ace-hitl 0.15.0 → 0.16.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '0827bd8ade04c613021128ac335a1d0fea74d5954e718122bd243a780bebb675'
-  data.tar.gz: df48a9612ca6a87670142ee8f511a837e206af2294a1a609be8045bfc14c1830
+  metadata.gz: 6d2bae48cdaf02e617f52c254eb78f5a8dae316be06a8787d4282041c01eacc3
+  data.tar.gz: 81410404b3ad0e07900497a9f62594aba56aaf987ed2d816d208bcab112b096c
 SHA512:
-  metadata.gz: b0f0b827b307e8baf05a25c9503455fde43c8734e121f7d3f5f222a4d0a0aa201653bb346366fd6b8445c700031113068ff133cf24e4566b825e4bf59633f622
-  data.tar.gz: 462e2cef1a68a7a4a3975b96b324977223101a53ba384940875197e61c103054d3e52cbb83d4337f98aea0f5c92dfd306d0c372caa61e2bd8ab20517aca73cf3
+  metadata.gz: e5ad8fad6083826ca4f1fb6220d7bf87bd302482bbbe946cc93778bf83279d3cf728898e9f2c9bb286ebac9e98a278b5129ab3914d1ee7b354c2befd07400129
+  data.tar.gz: 1b0bae700322c0fae15a9f6ab81a7efd5faad863db9f729115909c95e66087be26b2217ad037e5e21ea3a7e7dc7bd418afa3dd1b01654f8f5fcda36007fd5b3d

data/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.16.0] - 2026-10-16
+
+### Added
+
+- Require explicit predelegation for sixteen-hour proposal decisions and bind ordinary project proposals to the selected canonical owner. Refresh project and owner grants at transitions and replay; compose existing Unix/TLS listeners under the authority lifetime.
+
+### Fixed
+
+- Read TLS authority configuration through bounded protected descriptors, rejecting symlinks, unsafe ancestors, special files and concurrent replacement before startup. Declare the direct Runtime dependency used by this reader.
+
 ## [0.15.0] - 2026-10-14
 
 ### Added

data/docs/usage.md

@@ -358,8 +358,11 @@ The JSON proposal requires operation, target (`resource` and optional `artifact_
 candidate_head, input_digest, context, options, recommendation and prerequisites; rationale
 is optional. Contents are bounded and non-secret. Input digest uses the canonical service
 input digest. Candidate head is separate from base head and the evidence journal commit.
-Every precisely presented operation is eligible for sixteen-hour silence, including
-publishing, deployment and access/privilege expansion. Fixed service scope, current head,
+Only operation classes explicitly delegated in trusted project policy are eligible
+for sixteen-hour silence. Delegation must exist when the revision is created and
+remain current at the deadline; a later grant cannot approve an older revision.
+Without delegation the proposal still accepts an explicit correlated decision.
+Fixed service scope, current head,
 independently executed review/tests, bound running attempt and operation-specific OTP gates
 still apply at execution. Proposal authorization never supplies credentials or runs a callback.
 
@@ -423,6 +426,8 @@ hitl:
   service_uid: 1200
   transport_uids: [1201]
   proposal_uids: [1202]
+  silence_operations:
+    ace: [merge]
 authorization:
   principals:
     "1201":
@@ -438,6 +443,11 @@ resolve silence. Missing role or project admission refuses the operation,
 including direct library calls. This is a source configuration contract;
 installed deployment adoption remains part of gad.8 acceptance.
 
+`silence_operations` is an exact project-to-operation list, with no wildcards or
+implicit publish/deploy/access grants. It never expands command or credential
+authority. TLS authorities read the same trusted grants document selected by
+`--grants-path`; certificate authentication alone grants no silence decision.
+
 ### Controlled installed proposal verification
 
 From an ACE checkout with Ruby, tmux and the complete dependency archives cached locally:

data/lib/ace/hitl/cli/commands/serve.rb

@@ -69,6 +69,7 @@ module Ace
               binding: binding_policy,
               project: authority.project_id,
               credential: authority.credential,
+              decision_policy: Providers::Lab.grants_policy(grants_path: grants_path(options)),
               ssl_context: authority.ssl_context!,
               listen: authority.listen,
               port: authority.port,

