key, item| freeze_data(key); freeze_data(item) } if value.is_a?(Hash)
+          value.each { |item| freeze_data(item) } if value.is_a?(Array)
+          value.freeze
+        end
+      end
+    end
+  end
+end

data/lib/ace/herdr/molecules/protected_inbox_selection.rb

@@ -0,0 +1,126 @@
+# frozen_string_literal: true
+require "tmpdir"
+require "ace/runtime/molecules/protected_task_context_entry"
+require_relative "bounded_process"
+require_relative "inbox_context_store"
+
+module Ace
+  module Herdr
+    module Molecules
+      # Existing immutable entry owns discovery; the endpoint still authorizes effects.
+      class ProtectedInboxSelection
+        TOKEN = /\A[A-Za-z0-9][A-Za-z0-9._-]{0,127}\z/
+        def initialize(entry_owner: Ace::Runtime::Molecules::ProtectedTaskContextEntry.new,
+          runner: BoundedProcess, uid: Process.uid, env: ENV)
+          @owner, @runner, @uid, @env = entry_owner, runner, uid, env
+        end
+
+        def with(options)
+          downstream_started = false
+          selected = options.values_at(:project, :mapping, :inbox_context, :claim_generation, :assignment).any? { |item| !item.nil? } ||
+            %w[ACE_ASSIGN_PROJECT_ID ACE_ASSIGN_LAUNCH_MAPPING ACE_ASSIGN_INBOX_CONTEXT_ID].any? { |key| !@env[key].to_s.empty? }
+          @owner.with do |pin|
+            unless pin
+              raise ValidationError, "protected inbox entry is absent" if selected
+              downstream_started = true
+              next yield nil
+            end
+            principal = invoke(pin, ["authority", "inbox-context-principal"], 1024)
+            object!(principal, %w[schema uid protected_participant])
+            unless principal["schema"] == "ace.assign.inbox-context-principal/v1" && principal["uid"] == @uid &&
+                principal["uid"].is_a?(Integer) && [true, false].include?(principal["protected_participant"])
+              raise ValidationError, "protected inbox actual caller differs"
+            end
+            unless principal.fetch("protected_participant") || selected
+              downstream_started = true
+              next yield nil
+            end
+            keys = {project: "ACE_ASSIGN_PROJECT_ID", mapping: "ACE_ASSIGN_LAUNCH_MAPPING", inbox_context: "ACE_ASSIGN_INBOX_CONTEXT_ID"}
+            selectors = keys.to_h do |key, hint_key|
+              value, hint = options[key], @env[hint_key].to_s
+              unless value.is_a?(String) && TOKEN.match?(value) && (hint.empty? || hint == value)
+                raise ValidationError, "explicit protected inbox selectors differ"
+              end
+              [key, value]
+            end
+            args = selectors.flat_map { |key, value| ["--#{key.to_s.tr('_', '-')}", value] }
+            result = invoke(pin, ["authority", "inbox-context-selection", *args], 16_384)
+            object!(result, %w[schema uid project_id mapping_id inbox_context_id descriptor history context authority])
+            unless result["schema"] == "ace.assign.inbox-context-selection/v1" && result["uid"] == @uid &&
+                result.values_at("project_id", "mapping_id", "inbox_context_id") == selectors.values
+              raise ValidationError, "protected inbox selected association differs"
+            end
+            %w[descriptor history].each do |field|
+              reference = result.fetch(field)
+              object!(reference, %w[path bytes sha256])
+              @owner.validate_pin!({"manifest" => reference, "wrapper" => reference})
+            end
+            context = result.fetch("context")
+            object!(context, %w[control_socket_path owner_credentials native_mapping_id])
+            endpoint!(context.fetch("control_socket_path")); credentials!(context.fetch("owner_credentials"))
+            raise ValidationError, "protected inbox native mapping differs" unless context["native_mapping_id"].is_a?(String) && TOKEN.match?(context["native_mapping_id"])
+            authority = result.fetch("authority")
+            object!(authority, %w[authority_id socket_path uid gid groups])
+            endpoint!(authority.fetch("socket_path")); credentials!(authority.slice("uid", "gid", "groups"))
