ace-hitl 0.9.0 → 0.10.0

data/lib/ace/hitl/cli/commands/pending.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require "ace/support/cli"
+require_relative "lifecycle_command"
+
+module Ace
+  module Hitl
+    module CLI
+      module Commands
+        # Host-broker listing of answerable relay requests; never purges
+        # or cancels anything (W651).
+        class Pending < Ace::Support::Cli::Command
+          include Ace::Support::Cli::Base
+          include LifecycleCommand
+
+          desc "List answerable HITL relay requests (host-broker operation)"
+
+          option :quiet, type: :boolean, aliases: %w[-q], desc: "Suppress non-essential output"
+
+          def call(**options)
+            emit(lifecycle_store.pending)
+          rescue Lifecycle::Error => e
+            raise_lifecycle_error(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/hitl/cli/commands/states.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require "ace/support/cli"
+require_relative "lifecycle_command"
+
+module Ace
+  module Hitl
+    module CLI
+      module Commands
+        # Host-broker listing of all public lifecycle projections.
+        class States < Ace::Support::Cli::Command
+          include Ace::Support::Cli::Base
+          include LifecycleCommand
+
+          desc "List public HITL lifecycle projections (host-broker operation)"
+
+          option :quiet, type: :boolean, aliases: %w[-q], desc: "Suppress non-essential output"
+
+          def call(**options)
+            emit(lifecycle_store.states)
+          rescue Lifecycle::Error => e
+            raise_lifecycle_error(e.message)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/hitl/cli/commands/wait.rb

@@ -55,11 +55,11 @@ module Ace
               lab_request_id = event.metadata["lab_request_id"]
               puts "Lab request delivered: #{event.id} (#{result[:lab_state]})"
               puts "Lab request: #{lab_request_id}"
-              puts "Consume the answer when ready: lab-hitl consume #{lab_request_id}"
+              puts "Consume the answer when ready from the lab relay."
               if result[:lab_state] == "callback-ok"
                 puts "Effect callback: ok"
               elsif result[:lab_state] == "callback-escalated"
-                puts "Effect callback: escalated; inspect with: lab-hitl duty"
+                puts "Effect callback: escalated; inspect the lab duty projection"
               end
             when :timeout
               raise Ace::Support::Cli::Error.new("Timed out waiting for HITL event '#{ref}'")

data/lib/ace/hitl/cli.rb

@@ -8,6 +8,15 @@ require_relative "cli/commands/show"
 require_relative "cli/commands/list"
 require_relative "cli/commands/update"
 require_relative "cli/commands/wait"
+require_relative "cli/commands/deliver"
+require_relative "cli/commands/consume"
+require_relative "cli/commands/cancel"
+require_relative "cli/commands/pending"
+require_relative "cli/commands/states"
+require_relative "cli/commands/duty"
+require_relative "cli/commands/overseer_send"
+require_relative "cli/commands/overseer_pending"
+require_relative "cli/commands/overseer_ack"
 
 module Ace
   module Hitl
@@ -22,7 +31,16 @@ module Ace
         ["show", "Show HITL event details"],
         ["list", "List HITL events"],
         ["update", "Update HITL event metadata or answer"],
-        ["wait", "Wait for an answer on a specific HITL event"]
+        ["wait", "Wait for an answer on a specific HITL event"],
+        ["deliver", "Deliver an answer (stdin) to a pending HITL relay request"],
+        ["consume", "Wait for and consume the answer of one own HITL relay request"],
+        ["cancel", "Cancel one HITL relay request with an audited reason"],
+        ["pending", "List answerable HITL relay requests (host-broker)"],
+        ["states", "List public HITL lifecycle projections (host-broker)"],
+        ["duty", "Project pending and escalated HITL requests (host-broker)"],
+        ["overseer-send", "Queue a bounded, type-tagged Overseer response (stdin)"],
+        ["overseer-pending", "List queued Overseer responses (host-broker)"],
+        ["overseer-ack", "Acknowledge one relayed Overseer response"]
       ].freeze
 
