ace-hitl 0.14.0 → 0.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d921414979ccc0569dbfc0c8e102b3aa29c929f5e9ccde725968dc2a7227da9a
-  data.tar.gz: fb5c118b0f25a93507602223c5fb7f0751149883c4ead52ab96018d2651e4664
+  metadata.gz: '0827bd8ade04c613021128ac335a1d0fea74d5954e718122bd243a780bebb675'
+  data.tar.gz: df48a9612ca6a87670142ee8f511a837e206af2294a1a609be8045bfc14c1830
 SHA512:
-  metadata.gz: 67d4f65668300b1c111937e9f0dd11aa4ab11684db06c0cbe65cc2f73d227601985b32734bcd21849e82740a7bf44133fbdeb4bd860c45836e2f8cd541874d25
-  data.tar.gz: a7ee80f146804aedf4f7f14d901c6678cee3e8de3d909feb79ef189b5c36a97980a3ce0892760943533907bbce766847848492f3c8e9f8578064ba859261f699
+  metadata.gz: b0f0b827b307e8baf05a25c9503455fde43c8734e121f7d3f5f222a4d0a0aa201653bb346366fd6b8445c700031113068ff133cf24e4566b825e4bf59633f622
+  data.tar.gz: 462e2cef1a68a7a4a3975b96b324977223101a53ba384940875197e61c103054d3e52cbb83d4337f98aea0f5c92dfd306d0c372caa61e2bd8ab20517aca73cf3

data/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.15.0] - 2026-10-14
+
+### Added
+
+- Add `ace-hitl serve --tls-authority FILE` for the host/Incus mTLS crossing: a TLS 1.3-only loopback lifecycle authority with mutual X.509 identity (closed-form URI SANs, exact SHA-256 fingerprint pins, configured issuing CA, serverAuth/clientAuth EKU), fail-closed credential provisioning-layout enforcement before any socket opens, and remote peer-to-project binding that refuses pending flows, creates, and proposals for any non-bound project. Unix peer-credential serving is unchanged; shared frame/store logic is extracted without behavior change.
+
+### Changed
+
+- Narrow `ace-hitl serve --group` to dedicated lifecycle groups: a missing group, broad or known-shared control groups (gid 0, `lab-control`), the legacy `/run/lab` directory, and directories containing a legacy `labd.sock` entry now refuse startup fail-closed before any endpoint is created.
+
 ## [0.14.0] - 2026-10-11
 
 ### Added

data/docs/usage.md

@@ -472,3 +472,38 @@ Missing local dependency archives fail visibly without network fallback. A faile
 consumer retains diagnostic artifacts; inspect `result.json` and `service.log`
 before retrying. Each invocation retains a new run directory and requires a new
 empty GEM_HOME.
+
+## The host/Incus mTLS crossing (nh0-A)
+
+`ace-hitl serve --tls-authority FILE` runs one lifecycle authority of
+the shared-Hermes topology on a loopback TCP endpoint where the
+project's Incus TCP proxy device connects. The authority config
+(`ace.hitl.tls.authority/v1`, closed fields, root-owned runtime file
+`root:<service-group> 0640`) owns the loopback listen address, the
+project ID, the service account names and the server credential
+reference — never secret bytes:
+
+```json
+{"schema": "ace.hitl.tls.authority/v1",
+ "project_id": "proj-a", "listen": "127.0.0.1", "port": 8443,
+ "service_user": "hitl-proj-a", "service_group": "hitl-proj-a",
+ "tls_server_credential": {
+   "certificate_file": "/etc/ace-hitl/proj-a/server.pem",
+   "private_key_file": "/etc/ace-hitl/proj-a/server-key.pem",
+   "ca_file": "/etc/ace-hitl/proj-a/ca.pem",
+   "server_uri_san": "urn:ace:hitl:proj-a:lifecycle-server",
+   "allowed_client_uri_san": "urn:ace:hitl:proj-a:hermes-client",
+   "allowed_client_certificate_sha256": "<64 lowercase hex>"}}
+```
+
+Startup enforces the exact provisioning layout (ancestors `root:root`
+0755, project directory `root:<service-group>` 0750, private key
+`<service-user>:<service-group>` 0400 and never hard-linked,
+certificate/CA `root:root` 0444) BEFORE any socket opens, validates its
+own certificate identity (single URI SAN, serverAuth EKU, key match),
+speaks TLS 1.3 only, and admits exactly the configured client
+SAN/fingerprint pair — bound to the authority's one project, with
+pending flows and creates refused for any other project. Unix
+peer-credential serving (`serve` without `--tls-authority`) remains the
+same-runtime boundary. lab-config (gad.8/gad.b) owns accounts, file
+provisioning, Incus proxy devices and the tailnet listeners.