+            raise ValidationError, "protected inbox authority ID differs" unless authority["authority_id"].is_a?(String) && TOKEN.match?(authority["authority_id"])
+            downstream_started = true
+            yield result
+          end
+        rescue Ace::Runtime::Error, IOError, SystemCallError, Timeout::Error, BoundedProcess::PostLaunchError, KeyError, TypeError, ArgumentError
+          raise if downstream_started
+          raise ValidationError, "protected inbox selection is unavailable"
+        end
+
+        private
+
+        def invoke(pin, args, limit)
+          @owner.with_entry(pin) do |entry|
+            Dir.mktmpdir("ace-inbox-selector-", "/tmp") do |directory|
+              path = File.join(directory, "selector.json")
+              File.open(path, File::WRONLY | File::CREAT | File::EXCL, 0o600) do |writer|
+                writer.write(JSON.generate(entry.pin.fetch("manifest")) + "\n"); writer.flush
+                File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |reader|
+                  unless reader.stat.file? && reader.stat.uid == Process.uid && (reader.stat.mode & 0o077).zero? &&
+                      [reader.stat.dev, reader.stat.ino, reader.stat.size] == [writer.stat.dev, writer.stat.ino, writer.stat.size]
+                    raise ValidationError, "protected inbox selector handle differs"
+                  end
+                  File.unlink(path)
+                  output = @runner.call(["/proc/self/fd/4", "-I", "-S", "-B", "-", *args], stdin_data: entry.body,
+                    timeout_s: 30, output_limit: limit, stderr_limit: 16_384,
+                    descriptor_mapping: {4 => entry.interpreter, 5 => reader}, environment: {}, chdir: "/", cleanup_group: true)
+                  unless output.status&.success? && !output.oversized && output.stdout.is_a?(String) &&
+                      output.stdout.end_with?("\n") && output.stdout.count("\n") == 1
+                    raise ValidationError, "protected inbox entry failed or framing differs"
+                  end
+                  record = InboxContextStore.decode(output.stdout, limit: limit)
+                  raise ValidationError, "protected inbox entry is not compact JSON" unless JSON.generate(record) + "\n" == output.stdout
+                  record
+                end
+              end
+            end
+          end
+        end
+
+        def object!(value, fields)
+          raise ValidationError, "protected inbox fields differ" unless value.is_a?(Hash) && value.keys.sort == fields.sort
+        end
+
+        def endpoint!(value)
+          unless value.is_a?(String) && value.encoding == Encoding::UTF_8 && value.valid_encoding? &&
+              value.bytesize.between?(2, 4096) && value.start_with?("/") && !value.include?("\0") && File.expand_path(value) == value
+            raise ValidationError, "protected inbox endpoint differs"
+          end
+        end
+
+        def credentials!(value)
+          object!(value, %w[uid gid groups])
+          unless value.values_at("uid", "gid").all? { |number| number.is_a?(Integer) && number.positive? } &&
+              value["groups"].is_a?(Array) && value["groups"].size <= 64 &&
+              value["groups"].all? { |number| number.is_a?(Integer) && number.positive? } && value["groups"] == value["groups"].sort.uniq
+            raise ValidationError, "protected inbox principal differs"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/herdr/molecules/protected_native_control.rb

@@ -2,6 +2,7 @@
 require "ace/runtime/molecules/protected_linux"
 require "ace/runtime/molecules/protected_socket"
 require "securerandom"
+require_relative "guarded_native_origin"
 
 module Ace
   module Herdr
@@ -26,6 +27,129 @@ module Ace
         end
 
         def request(method, params = {})
+          result = exchange(method, params)
+          unless result["result"].is_a?(Hash) && !result.key?("error")
+            raise Ace::Runtime::RuntimeUnavailableError, "native control response is invalid"
+          end
+          result.fetch("result")
+        end
+
+        # Admission calls this before committing the durable prompt intent.
+        # Neither this method nor replay is permission to issue native input.