       HELP_EXAMPLES = [
@@ -40,6 +58,15 @@ module Ace
       register "list", CLI::Commands::List
       register "update", CLI::Commands::Update
       register "wait", CLI::Commands::Wait
+      register "deliver", CLI::Commands::Deliver
+      register "consume", CLI::Commands::Consume
+      register "cancel", CLI::Commands::Cancel
+      register "pending", CLI::Commands::Pending
+      register "states", CLI::Commands::States
+      register "duty", CLI::Commands::Duty
+      register "overseer-send", CLI::Commands::OverseerSend
+      register "overseer-pending", CLI::Commands::OverseerPending
+      register "overseer-ack", CLI::Commands::OverseerAck
 
       version_cmd = Ace::Support::Cli::VersionCommand.build(
         gem_name: "ace-hitl",

data/lib/ace/hitl/lifecycle/atomic_json.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require "json"
+require "fileutils"
+require "securerandom"
+
+module Ace
+  module Hitl
+    module Lifecycle
+      # Durable, permission-preserving JSON record writes (port of
+      # atomic_json): O_EXCL|O_NOFOLLOW tempfile in the target directory,
+      # fsync, chmod, chown, rename. Ownership transitions go through the
+      # injectable ownership strategy; production performs real chown(2),
+      # tests map names onto the current identity (spec 8wm.t.y21 §2).
+      module AtomicJson
+        Ownership = Struct.new(:uid, :gid)
+
+        DEFAULT_OWNERSHIP = Object.new.tap do |strategy|
+          strategy.define_singleton_method(:chown) do |path, ownership|
+            File.chown(ownership.uid, ownership.gid, path) if ownership
+          end
+        end.freeze
+
+        module_function
+
+        # mode is an Integer permission bits value; ownership nil keeps
+        # the current identity. exclusive commits with link(2) instead of
+        # rename(2), so an existing destination raises Errno::EEXIST
+        # instead of being silently replaced (create-once writes).
+        def call(path, value, mode:, ownership: nil, ownership_strategy: DEFAULT_OWNERSHIP,
+          exclusive: false)
+          path = Pathname.new(path)
+          path.parent.mkpath
+          # The random suffix makes the temporary unique per invocation:
+          # a fixed pid-based name lets a competing writer's cleanup
+          # delete our in-flight temporary and fail both writes (review
+          # 8wq2zttt on PR#336). Cleanup only ever touches this call's
+          # own file.
+          temporary = path.parent.join(".#{path.basename}.tmp.#{$PROCESS_ID}.#{SecureRandom.hex(4)}")
+          flags = File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW
+          fd = IO.sysopen(temporary, flags, mode)
+          begin
+            io = IO.for_fd(fd, mode: "w")
+            begin
+              io.write(JSON.generate(value))
+              io.write("\n")
+              io.flush
+              io.fsync
+            ensure
+              io.close
+            end
+          rescue
+            begin
+              temporary.unlink
+            rescue
+              nil
+            end
+            raise
+          end
+          File.chmod(mode, temporary)
+          ownership_strategy.chown(temporary, ownership)
+          if exclusive
+            File.link(temporary, path)
+          else
+            File.rename(temporary, path)
+          end
+        ensure
+          temporary.unlink if temporary&.exist?
+        end
+
+        def read(path)
+          JSON.parse(File.read(path))
+        rescue SystemCallError, JSON::ParserError
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/ace/hitl/lifecycle/binding.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Ace
+  module Hitl
+    module Lifecycle
+      # The binding seam between the generic request lifecycle and the
+      # domain that owns Work/Attempt liveness and attribution (spec
+      # 8wm.t.y21 §1). The store REQUIRES a binding; the generic core
+      # never carries Work/Attempt semantics itself.
+      #
+      # Implementations must fail closed: any doubt raises BindingError.
+      class Binding
+        # Validate a request creation against the requester's exact live
+        # attempt. Raises BindingError on any violation or unavailability.
+        def validate_request(work:, attempt:, project:, requester:)
+          raise NotImplementedError
+        end
+
+        # Re-verify that the attempt is still live before an answer is
+        # delivered or consumed. Raises BindingError when terminal.
+        def require_active(work:, attempt:)
+          raise NotImplementedError
+        end
+      end
+    end
+  end
+end