data/lib/ace/hitl/cli/commands/serve.rb

@@ -19,15 +19,20 @@ module Ace
           desc "Run the authenticated HITL store boundary service (peer-credential access)"
 
           option :socket, type: :string, desc: "Boundary socket path (default: ACE_HITL_SOCKET or /run/lab/hitl.sock)"
-          option :group, type: :string, desc: "Dedicated control group allowed to connect (default: lab-control)"
+          option :group, type: :string,
+            desc: "Dedicated lifecycle group allowed to connect (required; root and lab-control are refused)"
           option :store_root, type: :string, desc: "Private store root (default: ACE_HITL_STORE_ROOT or /run/lab/hitl)"
           option :grants_path, type: :string, desc: "Trusted grants document (default: ACE_HITL_GRANTS_PATH or /etc/lab/ace-lab/authorization.yml)"
           option :repo_root, type: :string, desc: "Candidate repository for the managed attempt authority"
+          option :tls_authority, type: :string, desc: "Serve the host/Incus mTLS crossing from this authority config (root:<service-group> 0640; loopback TCP + verified project client identity)"
 
           option :quiet, type: :boolean, aliases: %w[-q], desc: "Suppress non-essential output"
           option :verbose, type: :boolean, aliases: %w[-v], desc: "Show verbose output"
 
           def call(**options)
+            return serve_tls_authority(options) if options[:tls_authority]
+
+            group = dedicated_group(options)
             policy = Providers::Lab.grants_policy(grants_path: grants_path(options))
             unless policy.service_uid
               raise_cli_error(
@@ -42,7 +47,7 @@ module Ace
               binding: binding_policy,
               policy: policy,
               socket_path: socket_path(options),
-              group: options[:group] || Lifecycle::Store::DEFAULT_GROUP,
+              group: group,
               logger: options[:verbose] ? ->(message) { warn message } : nil
             )
             service.run
@@ -52,6 +57,36 @@ module Ace
 
           private
 
+          # The host/Incus crossing (spec 8xa.t.nh0): authority config,
+          # credential layout and TLS material are verified fail-closed
+          # BEFORE the loopback listener opens; the verified project-
+          # scoped client certificate is the only admitted peer.
+          def serve_tls_authority(options)
+            authority = Lifecycle::TlsAuthority.load(options[:tls_authority])
+            binding_policy = Providers::Lab.assignment_binding(repo_root: options[:repo_root])
+            service = Lifecycle::TlsService.new(
+              root: store_root(options),
+              binding: binding_policy,
+              project: authority.project_id,
+              credential: authority.credential,
+              ssl_context: authority.ssl_context!,
+              listen: authority.listen,
+              port: authority.port,
+              group: authority.service_group,
+              logger: options[:verbose] ? ->(message) { warn message } : nil
+            )
+            service.run
+          rescue Lifecycle::Error, Providers::ProviderUnavailableError => e
+            raise_cli_error(e.message)
+          end
+
+          def dedicated_group(options)
+            group = options[:group].to_s
+            return group unless group.empty?
+
+            raise_cli_error("--group is required and must name a dedicated lifecycle group")
+          end
+
           def socket_path(options)
             options[:socket] || ENV[Providers::Lab::SOCKET_PATH_ENV] || Providers::Lab::DEFAULT_SOCKET_PATH
           end

data/lib/ace/hitl/lifecycle/client.rb

@@ -2,13 +2,18 @@
 
 require "socket"
 require_relative "protocol"
+require_relative "frame_exchange"
+require_relative "lifecycle_requests"
 
