ace-hitl 0.13.0 → 0.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2e0e3e52b0322d7e5b585bf30728ebaae32337e06b4a8be12e96dcba1c0d498b
-  data.tar.gz: 4b79e7e2d5efd486c794be95cf515d147b17f322227d3cd6d6583382f3e6fb7e
+  metadata.gz: d921414979ccc0569dbfc0c8e102b3aa29c929f5e9ccde725968dc2a7227da9a
+  data.tar.gz: fb5c118b0f25a93507602223c5fb7f0751149883c4ead52ab96018d2651e4664
 SHA512:
-  metadata.gz: a7abb0c60530c467efbb7a2b99d514e23a716bd61fce8d67c65966d629bb70969785043d63dd36e60eabd1d708d7d850b58eca6b31e5135c071e2791147c3bd7
-  data.tar.gz: 339b0dee9be68ff3ef82b4de954e6642a58b4ccdf8cad109524b66991423f39f543a59f75e8e957c1be23e263975a3448009a3558aa3e622415059d14ad036bd
+  metadata.gz: 67d4f65668300b1c111937e9f0dd11aa4ab11684db06c0cbe65cc2f73d227601985b32734bcd21849e82740a7bf44133fbdeb4bd860c45836e2f8cd541874d25
+  data.tar.gz: a7ee80f146804aedf4f7f14d901c6678cee3e8de3d909feb79ef189b5c36a97980a3ce0892760943533907bbce766847848492f3c8e9f8578064ba859261f699

data/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.14.0] - 2026-10-11
+
+### Added
+
+- Add `ace-hitl serve --group` so each repository authority can expose its lifecycle socket through a dedicated control group.
+
+### Changed
+
+- Direct unsafe socket-directory failures to dedicated service-owned directories that do not contain unrelated service sockets.
+- Apply the configured authority group to root-owned public lifecycle projections as well as the service socket.
+
+### Fixed
+
+- Refuse startup if the configured socket group cannot be resolved or assigned, and retag existing public projections to the configured group before serving.
+
+## [0.13.1] - 2026-10-10
+
+### Fixed
+
+- Require the published producer and consumer patch versions containing the protected context and managed-attempt APIs; exclude incompatible prior dependency graphs.
+
 ## [0.13.0] - 2026-10-08
 
 ### Added

data/docs/usage.md

@@ -170,10 +170,16 @@ document — the same file and traversal trust rules as ace-lab
 
 ```bash
 # Deployment (root runs the service under its own account):
-ace-hitl serve                      # ACE_HITL_SOCKET, ACE_HITL_STORE_ROOT,
-                                    # ACE_HITL_GRANTS_PATH override paths
+ace-hitl serve --socket /run/ace-hitl-project/lifecycle.sock \
+  --store-root /var/lib/ace-hitl-project --group ace-hitl-project
+# ACE_HITL_SOCKET, ACE_HITL_STORE_ROOT and ACE_HITL_GRANTS_PATH may supply paths.
 ```
 
+Give each authority a dedicated service/root-owned, non-world-writable socket
+directory and a dedicated control group. Do not place its socket in `/run/lab`
+or another directory containing unrelated service sockets: granting the
+transport access to that directory's shared group can expose those endpoints.
+
 Store layout (all service-owned): `0711` traverse-only root;
 `requests/ answers/ secrets/ effects/ locks/ terminals/` are `0700`;
 `public/` is `0755` with `0440` non-secret projections. There is no

data/lib/ace/hitl/cli/commands/serve.rb

@@ -19,6 +19,7 @@ module Ace
           desc "Run the authenticated HITL store boundary service (peer-credential access)"
 
           option :socket, type: :string, desc: "Boundary socket path (default: ACE_HITL_SOCKET or /run/lab/hitl.sock)"
+          option :group, type: :string, desc: "Dedicated control group allowed to connect (default: lab-control)"
           option :store_root, type: :string, desc: "Private store root (default: ACE_HITL_STORE_ROOT or /run/lab/hitl)"
           option :grants_path, type: :string, desc: "Trusted grants document (default: ACE_HITL_GRANTS_PATH or /etc/lab/ace-lab/authorization.yml)"
           option :repo_root, type: :string, desc: "Candidate repository for the managed attempt authority"
@@ -41,6 +42,7 @@ module Ace
               binding: binding_policy,
               policy: policy,
               socket_path: socket_path(options),
+              group: options[:group] || Lifecycle::Store::DEFAULT_GROUP,
               logger: options[:verbose] ? ->(message) { warn message } : nil
             )
             service.run