data/lib/ace/hitl/lifecycle/duty.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require_relative "errors"
+
+module Ace
+  module Hitl
+    module Lifecycle
+      # The standing-duty projection (spec 8wm.t.y21 §7; contract of the
+      # deployed hitl_status/duty surface): pending answerable requests
+      # with their effect declaration visibility, plus everything the
+      # effect layer has escalated. Root-only, like the store reads it
+      # projects from.
+      module Duty
+        module_function
+
+        def project(store)
+          store.require_root!("duty")
+          {
+            "pending" => store.pending.map { |value| pending_entry(value) },
+            "escalated" => store.states.select do |record|
+              record["effect_state"] == Effects::OUTCOME_ESCALATED
+            end
+          }
+        end
+
+        def pending_entry(value)
+          {
+            "id" => value["id"],
+            "work" => value["work"],
+            "attempt" => value["attempt"],
+            "project" => value["project"],
+            "harness" => value["harness"],
+            "kind" => value["kind"],
+            "state" => "created",
+            "requester" => value["requester"],
+            "created_at" => value["created_at"],
+            "has_effect" => value["effect"].is_a?(Hash) && Array(value["effect"]["argv"]).any?
+          }
+        end
+      end
+    end
+  end
+end

data/lib/ace/hitl/lifecycle/effects.rb

@@ -0,0 +1,254 @@
+# frozen_string_literal: true
+
+require "json"
+require_relative "errors"
+require_relative "../atoms/hitl_effect_validator"
+
+module Ace
+  module Hitl
+    module Lifecycle
+      # The requester-declared answer-effect layer (spec 8wm.t.y21 §5;
+      # recovered from the deployed 8wl.t.ga9 contract). A request may
+      # declare a callback that executes exactly once when the answer
+      # arrives — always AFTER the answer is relayed — AS THE REQUESTER,
+      # through exec-style argv (a shell never sees the answer). The
+      # answer content and the substituted argv never appear in any log;
+      # full attempts live only in the root-only effects log.
+      module Effects
+        DEFAULT_TIMEOUT_S = 120
+        TERMINATE_GRACE_SECONDS = 0.2
+        OUTCOME_OK = "callback-ok"
+        OUTCOME_ESCALATED = "callback-escalated"
+
+        # A Lifecycle::Error so every lifecycle caller's typed rescue
+        # (notably the provider seam's orphan-event ask wrapper) catches
+        # declaration violations instead of a raw backtrace escaping to
+        # the CLI (review F-R1 on W696).
+        DeclarationError = Class.new(Lifecycle::Error)
+
+        module_function
+
+        # Validated by Atoms::HitlEffectValidator at the CLI boundary;
+        # the store re-applies the declaration checks so direct API use
+        # cannot bypass the bounds. Declarations are never rewritten.
+        def validate_declaration!(effect)
+          match = effect[:match]&.to_s
+          cwd = (effect[:cwd] || effect[:effect_cwd])&.to_s
+          # cwd is a required declaration field (spec §5: {argv:, cwd:,
+          # match:, timeout_s:}). A cwd-less declaration would otherwise
+          # pass validation and fail at answer time as a misleading
+          # Errno::ENOENT spawn escalation (review F-A on W696).
+          if cwd.nil? || cwd.strip.empty?
+            raise DeclarationError,
+              "--effect-cwd is required for an effect callback (absolute path to an existing directory)"
+          end
+          Atoms::HitlEffectValidator.validate!(
+            match: match,
+            effect_args: Array(effect[:effect_args] || effect[:argv]).map(&:to_s),
+            effect_cwd: cwd,
+            effect_timeout: (effect[:timeout_s] || effect[:effect_timeout]).to_s
+          )
+        rescue Atoms::HitlEffectValidator::ValidationError => e
+          raise DeclarationError, e.message
+        end
+
+        # The persisted record shape, byte-compatible with the deployed
+        # contract: {argv:, cwd:, match:, timeout_s:}.
+        def normalized_declaration(effect)
+          timeout = effect[:timeout_s] || effect[:effect_timeout] || DEFAULT_TIMEOUT_S