 module Ace
   module Hitl
     module Lifecycle
-      # The authenticated client of the scoped store boundary (spec
-      # 8wq.t.34i). The CLI lifecycle operations run through this client;
-      # direct shared-store access is not a client-side option.
+      # The authenticated Unix-socket client of the scoped store
+      # boundary (spec 8wq.t.34i). The CLI lifecycle operations run
+      # through this client; direct shared-store access is not a
+      # client-side option. Cross-runtime clients use the mutual-TLS
+      # Hermes client of the host/Incus crossing (spec 8xa.t.nh0)
+      # instead; both share the request surface and frame exchange.
       #
       # Both endpoint directions are authenticated:
       # - the client authenticates the SERVICE: the socket must be a
@@ -21,43 +26,10 @@ module Ace
       # classified lifecycle errors arrive from the service and are
       # re-raised under their own classes.
       class Client
-        attr_reader :socket_path, :service_uid
-
-        def proposal_create(**params)
-          request("proposal-create", params)
-        end
-
-        def proposal_show(id, project:, history_after: 0)
-          request("proposal-show", {"id" => id, "project" => project, "history_after" => history_after})
-        end
-
-        def proposal_revise(id, project:, expected_revision:, operation_id:, document:)
-          request("proposal-revise", {"id" => id, "project" => project, "expected_revision" => expected_revision, "operation_id" => operation_id, "document" => document})
-        end
+        include FrameExchange
+        include LifecycleRequests
 
-        def proposal_acknowledge(id, project:, submitted_at:)
-          request("proposal-ack", {"id" => id, "project" => project, "submitted_at" => submitted_at})
-        end
-
-        def proposal_reply(id, project:, **params)
-          request("proposal-reply", {"id" => id, "project" => project}.merge(params))
-        end
-
-        def proposal_reconcile(id, project:, checkpoint:)
-          request("proposal-reconcile", {"id" => id, "project" => project, "checkpoint" => checkpoint})
-        end
-
-        def proposal_wake(project:, after: nil)
-          request("proposal-wake", {"project" => project, "after" => after}.compact)
-        end
-
-        def proposal_due(project:, after: nil)
-          request("proposal-due", {"project" => project, "after" => after}.compact)
-        end
-
-        def proposal_history(project:, query: "", after: nil)
-          request("proposal-history", {"project" => project, "query" => query, "after" => after}.compact)
-        end
+        attr_reader :socket_path, :service_uid
 
         def initialize(socket_path:, service_uid:, deadline_seconds: Protocol::DEFAULT_DEADLINE_SECONDS)
           @socket_path = socket_path.to_s
@@ -85,57 +57,6 @@ module Ace
           raise TransportError, "HITL boundary request is not serializable (#{e.message})"
         end
 
-        def create(deadline: nil, **params)
-          request("create", params.transform_keys(&:to_s), deadline: deadline)
-        end
-
-        def read(id, deadline: nil)
-          request("read", {"id" => id}, deadline: deadline)
-        end
-
-        def deliver(id, answer)
-          request("deliver", {"id" => id, "answer" => answer.to_s})
-        end
-
-        def consume(id, timeout: 0, operation: nil, native_delivery: false, deadline: nil)
-          params = {"id" => id, "timeout" => Integer(timeout)}
-          params["operation"] = operation if operation
-          params["native_delivery"] = true if native_delivery
-          request("consume", params, deadline: deadline)
-        end
-
-        def cancel(id, reason: "", deadline: nil)
-          request("cancel", {"id" => id, "reason" => reason.to_s}, deadline: deadline)
-        end
-
-        def pending(project: nil)
-          items = []
-          after = nil
-          loop do
-            page = pending_page(project: project, after: after)
-            items.concat(page.fetch("items"))
-            cursor = page.fetch("next")
-            break unless cursor
-            unless cursor.is_a?(String) && (after.nil? || cursor > after)
-              raise TransportError, "pending cursor did not advance"
-            end
-            after = cursor
-          end
-          items
-        end
-
-        def pending_page(project: nil, after: nil)
-          request("pending", {"project" => project, "after" => after}.compact)
-        end
-
-        def states
-          request("states")
-        end
-
-        def ping
-          request("ping")
-        end
-
         private
 
         # The endpoint must be owned by the trusted service identity and
@@ -175,24 +96,6 @@ module Ace
           socket.getpeereid
         end
 