data/lib/ace/hitl/lifecycle/service.rb

@@ -139,22 +139,19 @@ module Ace
 
         def prepare!
           begin
+            group_id = Etc.getgrnam(@group).gid
             verify_socket_directory!
             acquire_endpoint_lock!
             recover_stale_endpoint!
             @server = UNIXServer.open(@socket_path)
             @endpoint_identity = endpoint_identity
+            File.chown(nil, group_id, @socket_path)
+            File.chmod(DEFAULT_SOCKET_MODE, @socket_path)
+          rescue ArgumentError => e
+            raise TransportError, "the HITL boundary control group is unavailable (#{e.message})"
           rescue SystemCallError, IOError => e
             raise TransportError, "the HITL boundary endpoint is not usable (#{e.class}: #{e.message})"
           end
-          File.chmod(DEFAULT_SOCKET_MODE, @socket_path)
-          begin
-            File.chown(nil, Etc.getgrnam(@group).gid, @socket_path)
-          rescue ArgumentError, SystemCallError
-            # A service that cannot set the control group keeps the
-            # owner-only socket; the peer-credential gate still applies.
-            nil
-          end
           begin
             root_store.ensure_layout!
           rescue SystemCallError => e
@@ -204,7 +201,8 @@ module Ace
 
           raise TransportError,
             "HITL boundary socket directory is not protected: #{dir} " \
-            "(must be service/root-owned and not world-writable)"
+            "(use a dedicated service/root-owned, non-world-writable directory; " \
+            "do not share a directory containing unrelated service sockets)"
         end
 
         def authenticate!(socket)
@@ -236,7 +234,7 @@ module Ace
             policy: @policy,
             identity: peer,
             vault: @vault,
-            proposal_clock: @proposal_clock, stopping: -> { @stopping }
+            proposal_clock: @proposal_clock, stopping: -> { @stopping }, group: @group
           )
         end
 
@@ -371,7 +369,7 @@ module Ace
         end
 
         def root_store
-          Store.new(root: @root, binding: @binding, policy: @policy)
+          Store.new(root: @root, binding: @binding, policy: @policy, group: @group)
         end
 
         def log(message)

data/lib/ace/hitl/lifecycle/store.rb

@@ -79,7 +79,8 @@ module Ace
 
         def initialize(root:, binding:, policy: AccessPolicy.new,
           identity: Identity, ownership: AtomicJson::DEFAULT_OWNERSHIP,
-          poll_seconds: CONSUME_POLL_SECONDS, vault: :file, proposal_clock: -> { Time.now.utc }, stopping: -> { false })
+          poll_seconds: CONSUME_POLL_SECONDS, vault: :file, proposal_clock: -> { Time.now.utc },
+          stopping: -> { false }, group: DEFAULT_GROUP)
           raise ArgumentError, "a binding policy is required (fail closed without one)" unless binding
           raise ArgumentError, "an access policy is required (fail closed without one)" unless policy
 
@@ -92,6 +93,7 @@ module Ace
           @vault = vault == :file ? OtpVault::FileVault : vault
           @proposal_clock = proposal_clock
           @stopping = stopping
+          @group = group
         end
 
         # ---- requester side ------------------------------------------------
@@ -585,6 +587,7 @@ module Ace
             FileUtils.mkdir_p(dir)
             File.chmod(mode, dir)
           end
+          retag_public_projections! if @identity.root?
           nil
         end
 
@@ -1083,7 +1086,20 @@ module Ace
         end
 
         def group_id
-          @group_id ||= @identity.group_id(DEFAULT_GROUP)
+          @group_id ||= @identity.group_id(@group)
+        end
+
+        def retag_public_projections!
+          public_dir.children.each do |path|
+            next unless path.basename.to_s.end_with?(".json")
+
+            stat = File.lstat(path)
+            unless stat.file? && !stat.symlink?
+              raise StateError, "public lifecycle projection is not a regular file"
+            end
+            File.chmod(PUBLIC_MODE, path)
+            @ownership.chown(path, AtomicJson::Ownership.new(uid: stat.uid, gid: group_id))
+          end
         end
       end
     end

data/lib/ace/hitl/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Hitl
-    VERSION = "0.13.0"
+    VERSION = "0.14.0"
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-hitl
 version: !ruby/object:Gem::Version
-  version: 0.13.0
+  version: 0.14.0
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-08 00:00:00.000000000 Z
+date: 2026-10-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-hitl-contract
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.2'
+        version: 0.2.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.2'
+        version: 0.2.1
 - !ruby/object:Gem::Dependency
   name: ace-support-core
   requirement: !ruby/object:Gem::Requirement
@@ -113,28 +113,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.66'
+        version: '0.67'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.66'
+        version: '0.67'
 - !ruby/object:Gem::Dependency
   name: ace-herdr
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.5'
+        version: 0.5.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.5'
+        version: 0.5.1
 description: Provides the dedicated ace-hitl package surface for human in the loop
   (HITL) semantics and CLI workflows.
 email: