ace-hitl 0.14.0 → 0.16.0

data/lib/ace/hitl/lifecycle/frame_exchange.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+module Ace
+  module Hitl
+    module Lifecycle
+      # The deadline-bounded frame exchange of a lifecycle client (spec
+      # 8wq.t.34i, shared by the Unix and the TLS 1.3/TCP transports):
+      # one newline-delimited request frame out, one bounded response
+      # frame back, size and deadline rules identical on both transports.
+      # The includer supplies `@deadline_seconds` and implements
+      # `#request(op, params, deadline:)`.
+      module FrameExchange
+        private
+
+        def await!(socket, direction, deadline)
+          remaining = deadline && deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          raise TransportError, "HITL boundary deadline exceeded" if remaining && remaining <= 0
+          readable, writable = direction == :read ? [[socket], nil] : [nil, [socket]]
+          raise TransportError, "HITL boundary deadline exceeded" unless IO.select(readable, writable, nil, remaining)
+        end
+
+        def write_frame!(socket, frame, deadline)
+          offset = 0
+          while offset < frame.bytesize
+            await!(socket, :write, deadline)
+            written = socket.write_nonblock(frame.byteslice(offset..), exception: false)
+            next if written == :wait_writable
+            raise TransportError, "HITL boundary closed before request" unless written.is_a?(Integer) && written.positive?
+            offset += written
+          end
+        end
+
+        def read_line(socket, deadline)
+          data = +""
+          loop do
+            remaining = deadline && deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            raise TransportError, "HITL boundary deadline exceeded" if remaining && remaining <= 0
+            ready = IO.select([socket], nil, nil, remaining)
+            raise TransportError, "HITL boundary deadline exceeded" unless ready
+
+            chunk = socket.read_nonblock(4096, exception: false)
+            raise TransportError, "HITL boundary closed before responding" if chunk.nil?
+            # A spurious not-ready result goes back to select; only the
+            # deadline ends the wait (review 8x32r9b4).
+            next if chunk == :wait_readable
+
+            data << chunk
+            if data.bytesize > Protocol::MAX_FRAME_BYTES
+              raise TransportError, "HITL boundary response is too large"
+            end
+            return data if data.include?("\n")
+          end
+        end
+
+        # A consume without a timeout waits indefinitely at the client
+        # boundary too; every bounded call gets a deadline slightly
+        # beyond its own wait so the server result wins the race.
+        def request_deadline(op, params, selected)
+          if !selected.nil? && (!selected.is_a?(Numeric) || !selected.finite?)
+            raise TransportError, "HITL boundary deadline is invalid"
+          end
+          local = deadline_for(op, params)
+          [selected, local].compact.min
+        end
+
+        def deadline_for(op, params)
+          if op == "consume" && Integer(params["timeout"]) <= 0
+            nil
+          else
+            Process.clock_gettime(Process::CLOCK_MONOTONIC) + @deadline_seconds + Integer(params["timeout"])
+          end
+        rescue ArgumentError, TypeError
+          Process.clock_gettime(Process::CLOCK_MONOTONIC) + @deadline_seconds
+        end
+      end
+    end
+  end
+end