-        # A consume without a timeout waits indefinitely at the client
-        # boundary too; every bounded call gets a deadline slightly
-        # beyond its own wait so the server result wins the race.
-        def request_deadline(op, params, selected)
-          if !selected.nil? && (!selected.is_a?(Numeric) || !selected.finite?)
-            raise TransportError, "HITL boundary deadline is invalid"
-          end
-          local = deadline_for(op, params)
-          [selected, local].compact.min
-        end
-
-        def await!(socket, direction, deadline)
-          remaining = deadline && deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
-          raise TransportError, "HITL boundary deadline exceeded" if remaining && remaining <= 0
-          readable, writable = direction == :read ? [[socket], nil] : [nil, [socket]]
-          raise TransportError, "HITL boundary deadline exceeded" unless IO.select(readable, writable, nil, remaining)
-        end
-
         def connect!(socket, deadline)
           if deadline && deadline <= Process.clock_gettime(Process::CLOCK_MONOTONIC)
             raise TransportError, "HITL boundary deadline exceeded"
@@ -203,49 +106,6 @@ module Ace
           error = socket.getsockopt(Socket::SOL_SOCKET, Socket::SO_ERROR).int
           raise SystemCallError.new("HITL boundary connection failed", error) unless error.zero?
         end
-
-        def write_frame!(socket, frame, deadline)
-          offset = 0
-          while offset < frame.bytesize
-            await!(socket, :write, deadline)
-            written = socket.write_nonblock(frame.byteslice(offset..), exception: false)
-            next if written == :wait_writable
-            raise TransportError, "HITL boundary closed before request" unless written.is_a?(Integer) && written.positive?
-            offset += written
-          end
-        end
-
-        def deadline_for(op, params)
-          if op == "consume" && Integer(params["timeout"]) <= 0
-            nil
-          else
-            Process.clock_gettime(Process::CLOCK_MONOTONIC) + @deadline_seconds + Integer(params["timeout"])
-          end
-        rescue ArgumentError, TypeError
-          Process.clock_gettime(Process::CLOCK_MONOTONIC) + @deadline_seconds
-        end
-
-        def read_line(socket, deadline)
-          data = +""
-          loop do
-            remaining = deadline && deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
-            raise TransportError, "HITL boundary deadline exceeded" if remaining && remaining <= 0
-            ready = IO.select([socket], nil, nil, remaining)
-            raise TransportError, "HITL boundary deadline exceeded" unless ready
-
-            chunk = socket.read_nonblock(4096, exception: false)
-            raise TransportError, "HITL boundary closed before responding" if chunk.nil?
-            # A spurious not-ready result goes back to select; only the
-            # deadline ends the wait (review 8x32r9b4).
-            next if chunk == :wait_readable
-
-            data << chunk
-            if data.bytesize > Protocol::MAX_FRAME_BYTES
-              raise TransportError, "HITL boundary response is too large"
-            end
-            return data if data.include?("\n")
-          end
-        end
       end
     end
   end