data/lib/ace/hitl/lifecycle/policy.rb

@@ -105,6 +105,14 @@ module Ace
         def proposal?(_peer, project:)
           false
         end
+
+        def proposal_silence?(caller_uid:, requester:, project:, operation:)
+          false
+        end
+
+        def silence_operation?(project:, operation:)
+          false
+        end
         # @return [Boolean] true when the peer may deliver answers and
         #   observe pending/states for the given project
         def transport?(_peer, project: nil)
@@ -151,13 +159,36 @@ module Ace
         # an ordinary requester or transport grant.
         def proposal?(peer, project:)
           current = document
+          proposal_principal?(peer.uid, project, current)
+        end
+
+        # A proposer grant allows asking. Only this separate, exact project
+        # operation list delegates a decision after the acknowledged window.
+        def proposal_silence?(caller_uid:, requester:, project:, operation:)
+          current = document
+          proposal_principal?(caller_uid, project, current) &&
+            delegated_operation?(project, operation, current)
+        end
+
+        def silence_operation?(project:, operation:)
+          delegated_operation?(project, operation, document)
+        end
+
+        private
+
+        def proposal_principal?(uid, project, current)
           uids = hitl_facts(current)["proposal_uids"]
-          projects = authorized_projects(peer.uid, current)
-          uids.is_a?(Array) && uids.include?(peer.uid) && projects &&
+          projects = authorized_projects(uid, current)
+          uid.is_a?(Integer) && uids.is_a?(Array) && uids.include?(uid) && projects &&
             (projects.empty? || projects.include?(project.to_s))
         end
 
-        private
+        def delegated_operation?(project, operation, current)
+          delegations = hitl_facts(current)["silence_operations"]
+          operations = delegations.is_a?(Hash) && delegations[project]
+          operations.is_a?(Array) && operation.is_a?(String) &&
+            operation.match?(/\A[a-z][a-z0-9-]{0,63}\z/) && operations.include?(operation)
+        end
 
         def document
           @document || TrustedFile.read_yaml(@grants_path) || {}

data/lib/ace/hitl/lifecycle/proposals.rb

@@ -54,6 +54,7 @@ module Ace
           claims = proposal_journal(project).proposal_claims(record["revision_id"])
           claim = claims.last
           outcome = case claim && claim["state"]
+          when "pending" then "queued"
           when "accepted" then "executing"
           when "succeeded" then "succeeded"
           when "failed", "failed-settled", "rejected" then "failed"
@@ -88,6 +89,7 @@ module Ace
           record = proposal_for_request!(request, project: project)
           require_transport!("proposal reconciliation", {"project" => record["project_id"]})
           proposal_transition(record) do |current|
+            next current unless silence_delegated?(current)
             Ace::Hitl::Proposals::Policy.resolve(current, checkpoint: checkpoint, now: proposal_now)
           end
         end
@@ -136,6 +138,11 @@ module Ace
 
         private
 
+        def silence_delegated?(record)
+          @policy.proposal_silence?(caller_uid: record["caller_uid"], requester: record["requester"],
+            project: record["project_id"], operation: record["operation"])
+        end
+
         def require_proposer!(project)
           unless @policy.respond_to?(:proposal?) && @policy.proposal?(@identity, project: project)
             raise PermissionError, "proposal requires the installed second-commander decision principal"
@@ -189,6 +196,8 @@ module Ace
         def proposal_transition(record, &policy)
           proposal_journal(record.fetch("project_id")).change_proposal(record["proposal_id"], assignment_id: record["assignment_id"],
             attempt_id: record["attempt_id"]) do |current|
+            # Selection may change while waiting for the canonical ref lock.
+            proposal_journal(record.fetch("project_id"))
             # A reply to an older revision cannot modify the new decision.
             next current unless current["request_id"] == record["request_id"]
             policy.call(current)
@@ -203,6 +212,7 @@ module Ace
           replay = nil
           record = @binding.with_active(assignment: assignment, attempt: attempt, project: project, requester: @identity.username) do
             proposal_journal(project).change_proposal(id, assignment_id: assignment, attempt_id: attempt) do |previous|
+              proposal_journal(project)
               if operation_id
                 replay = proposal_revision_replay(id, expected_revision, operation_id, content, project: project)
                 next previous if replay
@@ -228,6 +238,8 @@ module Ace
                 "attempt_id" => attempt, "project_id" => project, "requester" => @identity.username,
                 "caller_uid" => @identity.uid, "content_digest" => Digest::SHA256.hexdigest(JSON.generate(content)),
                 "state" => "awaiting-delivery", "created_at" => proposal_now,
+                "silence_delegated" => @policy.proposal_silence?(caller_uid: @identity.uid,
+                  requester: @identity.username, project: project, operation: content.fetch("operation")),
                 "authorization" => request, "lifecycle_request" => projection).tap do |value|
                   if operation_id
                     value["revision_operation_id"] = operation_id