data/lib/ace/hitl/lifecycle/frame_serving.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+module Ace
+  module Hitl
+    module Lifecycle
+      # The connection-serving half of a lifecycle boundary (spec
+      # 8wq.t.34i, reused by the TLS/TCP crossing of spec 8xa.t.nh0):
+      # one bounded request frame per dispatch, classified errors cross
+      # the wire, idleness and frame size stay bounded. The includer
+      # supplies `@idle_seconds`, `@logger` and `store_for(connection)`.
+      module FrameServing
+        def serve_connection(socket)
+          peer = authenticate!(socket)
+          store = store_for(peer)
+          loop do
+            line = read_frame(socket)
+            break if line.nil?
+
+            response = dispatch(store, line)
+            write_frame(socket, response)
+          end
+        rescue Lifecycle::Error => e
+          write_frame(socket, Protocol.encode_error(e)) rescue nil
+        rescue SystemCallError, IOError
+          nil
+        ensure
+          socket.close rescue nil
+        end
+
+        private
+
+        # One request frame per dispatch; lifecycle failures return
+        # classified error frames, transport/frame failures close the
+        # connection (serve_connection's rescues).
+        def dispatch(store, line)
+          request = Protocol.decode_request(line)
+          result = execute(store, request[:op], request[:params])
+          Protocol.encode_result(result)
+        rescue Protocol::FrameError, Lifecycle::Error, ArgumentError, TypeError => e
+          Protocol.encode_error(e)
+        end
+
+        def execute(store, op, params)
+          case op
+          when "ping" then {"pong" => true}
+          when "proposal-create" then store.proposal_create(**symbolize(params))
+          when "proposal-show" then store.proposal_show(required(params, "id"), project: required(params, "project"), history_after: params.fetch("history_after", 0))
+          when "proposal-revise" then store.proposal_revise(required(params, "id"), project: required(params, "project"), expected_revision: required(params, "expected_revision"),
+            operation_id: required(params, "operation_id"), document: required(params, "document"))
+          when "proposal-ack"
+            store.proposal_acknowledge(required(params, "id"), project: required(params, "project"), submitted_at: required(params, "submitted_at"))
+          when "proposal-reply"
+            store.proposal_reply(required(params, "id"), project: required(params, "project"), answer: required(params, "answer"),
+              received_at: required(params, "received_at"), sequence: required(params, "sequence"))
+          when "proposal-reconcile"
+            store.proposal_reconcile(required(params, "id"), project: required(params, "project"), checkpoint: required(params, "checkpoint"))
+          when "proposal-wake" then store.proposal_wake(project: required(params, "project"), after: params["after"])
+          when "proposal-due" then store.proposal_due(project: required(params, "project"), after: params["after"])
+          when "proposal-history" then store.proposal_history(project: required(params, "project"),
+            query: params.fetch("query", ""), after: params["after"])
+          when "create" then store.create(**symbolize(params))
+          when "read" then store.read(required(params, "id"))
+          when "deliver" then store.deliver(required(params, "id"), answer_reader(params))
+          when "consume"
+            store.consume(required(params, "id"), timeout: Integer(params["timeout"] || 0),
+              operation: params["operation"], native_delivery: params.fetch("native_delivery", false))
+          when "cancel" then store.cancel(required(params, "id"), reason: params["reason"].to_s)
+          when "pending" then store.pending_page(project: params["project"], after: params["after"])
+          when "states" then store.states
+          end
+        end
+
+        def symbolize(params)
+          params.transform_keys { |key| key.to_sym }
+        end
+
+        def required(params, key)
+          value = params[key]
+          raise Protocol::FrameError, "boundary parameter '#{key}' is required" if value.nil? || value.to_s.empty?
+
+          value
+        end
+
+        def answer_reader(params)
+          answer = params["answer"].to_s
+          ->(limit) { answer[0, limit] }
+        end
+
+        def read_frame(socket)
+          data = +""
+          loop do
+            ready = IO.select([socket], nil, nil, @idle_seconds)
+            return nil unless ready
+
+            chunk = socket.read_nonblock(4096, exception: false)
+            return nil if chunk.nil?
+            next sleep(0.01) if chunk == :wait_readable
+
+            data << chunk
+            if data.bytesize > Protocol::MAX_FRAME_BYTES
+              write_frame(socket, Protocol.encode_error(Protocol::FrameError.new("request frame is too large"))) rescue nil
+              return nil
+            end
+            return data if data.include?("\n")
+          end
+        end
+
+        def write_frame(socket, frame)
+          socket.write(frame)
+          socket.flush
+        end
+
+        def log(message)
+          @logger&.call("[ace-hitl] #{message}")
+        end
+      end
+    end
+  end
+end