+        def prompt_preflight!(binding)
+          raise Ace::Runtime::RuntimeUnavailableError, "canonical original binding is unavailable" unless binding.is_a?(Hash)
+          original = binding.reject { |key, _| key == "guarded_origin" }
+          fresh = guarded_binding!(original)
+          unless fresh.fetch("guarded_origin") == guarded_origin!(binding)
+            raise Ace::Runtime::RuntimeUnavailableError, "canonical original guarded actor changed"
+          end
+          fresh.fetch("guarded_origin")
+        end
+
+        # Explicit N2 capture keeps existing original scope binding bytes
+        # unchanged. The launch owner persists this separately in its canonical
+        # record data before issuing any steering permission.
+        def guarded_binding!(binding)
+          raise Ace::Runtime::RuntimeUnavailableError, "canonical original binding is unavailable" unless binding.is_a?(Hash)
+          original = binding.reject { |key, _| key == "guarded_origin" }
+          observed = observe(original.fetch("native_origin").merge("process_binding" => original))
+          info = request("pane.process_info", {"pane_id" => original.fetch("pane")}).fetch("process_info")
+          unless info["pane_id"] == original.fetch("pane") && info["shell_pid"] == observed.dig("process_identity", "pid") &&
+              info["guarded_prompt"] == true && info["guarded_input_drain"] == true
+            raise Ace::Runtime::RuntimeUnavailableError, "native original guarded capability is unavailable"
+          end
+          observed.merge("guarded_origin" => GuardedNativeOrigin.verify!(info.fetch("guarded_prompt_origin"),
+            terminal_id: observed.fetch("terminal_id"), child: observed.fetch("process_identity")))
+        rescue KeyError, TypeError
+          raise Ace::Runtime::RuntimeUnavailableError, "canonical original guarded actor is unavailable"
+        end
+
+        # Only an already accepted canonical issue permit invokes this method.
+        # Unknown/lost transport results remain uncertain even if a local error
+        # occurred before some observed write; native phase is the only refusal
+        # evidence. Never return native agent/message fields or prompt bytes.
+        def prompt(binding:, text:)
+          submit_prompt(guarded_origin!(binding), prompt_body!(text, 16_384))
+        end
+
+        # The admitted Inbox keeps its existing bounded payload contract while
+        # sharing the original actor guard and native submission transport.
+        def inbox_prompt(binding:, text:)
+          submit_prompt(guarded_origin!(binding), prompt_body!(text, 65_536))
+        end
+
+        def prompt_body!(text, limit)
+          body = text.dup.force_encoding(Encoding::UTF_8) if text.is_a?(String)
+          unless body && body.valid_encoding? && body.bytesize.between?(1, limit) && !body.match?(/\A[[:space:]]*\z/)
+            raise ArgumentError, "prompt text must be bounded nonblank UTF-8"
+          end
+          body
+        end
+        private :prompt_body!
+
+        # Called only by the admitted Inbox owner after durable queue/wake
+        # intent; this domain notification accepts no caller text or target.
+        def queue_wake(binding:)
+          submit_prompt(guarded_origin!(binding), "Check your native queued messages.")
+        end
+
+        def submit_prompt(origin, body)
+          frame = exchange("agent.prompt", {"target" => origin.fetch("terminal_id"), "text" => body, "expected_origin" => origin},
+            write_limit: 131_072, read_limit: 16_384)
+          result = frame["result"]
+          if frame.keys.sort == %w[id result] && result.is_a?(Hash) && result.keys.sort == %w[agent origin submission type] &&
+              result["type"] == "agent_prompted" && result["submission"] == "submitted" && result["origin"] == origin && result["agent"].is_a?(Hash)
+            GuardedNativeOrigin.verify!(result.fetch("origin"), terminal_id: origin.fetch("terminal_id"), child: origin.fetch("child"))
+            return {"outcome" => "submitted", "submission" => "submitted", "origin" => origin}
+          end
+          error = frame["error"]
+          codes = %w[guard_mismatch origin_unavailable origin_exited agent_blocked agent_not_ready target_missing submission_busy]
+          if frame.keys.sort == %w[error id] && error.is_a?(Hash) && error.keys.sort == %w[code message phase] &&
+              error["phase"] == "not_issued" && codes.include?(error["code"]) && error["message"].is_a?(String)
+            return {"outcome" => "not_issued", "phase" => "not_issued", "code" => error.fetch("code"), "origin" => origin}
+          end
+          {"outcome" => "uncertain", "origin" => origin}
+        rescue Ace::Runtime::RuntimeUnavailableError, IOError, SystemCallError
+          {"outcome" => "uncertain", "origin" => origin}
+        end
+
+        # Input drain authenticates the captured actor even after its original
+        # child exited. Reobserving a live child here would destroy that proof.