+          {
+            "argv" => Array(effect[:effect_args] || effect[:argv]).map(&:to_s),
+            "cwd" => (effect[:cwd] || effect[:effect_cwd]).to_s,
+            "match" => effect[:match]&.to_s,
+            "timeout_s" => Integer(timeout)
+          }
+        end
+
+        # Executed inside deliver's locked critical section, after the
+        # answer is relayed. Exactly one attempt; failure escalates once.
+        def run(store, value, answer, requester_uid:, requester_gid:, identity: Identity,
+          spawner: Process, group_dropper: nil)
+          declaration = value["effect"]
+          return nil unless declaration.is_a?(Hash) && Array(declaration["argv"]).any?
+
+          if !identity.root? && requester_uid != identity.euid
+            raise Lifecycle::PermissionError,
+              "effect callback requires the requester's identity and root authority to drop to it"
+          end
+
+          match_ok = declaration["match"].nil? || fullmatch?(declaration["match"], answer)
+          attempt = {
+            "at" => Time.now.to_i,
+            "match_ok" => match_ok,
+            "timed_out" => false,
+            "exit_status" => nil,
+            "duration_s" => nil
+          }
+          if match_ok
+            start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            begin
+              status, timed_out = execute(
+                declaration, answer, requester_uid, requester_gid, spawner,
+                group_dropper: group_dropper
+              )
+            rescue SystemCallError => e
+              # A spawn/wait failure (missing binary, non-executable
+              # argv, EPERM) must never escape deliver AFTER the answer
+              # was relayed: the operator signal would be silently lost.
+              # It is an escalation outcome exactly like a timeout or a
+              # nonzero exit (spec §5; review F2 on W696).
+              attempt["error"] = e.class.name
+              status = nil
+              timed_out = false
+            end
+            attempt["timed_out"] = timed_out
+            attempt["exit_status"] = status
+            attempt["duration_s"] = (Process.clock_gettime(Process::CLOCK_MONOTONIC) - start).round(3)
+          end
+          attempt["outcome"] = outcome_of(attempt)
+
+          record_effect_attempt(store, value, attempt)
+          effect_state = (attempt["outcome"] == "ok") ? OUTCOME_OK : OUTCOME_ESCALATED
+          value["effect_state"] = effect_state
+          store.update_public(value, "answer-delivered")
+          if effect_state == OUTCOME_ESCALATED
+            escalate_once(store, value, attempt)
+          end
+          effect_state
+        end
+
+        def outcome_of(attempt)
+          (attempt["match_ok"] && !attempt["timed_out"] && attempt["exit_status"] == 0) ? "ok" : "escalated"
+        end
+
+        # The root-only effects log: redacted attempts (no answer, no
+        # argv) plus the deduped escalation marker.
+        def record_effect_attempt(store, value, attempt)
+          store.effects_dir.mkpath
+          path = store.effects_dir.join("#{value["id"]}.json")
+          record = AtomicJson.read(path)
+          record = {"id" => value["id"], "attempts" => [], "escalated" => nil} unless record.is_a?(Hash)
+          record["attempts"] << attempt
+          if attempt["outcome"] != "ok" && record["escalated"].nil?
+            record["escalated"] = {"at" => Time.now.to_i, "outcome" => attempt["outcome"]}
+          end
+          AtomicJson.call(path, record, mode: 0o600)
+          nil
+        end
+
+        # The deduped escalation: recorded once per request in the
+        # effects log; the wake/spool glue stays behind the sink seam.
+        def escalate_once(store, value, attempt)
+          return if value["escalation_spooled"]
+
+          sink = store.escalation_sink
+          value["escalation_spooled"] = true
+          return unless sink
+
+          sink.call(
+            request_id: value["id"],
+            work: value["work"],
+            attempt: value["attempt"],
+            project: value["project"],
+            outcome: attempt["outcome"]