data/lib/ace/hitl/lifecycle/lifecycle_requests.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+module Ace
+  module Hitl
+    module Lifecycle
+      # The client request surface of the scoped store boundary (spec
+      # 8wq.t.34i), shared verbatim by the Unix client and the
+      # mutual-TLS Hermes client (spec 8xa.t.nh0): the existing bounded
+      # lifecycle frames are exchanged unchanged on both transports.
+      # The includer implements `#request(op, params, deadline:)`.
+      module LifecycleRequests
+        def proposal_create(**params)
+          request("proposal-create", params)
+        end
+
+        def proposal_show(id, project:, history_after: 0)
+          request("proposal-show", {"id" => id, "project" => project, "history_after" => history_after})
+        end
+
+        def proposal_revise(id, project:, expected_revision:, operation_id:, document:)
+          request("proposal-revise", {"id" => id, "project" => project, "expected_revision" => expected_revision, "operation_id" => operation_id, "document" => document})
+        end
+
+        def proposal_acknowledge(id, project:, submitted_at:)
+          request("proposal-ack", {"id" => id, "project" => project, "submitted_at" => submitted_at})
+        end
+
+        def proposal_reply(id, project:, **params)
+          request("proposal-reply", {"id" => id, "project" => project}.merge(params))
+        end
+
+        def proposal_reconcile(id, project:, checkpoint:)
+          request("proposal-reconcile", {"id" => id, "project" => project, "checkpoint" => checkpoint})
+        end
+
+        def proposal_wake(project:, after: nil)
+          request("proposal-wake", {"project" => project, "after" => after}.compact)
+        end
+
+        def proposal_due(project:, after: nil)
+          request("proposal-due", {"project" => project, "after" => after}.compact)
+        end
+
+        def proposal_history(project:, query: "", after: nil)
+          request("proposal-history", {"project" => project, "query" => query, "after" => after}.compact)
+        end
+
+        def create(deadline: nil, **params)
+          request("create", params.transform_keys(&:to_s), deadline: deadline)
+        end
+
+        def read(id, deadline: nil)
+          request("read", {"id" => id}, deadline: deadline)
+        end
+
+        def deliver(id, answer)
+          request("deliver", {"id" => id, "answer" => answer.to_s})
+        end
+
+        def consume(id, timeout: 0, operation: nil, native_delivery: false, deadline: nil)
+          params = {"id" => id, "timeout" => Integer(timeout)}
+          params["operation"] = operation if operation
+          params["native_delivery"] = true if native_delivery
+          request("consume", params, deadline: deadline)
+        end
+
+        def cancel(id, reason: "", deadline: nil)
+          request("cancel", {"id" => id, "reason" => reason.to_s}, deadline: deadline)
+        end
+
+        def pending(project: nil)
+          items = []
+          after = nil
+          loop do
+            page = pending_page(project: project, after: after)
+            items.concat(page.fetch("items"))
+            cursor = page.fetch("next")
+            break unless cursor
+            unless cursor.is_a?(String) && (after.nil? || cursor > after)
+              raise TransportError, "pending cursor did not advance"
+            end
+            after = cursor
+          end
+          items
+        end
+
+        def pending_page(project: nil, after: nil)
+          request("pending", {"project" => project, "after" => after}.compact)
+        end
+
+        def states
+          request("states")
+        end
+
+        def ping
+          request("ping")
+        end
+      end
+    end
+  end
+end

data/lib/ace/hitl/lifecycle/policy.rb

@@ -105,6 +105,14 @@ module Ace
         def proposal?(_peer, project:)
           false
         end
+
+        def proposal_silence?(caller_uid:, requester:, project:, operation:)
+          false
+        end
+
+        def silence_operation?(project:, operation:)
+          false
+        end
         # @return [Boolean] true when the peer may deliver answers and
         #   observe pending/states for the given project
         def transport?(_peer, project: nil)
@@ -151,13 +159,36 @@ module Ace
         # an ordinary requester or transport grant.
         def proposal?(peer, project:)
           current = document
+          proposal_principal?(peer.uid, project, current)
+        end
+
+        # A proposer grant allows asking. Only this separate, exact project
+        # operation list delegates a decision after the acknowledged window.
+        def proposal_silence?(caller_uid:, requester:, project:, operation:)
+          current = document
+          proposal_principal?(caller_uid, project, current) &&
+            delegated_operation?(project, operation, current)
+        end
+
+        def silence_operation?(project:, operation:)
+          delegated_operation?(project, operation, document)
+        end
+
+        private
+
+        def proposal_principal?(uid, project, current)
           uids = hitl_facts(current)["proposal_uids"]
-          projects = authorized_projects(peer.uid, current)
-          uids.is_a?(Array) && uids.include?(peer.uid) && projects &&
+          projects = authorized_projects(uid, current)
+          uid.is_a?(Integer) && uids.is_a?(Array) && uids.include?(uid) && projects &&
             (projects.empty? || projects.include?(project.to_s))
         end
 
-        private
+        def delegated_operation?(project, operation, current)
+          delegations = hitl_facts(current)["silence_operations"]
+          operations = delegations.is_a?(Hash) && delegations[project]
+          operations.is_a?(Array) && operation.is_a?(String) &&
+            operation.match?(/\A[a-z][a-z0-9-]{0,63}\z/) && operations.include?(operation)
+        end
 
         def document
           @document || TrustedFile.read_yaml(@grants_path) || {}

data/lib/ace/hitl/lifecycle/proposals.rb

@@ -54,6 +54,7 @@ module Ace
           claims = proposal_journal(project).proposal_claims(record["revision_id"])
           claim = claims.last
           outcome = case claim && claim["state"]
+          when "pending" then "queued"
           when "accepted" then "executing"
           when "succeeded" then "succeeded"
           when "failed", "failed-settled", "rejected" then "failed"
@@ -88,6 +89,7 @@ module Ace
           record = proposal_for_request!(request, project: project)
           require_transport!("proposal reconciliation", {"project" => record["project_id"]})
           proposal_transition(record) do |current|
+            next current unless silence_delegated?(current)
             Ace::Hitl::Proposals::Policy.resolve(current, checkpoint: checkpoint, now: proposal_now)
           end
         end
@@ -136,6 +138,11 @@ module Ace
 
         private
 
+        def silence_delegated?(record)
+          @policy.proposal_silence?(caller_uid: record["caller_uid"], requester: record["requester"],
+            project: record["project_id"], operation: record["operation"])
+        end
+
         def require_proposer!(project)
           unless @policy.respond_to?(:proposal?) && @policy.proposal?(@identity, project: project)
             raise PermissionError, "proposal requires the installed second-commander decision principal"
@@ -189,6 +196,8 @@ module Ace
         def proposal_transition(record, &policy)
           proposal_journal(record.fetch("project_id")).change_proposal(record["proposal_id"], assignment_id: record["assignment_id"],
             attempt_id: record["attempt_id"]) do |current|
+            # Selection may change while waiting for the canonical ref lock.
+            proposal_journal(record.fetch("project_id"))
             # A reply to an older revision cannot modify the new decision.
             next current unless current["request_id"] == record["request_id"]
             policy.call(current)
@@ -203,6 +212,7 @@ module Ace
           replay = nil
           record = @binding.with_active(assignment: assignment, attempt: attempt, project: project, requester: @identity.username) do
             proposal_journal(project).change_proposal(id, assignment_id: assignment, attempt_id: attempt) do |previous|
+              proposal_journal(project)
               if operation_id
                 replay = proposal_revision_replay(id, expected_revision, operation_id, content, project: project)
                 next previous if replay
@@ -228,6 +238,8 @@ module Ace
                 "attempt_id" => attempt, "project_id" => project, "requester" => @identity.username,
                 "caller_uid" => @identity.uid, "content_digest" => Digest::SHA256.hexdigest(JSON.generate(content)),
                 "state" => "awaiting-delivery", "created_at" => proposal_now,
+                "silence_delegated" => @policy.proposal_silence?(caller_uid: @identity.uid,
+                  requester: @identity.username, project: project, operation: content.fetch("operation")),
                 "authorization" => request, "lifecycle_request" => projection).tap do |value|
                   if operation_id
                     value["revision_operation_id"] = operation_id

data/lib/ace/hitl/lifecycle/remote_peer.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require "etc"
+
+module Ace
+  module Hitl
+    module Lifecycle
+      # The authenticated caller of one mutually authenticated TLS
+      # connection (spec 8xa.t.nh0): resolved from the VERIFIED
+      # project-scoped client certificate — single URI SAN, exact
+      # fingerprint, issuing CA and EKU checked before any lifecycle
+      # frame is decoded — never from payload fields or claim strings.
+      #
+      # A remote peer has no local uid: every check that would use one
+      # fails closed. The username is the exact verified URI SAN token,
+      # so requester-only store paths never match a foreign remote peer,
+      # and effect callbacks that would need a local privilege drop
+      # escalate exactly like the existing non-root transport case. The
+      # peer's OWN token materializes to the service identity that
+      # terminates the crossing (public projections and attribution of
+      # the requests it created); foreign names still resolve through
+      # the passwd database and unknown ones fail closed.
+      class RemotePeer
+        attr_reader :project, :identity
+
+        def initialize(project:, identity:)
+          @project = project.to_s
+          @identity = identity
+        end
+
+        def username
+          @identity
+        end
+
+        def root?
+          false
+        end
+
+        # No local identity exists across the crossing; used only for
+        # fail-closed comparisons (see Effects.run).
+        def euid
+          nil
+        end
+
+        def uid
+          nil
+        end
+
+        def gid
+          nil
+        end
+
+        def pid
+          nil
+        end
+
+        def ids
+          [nil, nil]
+        end
+
+        def user_ids(name)
+          return [Process.uid, Process.gid] if name.to_s == @identity
+
+          entry = Etc.getpwnam(name.to_s)
+          [entry.uid, entry.gid]
+        rescue ArgumentError
+          raise Lifecycle::Error, "unknown requester identity: #{name}"
+        end
+
+        def group_id(name)
+          Etc.getgrnam(name.to_s).gid
+        rescue ArgumentError
+          raise Lifecycle::Error, "unknown group identity: #{name}"
+        end
+      end
+    end
+  end
+end

data/lib/ace/hitl/lifecycle/service.rb

@@ -7,6 +7,7 @@ require_relative "protocol"
 require_relative "peer"
 require_relative "store"
 require_relative "otp_vault"
+require_relative "frame_serving"
 
 module Ace
   module Hitl
@@ -22,7 +23,12 @@ module Ace
       # nowhere, transfer exactly once, and die with the challenge or
       # the service.
       class Service
+        include FrameServing
+
         DEFAULT_SOCKET_MODE = 0o660
+        BROAD_CONTROL_GROUPS = [Store::DEFAULT_GROUP].freeze
+        LEGACY_SHARED_SOCKET_DIRECTORIES = ["/run/lab"].freeze
+        LEGACY_LABD_SOCKET = "labd.sock"
         # An idle connection holds a thread; bounded idleness keeps a
         # wedged peer from pinning the service (review 8x327buo).
         DEFAULT_IDLE_SECONDS = 120.0
@@ -118,28 +124,14 @@ module Ace
         # multi-UID acceptance fixture uses to drive real peers through
         # the real dispatch path.
         def serve_connection(socket)
-          peer = authenticate!(socket)
-          store = store_for(peer)
-          loop do
-            line = read_frame(socket)
-            break if line.nil?
-
-            response = dispatch(store, line)
-            write_frame(socket, response)
-          end
-        rescue Lifecycle::Error => e
-          write_frame(socket, Protocol.encode_error(e)) rescue nil
-        rescue SystemCallError, IOError
-          nil
-        ensure
-          socket.close rescue nil
+          super
         end
 
         private
 
         def prepare!
           begin
-            group_id = Etc.getgrnam(@group).gid
+            group_id = verify_control_group!
             verify_socket_directory!
             acquire_endpoint_lock!
             recover_stale_endpoint!
@@ -193,16 +185,39 @@ module Ace
         # must exist, must not be world-writable, and must be owned by
         # the service identity or root — otherwise anyone who can replace
         # the socket can impersonate the service.
+        def verify_control_group!
+          # Named broad groups are forbidden even on a host where that
+          # deployment group has not been created yet.
+          group = Etc.getgrnam(@group) unless BROAD_CONTROL_GROUPS.include?(@group)
+          if group.nil? || group.gid.zero? || BROAD_CONTROL_GROUPS.include?(group.name)
+            raise TransportError,
+              "HITL boundary control group is too broad: #{@group} " \
+              "(configure a dedicated lifecycle group; root and #{Store::DEFAULT_GROUP} are refused)"
+          end
+
+          group.gid
+        end
+
         def verify_socket_directory!
           dir = File.dirname(@socket_path)
+          expanded_dir = File.expand_path(dir)
+          if LEGACY_SHARED_SOCKET_DIRECTORIES.include?(expanded_dir)
+            raise TransportError,
+              "HITL boundary socket directory is shared with legacy labd: #{dir} " \
+              "(configure a dedicated lifecycle directory)"
+          end
+
           FileUtils.mkdir_p(dir)
           stat = File.lstat(dir)
-          return if (stat.uid.zero? || stat.uid == Process.uid) && (stat.mode & 0o002).zero?
+          protected_directory = (stat.uid.zero? || stat.uid == Process.uid) && (stat.mode & 0o002).zero?
+          legacy_socket = File.join(dir, LEGACY_LABD_SOCKET)
+          legacy_socket_exists = File.exist?(legacy_socket) || File.symlink?(legacy_socket)
+          return if protected_directory && !legacy_socket_exists
 
           raise TransportError,
             "HITL boundary socket directory is not protected: #{dir} " \
             "(use a dedicated service/root-owned, non-world-writable directory; " \
-            "do not share a directory containing unrelated service sockets)"
+            "do not share a directory containing unrelated service sockets or legacy labd)"
         end
 
         def authenticate!(socket)
@@ -238,63 +253,6 @@ module Ace
           )
         end
 