+        # Actor/server replacement or missing completion remains unconfirmed.
+        def inhibit_input(binding:)
+          origin = guarded_origin!(binding)
+          drain_input(origin)
+        end
+
+        def drain_input(origin)
+          frame = exchange("terminal.inhibit_input", {"target" => origin.fetch("terminal_id"), "expected_origin" => origin},
+            write_limit: 16_384, read_limit: 16_384)
+          result = frame["result"]
+          if frame.keys.sort == %w[id result] && result.is_a?(Hash) && result.keys.sort == %w[input_state origin pending_input type] &&
+              result["type"] == "terminal_input_drained" && result["origin"] == origin && result["input_state"] == "inhibited" &&
+              result["pending_input"].is_a?(Integer) && result["pending_input"].zero?
+            GuardedNativeOrigin.verify!(result.fetch("origin"), terminal_id: origin.fetch("terminal_id"), child: origin.fetch("child"))
+            return {"outcome" => "inhibited", "origin" => origin, "input_state" => "inhibited", "pending_input" => 0}
+          end
+          error = frame["error"]
+          if frame.keys.sort == %w[error id] && error.is_a?(Hash) && error.keys.sort == %w[code phase] &&
+              error["phase"] == "unconfirmed" && %w[invalid_params guard_mismatch origin_unavailable input_drain_unavailable].include?(error["code"])
+            return {"outcome" => "unconfirmed", "origin" => origin, "code" => error.fetch("code"), "phase" => "unconfirmed"}
+          end
+          {"outcome" => "unconfirmed", "origin" => origin}
+        rescue Ace::Runtime::RuntimeUnavailableError, IOError, SystemCallError
+          {"outcome" => "unconfirmed", "origin" => origin}
+        end
+
+        def guarded_origin!(binding)
+          raise Ace::Runtime::RuntimeUnavailableError, "canonical original guarded binding is unavailable" unless binding.is_a?(Hash)
+          GuardedNativeOrigin.verify!(binding.fetch("guarded_origin"), terminal_id: binding.fetch("terminal_id"),
+            child: binding.fetch("process_identity"))
+        rescue KeyError, TypeError
+          raise Ace::Runtime::RuntimeUnavailableError, "canonical original guarded binding is unavailable"
+        end
+
+        def exchange(method, params = {}, write_limit: wire::LIMIT, read_limit: wire::LIMIT)
           verify!
           native = @mapping.fetch("native")
           wire.connect(native.fetch("socket_path")) do |socket|
@@ -35,13 +159,13 @@ module Ace
             end
             id = SecureRandom.hex(12)
             deadline = wire.deadline
-            wire.write(socket, {"id" => id, "method" => method, "params" => params}, deadline: deadline)
-            result = wire.read(socket, deadline: deadline)
-            unless result.is_a?(Hash) && result["id"] == id && result["result"].is_a?(Hash) && !result.key?("error")
+            wire.write(socket, {"id" => id, "method" => method, "params" => params}, deadline: deadline, limit: write_limit)
+            result = wire.read(socket, deadline: deadline, limit: read_limit)
+            unless result.is_a?(Hash) && result["id"] == id
               raise Ace::Runtime::RuntimeUnavailableError, "native control response is invalid"
             end
             verify!
-            result.fetch("result")
+            result
           end
         rescue SystemCallError, IOError
           raise Ace::Runtime::RuntimeUnavailableError, "native control outcome is unavailable"
@@ -125,6 +249,7 @@ module Ace
         end
 
         private
+        private :exchange, :submit_prompt, :drain_input
         def wire
           Ace::Runtime::Molecules::ProtectedSocket
         end