data/lib/ace/hitl/lifecycle/credential_path_policy.rb

@@ -0,0 +1,183 @@
+# frozen_string_literal: true
+
+require "etc"
+
+module Ace
+  module Hitl
+    module Lifecycle
+      # Provisioning-time enforcement of the one exact ownership/mode
+      # layout of the host/Incus crossing (spec 8xa.t.nh0). There are no
+      # mode alternatives:
+      #
+      # - every credential-tree ancestor above the project leaf is
+      #   `root:root` mode `0755` (verified up to the filesystem root);
+      # - the project credential directory is `root:<service-group>`
+      #   mode `0750`;
+      # - the referenced private key is `<service-user>:<service-group>`
+      #   mode `0400` and never hard-linked;
+      # - the referenced certificate and CA bundle are `root:root`
+      #   mode `0444`;
+      # - the root-owned runtime file containing endpoint/credential
+      #   references is `root:<service-group>` mode `0640`;
+      # - each path component and file is a regular owned object: no
+      #   symlink, group/world-writable component, hard-linked key or
+      #   ownership substitution is accepted.
+      #
+      # Exact mode + exact owner/group verification is the enforceable
+      # ACL proxy: any POSIX ACL that grants beyond the declared mode
+      # surfaces in the group class bits and fails the exact match.
+      #
+      # Any missing, unreadable, redirected, over-broad, incorrectly
+      # owned/mode-set or mismatched object REFUSES STARTUP before a
+      # socket is opened: every check runs before the TLS service binds.
+      class CredentialPathPolicy
+        Error = Class.new(Lifecycle::Error)
+
+        ANCESTOR_MODE = 0o755
+        PROJECT_DIR_MODE = 0o750
+        KEY_MODE = 0o400
+        PUBLIC_MODE = 0o444
+        RUNTIME_FILE_MODE = 0o640
+
+        class << self
+          # Verify the three referenced credential files of one project
+          # credential object (server or client form; both share the
+          # layout).
+          def verify_credential_tree!(credential:, service_user:, service_group:)
+            new(service_user: service_user, service_group: service_group)
+              .verify_credential_tree!(credential)
+          end
+
+          # Verify one root-owned runtime configuration file that holds
+          # endpoint/credential references.
+          def verify_runtime_file!(path, service_group:)
+            new(service_user: nil, service_group: service_group).verify_runtime_file!(path)
+          end
+        end
+
+        def initialize(service_user:, service_group:)
+          # The runtime-file check verifies root ownership only; the
+          # service user is required for the key ownership rule.
+          @service_uid = service_user.nil? ? nil : resolve_user(service_user)
+          @service_gid = resolve_group(service_group)
+        end
+
+        def verify_credential_tree!(credential)
+          roles = {"certificate_file" => :public, "private_key_file" => :key, "ca_file" => :public}
+          # Pass one: structural verification of EVERY referenced file
+          # (existence, no symlink, regular file) before any ownership
+          # comparison — structural refusals never depend on privilege.
+          paths = roles.map do |field, role|
+            path = credential.fetch(field)
+            lstat_file!(path, "credential file")
+            [path, role]
+          end
+          # Pass two: the exact ownership/mode rules per role.
+          paths.each do |path, role|
+            verify_owner_mode!(path, role)
+          end
+          project_dir = File.dirname(paths.first.first)
+          unless paths.all? { |path, _role| File.dirname(path) == project_dir }
+            raise Error,
+              "credential files must share one project credential directory " \
+              "(#{paths.map(&:first).join(", ")})"
+          end
+          verify_project_directory(project_dir)
+          verify_ancestors(project_dir)
+          self
+        end
+
+        def verify_runtime_file!(path)
+          stat = lstat_file!(path, "runtime configuration file")
+          unless stat.uid.zero? && stat.gid == @service_gid && (stat.mode & 0o7777) == RUNTIME_FILE_MODE
+            raise Error,
+              "runtime configuration file must be root:<service-group> mode 0640: #{path} " \
+              "(got uid=#{stat.uid} gid=#{stat.gid} mode=#{stat.mode.to_s(8)})"
+          end
+
+          self
+        end
+
+        private
+
+        def verify_owner_mode!(path, role)
+          stat = File.lstat(path)
+          expected_owner = role == :key ? [@service_uid, @service_gid] : [0, 0]
+          expected_mode = role == :key ? KEY_MODE : PUBLIC_MODE
+          unless [stat.uid, stat.gid] == expected_owner && (stat.mode & 0o7777) == expected_mode
+            raise Error,
+              "credential file has the wrong owner or mode: #{path} (got uid=#{stat.uid} " \
+              "gid=#{stat.gid} mode=#{stat.mode.to_s(8)})"
+          end
+          if role == :key && stat.nlink != 1
+            raise Error, "credential private key must not be hard-linked: #{path}"
+          end
+        end
+
+        def verify_project_directory(path)
+          stat = File.lstat(path)
+          unless stat.directory? && !stat.symlink?
+            raise Error, "project credential directory is not a regular directory: #{path}"
+          end
+          unless stat.uid.zero? && stat.gid == @service_gid && (stat.mode & 0o7777) == PROJECT_DIR_MODE
+            raise Error,
+              "project credential directory must be root:<service-group> mode 0750: #{path} " \
+              "(got uid=#{stat.uid} gid=#{stat.gid} mode=#{stat.mode.to_s(8)})"
+          end
+        rescue Errno::ENOENT
+          raise Error, "project credential directory does not exist: #{path}"
+        end
+
+        # Every ancestor above the project leaf — up to the filesystem
+        # root — is a root:root 0755 directory. A group/world-writable,
+        # foreign-owned or symlinked component anywhere on the chain
+        # would allow credential substitution.
+        def verify_ancestors(path)
+          parent = File.expand_path("..", path)
+          components = parent.split("/").reject(&:empty?)
+          verify_ancestor!("/", File.lstat("/"))
+          components.each_with_object("") do |component, current|
+            current << "/#{component}"
+            stat = File.lstat(current)
+            verify_ancestor!(current, stat)
+          end
+        end
+
+        def verify_ancestor!(path, stat)
+          unless stat.directory? && !stat.symlink? && stat.uid.zero? && stat.gid.zero? &&
+              (stat.mode & 0o7777) == ANCESTOR_MODE
+            raise Error,
+              "credential path ancestor must be a root:root mode 0755 directory: #{path} " \
+              "(got uid=#{stat.uid} gid=#{stat.gid} mode=#{stat.mode.to_s(8)})"
+          end
+        rescue Errno::ENOENT
+          raise Error, "credential path ancestor does not exist: #{path}"
+        end
+
+        def lstat_file!(path, label)
+          stat = File.lstat(path)
+          raise Error, "#{label} must not be a symlink: #{path}" if stat.symlink?
+          raise Error, "#{label} is not a regular file: #{path}" unless stat.file?
+
+          stat
+        rescue Errno::ENOENT
+          raise Error, "#{label} does not exist: #{path}"
+        rescue SystemCallError
+          raise Error, "#{label} is not verifiable: #{path}"
+        end
+
+        def resolve_user(name)
+          Etc.getpwnam(name.to_s).uid
+        rescue ArgumentError
+          raise Error, "the configured service user does not exist: #{name.inspect}"
+        end
+
+        def resolve_group(name)
+          Etc.getgrnam(name.to_s).gid
+        rescue ArgumentError
+          raise Error, "the configured service group does not exist: #{name.inspect}"
+        end
+      end
+    end
+  end
+end