-        # One request frame per dispatch; lifecycle failures return
-        # classified error frames, transport/frame failures close the
-        # connection (serve_connection's rescues).
-        def dispatch(store, line)
-          request = Protocol.decode_request(line)
-          result = execute(store, request[:op], request[:params])
-          Protocol.encode_result(result)
-        rescue Protocol::FrameError, Lifecycle::Error, ArgumentError, TypeError => e
-          Protocol.encode_error(e)
-        end
-
-        def execute(store, op, params)
-          case op
-          when "ping" then {"pong" => true}
-          when "proposal-create" then store.proposal_create(**symbolize(params))
-          when "proposal-show" then store.proposal_show(required(params, "id"), project: required(params, "project"), history_after: params.fetch("history_after", 0))
-          when "proposal-revise" then store.proposal_revise(required(params, "id"), project: required(params, "project"), expected_revision: required(params, "expected_revision"),
-            operation_id: required(params, "operation_id"), document: required(params, "document"))
-          when "proposal-ack"
-            store.proposal_acknowledge(required(params, "id"), project: required(params, "project"), submitted_at: required(params, "submitted_at"))
-          when "proposal-reply"
-            store.proposal_reply(required(params, "id"), project: required(params, "project"), answer: required(params, "answer"),
-              received_at: required(params, "received_at"), sequence: required(params, "sequence"))
-          when "proposal-reconcile"
-            store.proposal_reconcile(required(params, "id"), project: required(params, "project"), checkpoint: required(params, "checkpoint"))
-          when "proposal-wake" then store.proposal_wake(project: required(params, "project"), after: params["after"])
-          when "proposal-due" then store.proposal_due(project: required(params, "project"), after: params["after"])
-          when "proposal-history" then store.proposal_history(project: required(params, "project"),
-            query: params.fetch("query", ""), after: params["after"])
-          when "create" then store.create(**symbolize(params))
-          when "read" then store.read(required(params, "id"))
-          when "deliver" then store.deliver(required(params, "id"), answer_reader(params))
-          when "consume"
-            store.consume(required(params, "id"), timeout: Integer(params["timeout"] || 0),
-              operation: params["operation"], native_delivery: params.fetch("native_delivery", false))
-          when "cancel" then store.cancel(required(params, "id"), reason: params["reason"].to_s)
-          when "pending" then store.pending_page(project: params["project"], after: params["after"])
-          when "states" then store.states
-          end
-        end
-
-        def symbolize(params)
-          params.transform_keys { |key| key.to_sym }
-        end
-
-        def required(params, key)
-          value = params[key]
-          raise Protocol::FrameError, "boundary parameter '#{key}' is required" if value.nil? || value.to_s.empty?
-
-          value
-        end
-
-        def answer_reader(params)
-          answer = params["answer"].to_s
-          ->(limit) { answer[0, limit] }
-        end
-
         # Keep one stable lock inode for the endpoint. Holding the lock
         # through shutdown prevents simultaneous starters from recovering
         # or replacing a socket another invocation is still acquiring.
@@ -344,37 +302,10 @@ module Ace
           nil
         end
 
-        def read_frame(socket)
-          data = +""
-          loop do
-            ready = IO.select([socket], nil, nil, @idle_seconds)
-            return nil unless ready
-
-            chunk = socket.read_nonblock(4096, exception: false)
-            return nil if chunk.nil?
-            next sleep(0.01) if chunk == :wait_readable
-
-            data << chunk
-            if data.bytesize > Protocol::MAX_FRAME_BYTES
-              write_frame(socket, Protocol.encode_error(Protocol::FrameError.new("request frame is too large"))) rescue nil
-              return nil
-            end
-            return data if data.include?("\n")
-          end
-        end
-
-        def write_frame(socket, frame)
-          socket.write(frame)
-          socket.flush
-        end
-
         def root_store
           Store.new(root: @root, binding: @binding, policy: @policy, group: @group)
         end
 
-        def log(message)
-          @logger&.call("[ace-hitl] #{message}")
-        end
       end
     end
   end