+          )
+        end
+
+        # Python re.fullmatch equivalent: the whole answer must match.
+        def fullmatch?(source, answer)
+          Regexp.new("\\A(?:#{source})\\z").match?(answer)
+        rescue RegexpError
+          false
+        end
+
+        # Exec-style spawn, never a shell. {answer} substitutes once per
+        # element as a plain string replace. Output is discarded
+        # (redaction). Process.spawn applies only setgid/setuid, so the
+        # supplementary-group drop happens around the spawn window (see
+        # drop_child_groups) and the forked child inherits the dropped
+        # list. Returns [exit_status, timed_out].
+        def execute(declaration, answer, requester_uid, requester_gid, spawner = Process,
+          group_dropper: nil)
+          group_dropper ||= method(:drop_child_groups)
+          # Block form: the answer is inserted literally. The
+          # replacement-string form would interpret backslash sequences
+          # in the answer as backreferences (review 8wq2ztty on PR#336).
+          argv = declaration["argv"].map { |element| element.gsub("{answer}") { answer } }
+          timeout = declaration["timeout_s"] || DEFAULT_TIMEOUT_S
+          deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout
+          status = nil
+          timed_out = false
+          group_dropper.call(requester_gid) do
+            # [cmd, cmd] forces exec/argv semantics: a single-element
+            # argv would otherwise be handed to a shell as a command
+            # string (review 8wq2ztu2 on PR#336), and a substituted
+            # answer must never become shell syntax.
+            #
+            # pgroup: true makes the child a process group leader so the
+            # timeout can signal its whole group (review 8wq2zttw on
+            # PR#336).
+            pid = spawner.spawn(
+              [argv.first, argv.first],
+              *argv.drop(1),
+              chdir: declaration["cwd"],
+              gid: requester_gid,
+              uid: requester_uid,
+              pgroup: true,
+              out: File::NULL,
+              err: File::NULL
+            )
+            loop do
+              _, status = spawner.waitpid2(pid, Process::WNOHANG)
+              break if status
+
+              if Process.clock_gettime(Process::CLOCK_MONOTONIC) > deadline
+                timed_out = true
+                # -pid addresses the process group: a callback that
+                # forked leaves no descendants running after the
+                # timeout. ESRCH means the group is already gone; macOS
+                # additionally raises EPERM when signaling a group whose
+                # only remaining members are zombies — both are fine,
+                # the direct child is reaped by the wait below.
+                begin
+                  spawner.kill("TERM", -pid)
+                rescue Errno::ESRCH, Errno::EPERM
+                end
+                sleep_after_terminate
+                begin
+                  spawner.kill("KILL", -pid)
+                rescue Errno::ESRCH, Errno::EPERM
+                end
+                _, status = spawner.waitpid2(pid)
+                break
+              end
+              sleep 0.05
+            end
+          end
+          [status&.exitstatus, timed_out]
+        end
+
+        # Supplementary-group isolation for the effect child (spec §5;
+        # review F7 on W696): spawn has no groups hook, so root swaps the
+        # process supplementary list for exactly the requester's group
+        # for the duration of the block and restores it afterwards; the
+        # child inherits the dropped list. A non-root process has nothing
+        # to drop and would hit EPERM, so it yields unchanged.
+        def drop_child_groups(gid)
+          return yield unless Process.euid.zero?
+
+          previous = Process.groups
+          Process::Sys.setgroups([gid])
+          begin
+            yield
+          ensure
+            Process::Sys.setgroups(previous)
+          end
+        end
+
+        def sleep_after_terminate
+          sleep(TERMINATE_GRACE_SECONDS)
+        end
+      end
+    end
+  end
+end