data/lib/ace/hitl/lifecycle/service.rb

@@ -186,10 +186,12 @@ module Ace
         # the service identity or root — otherwise anyone who can replace
         # the socket can impersonate the service.
         def verify_control_group!
-          group = Etc.getgrnam(@group)
-          if group.gid.zero? || BROAD_CONTROL_GROUPS.include?(group.name)
+          # Named broad groups are forbidden even on a host where that
+          # deployment group has not been created yet.
+          group = Etc.getgrnam(@group) unless BROAD_CONTROL_GROUPS.include?(@group)
+          if group.nil? || group.gid.zero? || BROAD_CONTROL_GROUPS.include?(group.name)
             raise TransportError,
-              "HITL boundary control group is too broad: #{group.name} " \
+              "HITL boundary control group is too broad: #{@group} " \
               "(configure a dedicated lifecycle group; root and #{Store::DEFAULT_GROUP} are refused)"
           end
 

data/lib/ace/hitl/lifecycle/tls_access_policy.rb

@@ -10,8 +10,9 @@ module Ace
       # even when issued by the same CA, and no operation against any
       # other project is reachable through this authority.
       class TlsAccessPolicy < AccessPolicy
-        def initialize(project:)
+        def initialize(project:, decision_policy: AccessPolicy.new)
           @project = project.to_s
+          @decision_policy = decision_policy
         end
 
         def transport?(peer, project: nil)
@@ -22,6 +23,16 @@ module Ace
           transport?(peer, project: project)
         end
 
+        def proposal_silence?(caller_uid:, requester:, project:, operation:)
+          return false unless project == @project
+          # The transport peer is authenticated separately. A local proposal
+          # retains its original kernel principal when Hermes reconciles it.
+          return @decision_policy.proposal_silence?(caller_uid: caller_uid, requester: requester,
+            project: project, operation: operation) unless caller_uid.nil?
+          requester == "urn:ace:hitl:#{@project}:hermes-client" &&
+            @decision_policy.silence_operation?(project: project, operation: operation)
+        end
+
         # A TLS authority has no Unix service uid; client endpoint
         # verification is certificate-based.
         def service_uid

data/lib/ace/hitl/lifecycle/tls_authority.rb

@@ -2,6 +2,7 @@
 
 require "ipaddr"
 require "json"
+require "ace/runtime/molecules/protected_artifact_set"
 require_relative "tls_credentials"
 require_relative "credential_path_policy"
 require_relative "tls_material"
@@ -22,16 +23,24 @@ module Ace
         SCHEMA = "ace.hitl.tls.authority/v1"
         FIELDS = %w[schema project_id listen port service_user service_group
           tls_server_credential].freeze
+        MAX_BYTES = 65_536
 
         attr_reader :project_id, :listen, :port, :service_user, :service_group,
           :credential, :path
 
         def self.load(path)
-          config = JSON.parse(File.read(path))
-          authority = new(config, path: path)
-          CredentialPathPolicy.verify_runtime_file!(path, authority.service_group)
-          authority
-        rescue JSON::ParserError, SystemCallError, IOError
+          reader = Ace::Runtime::Molecules::ProtectedArtifactSet.new(file_limit: MAX_BYTES, total_limit: MAX_BYTES)
+          reader.with do |held|
+            bytes, = held.read_path!(path)
+            config = JSON.parse(bytes, create_additions: false, allow_duplicate_key: false, max_nesting: 16)
+            authority = new(config, path: path)
+            CredentialPathPolicy.verify_runtime_file!(path, service_group: authority.service_group)
+            # Exact mode/group validation and parsing must refer to the same
+            # bounded protected inode, including every retained ancestor.
+            held.verify_unchanged!
+            authority
+          end
+        rescue JSON::ParserError, SystemCallError, IOError, Ace::Runtime::Error
           raise TransportError, "the HITL TLS authority configuration is unavailable or malformed: #{path}"
         end
 

data/lib/ace/hitl/lifecycle/tls_service.rb

@@ -35,7 +35,7 @@ module Ace
 
         def initialize(root:, binding:, project:, credential:, ssl_context:,
           listen: "127.0.0.1", port:, group: Store::DEFAULT_GROUP, vault: nil, logger: nil,
-          idle_seconds: DEFAULT_IDLE_SECONDS, proposal_clock: -> { Time.now.utc })
+          idle_seconds: DEFAULT_IDLE_SECONDS, proposal_clock: -> { Time.now.utc }, decision_policy: AccessPolicy.new)
           @root = root
           @binding = binding
           @project = TlsCredentials.project_id(project)
@@ -48,6 +48,7 @@ module Ace
           @logger = logger
           @idle_seconds = idle_seconds
           @proposal_clock = proposal_clock
+          @policy = TlsAccessPolicy.new(project: @project, decision_policy: decision_policy)
           @max_connections = MAX_CONNECTIONS
           @connections = 0
           @handler_threads = []
@@ -223,7 +224,7 @@ module Ace
             Store.new(
               root: @root,
               binding: @binding,
-              policy: TlsAccessPolicy.new(project: @project),
+              policy: @policy,
               identity: peer,
               vault: @vault,
               proposal_clock: @proposal_clock, stopping: -> { @stopping }, group: @group
@@ -233,7 +234,7 @@ module Ace
         end
 