data/lib/ace/hitl/lifecycle/frame_exchange.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+module Ace
+  module Hitl
+    module Lifecycle
+      # The deadline-bounded frame exchange of a lifecycle client (spec
+      # 8wq.t.34i, shared by the Unix and the TLS 1.3/TCP transports):
+      # one newline-delimited request frame out, one bounded response
+      # frame back, size and deadline rules identical on both transports.
+      # The includer supplies `@deadline_seconds` and implements
+      # `#request(op, params, deadline:)`.
+      module FrameExchange
+        private
+
+        def await!(socket, direction, deadline)
+          remaining = deadline && deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          raise TransportError, "HITL boundary deadline exceeded" if remaining && remaining <= 0
+          readable, writable = direction == :read ? [[socket], nil] : [nil, [socket]]
+          raise TransportError, "HITL boundary deadline exceeded" unless IO.select(readable, writable, nil, remaining)
+        end
+
+        def write_frame!(socket, frame, deadline)
+          offset = 0
+          while offset < frame.bytesize
+            await!(socket, :write, deadline)
+            written = socket.write_nonblock(frame.byteslice(offset..), exception: false)
+            next if written == :wait_writable
+            raise TransportError, "HITL boundary closed before request" unless written.is_a?(Integer) && written.positive?
+            offset += written
+          end
+        end
+
+        def read_line(socket, deadline)
+          data = +""
+          loop do
+            remaining = deadline && deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            raise TransportError, "HITL boundary deadline exceeded" if remaining && remaining <= 0
+            ready = IO.select([socket], nil, nil, remaining)
+            raise TransportError, "HITL boundary deadline exceeded" unless ready
+
+            chunk = socket.read_nonblock(4096, exception: false)
+            raise TransportError, "HITL boundary closed before responding" if chunk.nil?
+            # A spurious not-ready result goes back to select; only the
+            # deadline ends the wait (review 8x32r9b4).
+            next if chunk == :wait_readable
+
+            data << chunk
+            if data.bytesize > Protocol::MAX_FRAME_BYTES
+              raise TransportError, "HITL boundary response is too large"
+            end
+            return data if data.include?("\n")
+          end
+        end
+
+        # A consume without a timeout waits indefinitely at the client
+        # boundary too; every bounded call gets a deadline slightly
+        # beyond its own wait so the server result wins the race.
+        def request_deadline(op, params, selected)
+          if !selected.nil? && (!selected.is_a?(Numeric) || !selected.finite?)
+            raise TransportError, "HITL boundary deadline is invalid"
+          end
+          local = deadline_for(op, params)
+          [selected, local].compact.min
+        end
+
+        def deadline_for(op, params)
+          if op == "consume" && Integer(params["timeout"]) <= 0
+            nil
+          else
+            Process.clock_gettime(Process::CLOCK_MONOTONIC) + @deadline_seconds + Integer(params["timeout"])
+          end
+        rescue ArgumentError, TypeError
+          Process.clock_gettime(Process::CLOCK_MONOTONIC) + @deadline_seconds
+        end
+      end
+    end
+  end
+end