data/lib/ace/hitl/lifecycle/errors.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Ace
+  module Hitl
+    module Lifecycle
+      # Error model for the generic HITL request lifecycle
+      # (spec 8wm.t.y21 §9; ports of the migrated transport CLI error surfaces).
+      class Error < StandardError; end
+
+      # The Work/Attempt binding policy rejected the operation, or the
+      # binding authority is unreachable. Never a silent pass.
+      class BindingError < Error; end
+
+      # The operation requires an identity the caller does not have
+      # (root-only host-broker operations, foreign-requester answers).
+      class PermissionError < Error; end
+
+      # The request record is unknown, already transitioned, or the
+      # requested lifecycle transition does not hold.
+      class StateError < Error; end
+
+      # The answer violates its kind's shape or carries secret-shaped
+      # content.
+      class AnswerError < Error; end
+    end
+  end
+end

data/lib/ace/hitl/lifecycle/identity.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require "etc"
+
+module Ace
+  module Hitl
+    module Lifecycle
+      # The single identity gateway of the generic lifecycle: euid, user
+      # and group lookups, and the privilege drop for effect execution.
+      # Every identity decision goes through here so tests can pin a
+      # faithful unprivileged fixture without patching call sites
+      # (spec 8wm.t.y21 §2).
+      module Identity
+        module_function
+
+        def euid
+          Process.euid
+        end
+
+        def uid
+          Process.uid
+        end
+
+        def gid
+          Process.gid
+        end
+
+        def root?
+          euid.zero?
+        end
+
+        def username
+          Etc.getpwuid(euid)&.name || Process.uid.to_s
+        end
+
+        # The requester's uid/gid; unknown names fail closed.
+        def user_ids(name)
+          entry = Etc.getpwnam(name.to_s)
+          [entry.uid, entry.gid]
+        rescue ArgumentError
+          raise Lifecycle::Error, "unknown requester identity: #{name}"
+        end
+
+        def group_id(name)
+          Etc.getgrnam(name.to_s).gid
+        rescue ArgumentError
+          raise Lifecycle::Error, "unknown group identity: #{name}"
+        end
+
+        # Drop to the exact requester identity for effect execution.
+        # Root drops fully (setgroups/setgid/setuid); a non-root process
+        # may only "drop" to itself, so a foreign requester fails closed.
+        def drop_to!(uid, gid)
+          if root?
+            Process::Sys.setgroups([gid])
+            Process::Sys.setgid(gid)
+            Process::Sys.setuid(uid)
+          elsif uid != euid
+            raise Lifecycle::PermissionError,
+              "effect callback requires the requester's identity and root authority to drop to it"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/hitl/lifecycle/kinds.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module Ace
+  module Hitl
+    module Lifecycle
+      # Request kinds and the secret/OTP answer gates (port of the
+      # migrated kind model; spec 8wm.t.y21 §4).
+      module Kinds
+        ALL = %w[
+          text choice confirm secret review
+          question decision verification otp
+        ].freeze
+        SECRET = %w[otp].freeze
+
+        REQUEST_ID = /\A[A-Za-z0-9_-]{6,64}\z/
+        WORK_ID = /\AW[0-9]+\z/
+        ATTEMPT_ID = /\AA-[0-9a-f]{24}\z/
+        SAFE_LABEL = /\A[A-Za-z0-9_. -]{1,48}\z/
+        OTP_ANSWER = /\A[0-9]{6}\z/
+
+        # Secret-shape scrubbing: tokens that must never enter a
+        # non-OTP answer or a channel message.
+        SECRET_SHAPED = Regexp.new(
+          "(?:github_pat_[A-Za-z0-9_]+|gh[pousr]_[A-Za-z0-9]+|" \
+          "sk-[A-Za-z0-9_-]{20,}|-----BEGIN [A-Z ]+PRIVATE KEY-----|" \
+          "\\b(?:otp|token|secret|password)\\s*[:=]\\s*\\S+|" \
+          "\\b[0-9]{6}\\b)",
+          Regexp::IGNORECASE
+        ).freeze
+
+        class << self
+          def secret?(kind)
+            SECRET.include?(kind.to_s)
+          end
+
+          def valid?(kind)
+            ALL.include?(kind.to_s)
+          end
+
+          # The deliver/consume answer gate (port of check_answer):
+          # OTP answers must be exactly six ASCII digits; every other
+          # kind rejects secret-shaped content before persistence.
+          def check_answer!(kind, answer)
+            if secret?(kind)
+              unless OTP_ANSWER.match?(answer)
+                raise AnswerError, "OTP answer must be exactly six ASCII digits"
+              end
+            elsif SECRET_SHAPED.match?(answer)
+              raise AnswerError, "secret-shaped content is forbidden in HITL answers"
+            end
+            nil
+          end
+        end
+      end
+    end
+  end
+end