         def root_store
-          Store.new(root: @root, binding: @binding, policy: TlsAccessPolicy.new(project: @project), group: @group)
+          Store.new(root: @root, binding: @binding, policy: @policy, group: @group)
         end
       end
     end

data/lib/ace/hitl/proposals/policy.rb

@@ -108,6 +108,7 @@ module Ace
 
         def resolve(record, checkpoint:, now:)
           return record unless record["state"] == "awaiting-decision"
+          return record unless record["silence_delegated"] == true
           return record if timestamp(now) < timestamp(record.fetch("deadline"))
           valid = checkpoint["schema"] == "ace.hitl.hermes.ingress-checkpoint/v1" &&
             checkpoint["request"] == record["request_id"] && checkpoint["revision"] == record["revision_id"] &&

data/lib/ace/hitl/providers/lab/assignment_binding.rb

@@ -16,9 +16,14 @@ module Ace
         # authority. Every doubt maps to the classified BindingError —
         # unknown identity/authority is an error, never permission.
         class AssignmentBinding < Lifecycle::Binding
-          def initialize(coordinator: nil, repo_root: nil)
+          def initialize(coordinator: nil, repo_root: nil, project: nil, owner_guard: nil)
+            unless (project.nil? && owner_guard.nil?) ||
+                (project.is_a?(String) && !project.empty? && owner_guard.respond_to?(:call))
+              raise ArgumentError, "installed binding needs both a fixed project and its owner guard"
+            end
             @coordinator = coordinator
             @repo_root = repo_root
+            @project, @owner_guard = project, owner_guard
           end
 
           def validate_request(assignment:, attempt:, project:, requester:, caller_pid: nil)
@@ -30,6 +35,7 @@ module Ace
           # Read-only owner verification can run inside an already-held
           # assignment exclusion without reacquiring that exclusion.
           def reverse_address(assignment:, attempt:, project:, caller_pid:)
+            verify_selection!(project)
             unless caller_pid.is_a?(Integer) && caller_pid.positive?
               raise Lifecycle::BindingError, "kernel requester process identity is unavailable"
             end
@@ -49,15 +55,26 @@ module Ace
             unless project.is_a?(String) && !project.empty?
               raise Lifecycle::BindingError, "proposal requires an explicit project"
             end
+            verify_selection!(project)
             coordinator.send(:journal_for)
           end
 
           def proposal_projects
+            if @project
+              verify_selection!(@project)
+              return [@project]
+            end
             coordinator.send(:journal_for).proposals.map { |record| record.fetch("project_id") }.uniq.sort
           end
 
           private
 
+          def verify_selection!(project)
+            return unless @project
+            raise Lifecycle::BindingError, "project differs from installed HITL owner" unless project == @project
+            @owner_guard.call
+          end
+
           def with_verified(assignment_id, attempt_id, project_id, requester)
             # ONLY the authority verification is error-mapped: the
             # caller's transition (answer hand-off, commits, effects)
@@ -66,12 +83,14 @@ module Ace
             # failure (review 8x327bud). The exclusion still spans the
             # whole transition, so the phase flag separates the two.
             verifying = true
+            verify_selection!(project_id)
             coordinator.with_verified_attempt(
               assignment_id: assignment_id,
               attempt_id: attempt_id,
               project_id: project_id,
               requester: requester
             ) do |attempt|
+              verify_selection!(project_id)
               verifying = false
               yield attempt
             end

data/lib/ace/hitl/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Hitl
-    VERSION = "0.15.0"
+    VERSION = "0.16.0"
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-hitl
 version: !ruby/object:Gem::Version
-  version: 0.15.0
+  version: 0.16.0
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-14 00:00:00.000000000 Z
+date: 2026-10-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-hitl-contract
@@ -113,28 +113,42 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.67'
+        version: '0.70'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.67'
+        version: '0.70'
 - !ruby/object:Gem::Dependency
   name: ace-herdr
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.1
+        version: '0.6'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.1
+        version: '0.6'
+- !ruby/object:Gem::Dependency
+  name: ace-runtime
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.3'
 description: Provides the dedicated ace-hitl package surface for human in the loop
   (HITL) semantics and CLI workflows.
 email: