ace-lab 0.13.0 → 0.14.0

data/lib/ace/lab/organisms/verify.rb

@@ -4,11 +4,15 @@ require_relative "../errors"
 require_relative "../molecules/install_manifest_loader"
 require_relative "../molecules/key_provisioner"
 require_relative "../molecules/role_verifier"
+require_relative "../molecules/gemset_provisioner"
+require_relative "../molecules/extension_provisioner"
 require_relative "../molecules/hitl_routes"
 require_relative "../molecules/caller_authorizer"
 require_relative "../atoms/topology_schema"
 require "open3"
 require "yaml"
+require "json"
+require "fileutils"
 require "date"
 
 module Ace
@@ -77,7 +81,7 @@ module Ace
         # @return [Hash] {ready:, machine:, manifest:,
         #   authorization_path:, checks: {accounts:, directories:,
         #   keys:, roles:, repositories:, grants:, registry:,
-        #   overseer:, adapters:, tools:}, counts: {pass:, fail:,
+        #   overseer:, adapters:, tools:, gems:}, counts: {pass:, fail:,
         #   unknown:}}
         # @raise [Ace::Lab::InvalidConfigurationError] missing,
         #   untrusted or schema-invalid manifest — same classification
@@ -97,7 +101,9 @@ module Ace
             "registry" => check_registry(manifest),
             "overseer" => check_overseer(manifest),
             "adapters" => check_adapters(manifest, executors),
-            "tools" => check_tools(manifest, executors)
+            "tools" => check_tools(manifest, executors),
+            "gems" => check_gems(manifest),
+            "extensions" => check_extensions(manifest, entries)
           }
           flat = checks.values.flatten(1)
           {
@@ -551,6 +557,198 @@ module Ace
           end
         end
 
+        # Declared gem set (gad.2 gap #1, owner spec 8xg.t.sbz.7): every
+        # declared gem must be installed at its EXACT declared version in
+        # the declared target runtime (GEM_HOME) — read-only, through the
+        # SAME probe the provisioner converges from
+        # (GemsetProvisioner#runtime_versions), so readiness and
+        # convergence can never drift. A missing, symlinked or
+        # non-directory runtime fails every declared gem as a dependency
+        # (nothing could have converged into it); a gem at a wrong or
+        # missing version is a classified failure with an
+        # `ace-lab install` remedy; an environment without the `gem`
+        # executable degrades to unknown (the offline posture) and does
+        # not block by itself. Extra undeclared versions are not judged:
+        # the manifest is the single owner of the DECLARED set.
+        def check_gems(manifest)
+          gemset = manifest["gemset"]
+          gems = gemset["gems"]
+          return [] if gems.empty?
+
+          gem_home = gemset["gem_home"]
+          runtime_reason = gem_runtime_reason(gem_home)
+          provisioner = Molecules::GemsetProvisioner.new(runner: @runner)
+          gems.map do |gem|
+            if runtime_reason
+              next {"gem" => gem["name"], "version" => gem["version"], "gem_home" => gem_home,
+                    "status" => FAIL, "reason" => runtime_reason}
+            end
+
+            kind, versions_or_message = provisioner.runtime_versions(
+              name: gem["name"], gem_home: gem_home
+            )
+            status, reason = if kind != :ok
+              [kind == :unknown ? UNKNOWN : FAIL, versions_or_message]
+            else
+              verify_present_gem(provisioner, gem, versions_or_message, gem_home)
+            end
+            {"gem" => gem["name"], "version" => gem["version"], "gem_home" => gem_home,
+             "status" => status, "reason" => reason}
+          end
+        end
+
+        # A gem whose exact declared version is present must ALSO prove
+        # (1) its runtime dependency closure resolves in the target
+        # runtime — a gem listed in `gem list` with a missing
+        # transitive dependency is NOT ready (task 8xs.t.pu0.0) — and
+        # (2) no NEWER version sits beside the declared one: RubyGems
+        # activates the highest installed version, so a newer sibling
+        # would silently take over the runtime's CLI.
+        def verify_present_gem(provisioner, gem, versions, gem_home)
+          reason = gem_version_reason(gem, versions, gem_home)
+          return [FAIL, reason] if reason
+
+          newer_kind, newer_or_message = provisioner.newer_versions(
+            name: gem["name"], declared_version: gem["version"], gem_home: gem_home
+          )
+          if newer_kind != :ok
+            return [newer_kind == :unknown ? UNKNOWN : FAIL, newer_or_message]
+          end
+          unless newer_or_message.empty?
+            return [FAIL,
+              "gem '#{gem["name"]}' has newer version(s) #{newer_or_message.join(", ")} beside " \
+                "the declared #{gem["version"]} in '#{gem_home}'; the newer version would take " \
+                "over CLI activation; rerun ace-lab install"]
+          end
+
+          closure_kind, closure_or_message = provisioner.closure_failures(
+            name: gem["name"], version: gem["version"], gem_home: gem_home
+          )
+          return [closure_kind == :unknown ? UNKNOWN : FAIL, closure_or_message] if closure_kind != :ok
+          return [FAIL, closure_or_message.join("; ")] unless closure_or_message.empty?
+
+          [PASS, nil]
+        end
+
+        # Declared harness extension projections (task 8xs.t.pu0.0):
+        # re-derived from the same receipts and installed gem trees the
+        # provisioner converges (shared ExtensionProjection helpers) —
+        # the receipt must name the declared gem at its exact declared
+        # version, every projected file must match the installed gem's
+        # handbook/extensions content, the destination must not escape
+        # the extensions directory through a symlinked component, and
+        # the projected files must grant the declared account read.
+        def check_extensions(manifest, entries)
+          gemset = manifest["gemset"]
+          gemset["extensions"].map do |entry|
+            declared = gemset["gems"].find { |gem| gem["name"] == entry["gem"] }
+            reason = if declared.nil?
+              "extension source gem '#{entry["gem"]}' is not declared in the gemset"
+            else
+              extension_reason(entry, declared, gemset["gem_home"], entries[entry["account"]])
+            end
+            {"extension" => entry["gem"], "gem" => entry["gem"], "path" => entry["path"],
+             "account" => entry["account"], "status" => reason ? FAIL : PASS, "reason" => reason}
+          end
+        end
+
+        def extension_reason(entry, declared, gem_home, account_entry)
+          source_root = Molecules::ExtensionProjection.gem_source_root(
+            gem_home, entry["gem"], declared["version"]
+          )
+          return "gem '#{entry["gem"]}' #{declared["version"]} is not installed with a " \
+            "handbook/extensions tree in '#{gem_home}'; rerun ace-lab install" unless File.directory?(source_root)
+
+          receipt_path = File.join(entry["path"], Molecules::ExtensionProvisioner::RECEIPT_NAME)
+          unless File.file?(receipt_path)
+            return "extension projection receipt '#{receipt_path}' is missing; rerun ace-lab install"
+          end
+
+          begin
+            receipt = JSON.parse(File.read(receipt_path))
+          rescue JSON::ParserError
+            return "extension projection receipt '#{receipt_path}' is not valid JSON; rerun ace-lab install"
+          rescue Errno::EACCES, Errno::ENOENT
+            return "extension projection receipt '#{receipt_path}' is not readable; " \
+              "rerun ace-lab install"
+          end
+          if receipt["gem"] != entry["gem"] || receipt["version"] != declared["version"]
+            return "extension projection at '#{entry["path"]}' was projected from " \
+              "'#{receipt["gem"]} #{receipt["version"]}' but the manifest declares " \
+              "'#{entry["gem"]} #{declared["version"]}'; rerun ace-lab install"
+          end
+
+          expected = Molecules::ExtensionProjection.source_files(source_root)
+          listed = receipt.fetch("files", [])
+          if listed.sort != expected.keys.sort
+            return "extension projection at '#{entry["path"]}' lists different files than " \
+              "gem '#{entry["gem"]}' #{declared["version"]} carries; rerun ace-lab install"
+          end
+
+          # A destination that escapes the extensions directory through
+          # a symlinked component is refused before any comparison (the
+          # same validate_destination posture convergence applies).
+          begin
+            expected.each_key do |relative|
+              Molecules::ExtensionProjection.validate_destination!(entry["path"], relative)
+            end
+          rescue Ace::Lab::Error => e
+            return "#{e.message}; rerun ace-lab install"
+          end
+
+          mismatch = expected.find do |relative, source|
+            target = File.join(entry["path"], relative)
+            !File.file?(target) || !FileUtils.compare_file(source, target)
+          end
+          return "extension projection file '#{mismatch.first}' differs from gem " \
+            "'#{entry["gem"]}' #{declared["version"]}; rerun ace-lab install" if mismatch
+
+          # Declared-account readability (stat-based — the verifier
+          # does not run as the declared account): a projected file is
+          # readable when it is world-readable, or owner-readable AND
+          # owned by the declared account's uid.
+          unreadable = expected.keys.find do |relative|
+            unreadable_reason(File.join(entry["path"], relative), account_entry)
+          end
+          return "extension projection file '#{unreadable}' is not readable by the declared " \
+            "account '#{entry["account"]}'; rerun ace-lab install" if unreadable
+
+          nil
+        end
+
+        def unreadable_reason(path, account_entry)
+          stat = lstat(path)
+          return true if stat.nil? || !stat.file? || stat.symlink?
+
+          mode = stat.mode & 0o777
+          return false if (mode & 0o004) != 0 # world-readable
+          return false if (mode & 0o400) != 0 && account_entry && stat.uid == account_entry.uid
+
+          true
+        end
+
+        def gem_version_reason(gem, versions, gem_home)
+          return nil if versions.include?(gem["version"])
+          if versions.empty?
+            "gem '#{gem["name"]}' is not installed in gem runtime '#{gem_home}'; " \
+              "rerun ace-lab install"
+          else
+            "gem '#{gem["name"]}' is installed as #{versions.join(", ")} in " \
+              "'#{gem_home}' but the manifest declares #{gem["version"]}; rerun ace-lab install"
+          end
+        end
+
+        def gem_runtime_reason(gem_home)
+          stat = lstat(gem_home)
+          if stat.nil?
+            "gem runtime '#{gem_home}' is missing; rerun ace-lab install"
+          elsif stat.symlink?
+            "gem runtime '#{gem_home}' is a symbolic link"
+          elsif !stat.directory?
+            "'#{gem_home}' exists but is not a directory"
+          end
+        end
+
         # Resolve an executable without running it and judge it for the
         # TARGET EXECUTORS (FINAL-LAB3): a name containing a separator
         # must be a file executable at that path; a bare name must

data/lib/ace/lab/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Lab
-    VERSION = "0.13.0"
+    VERSION = "0.14.0"
   end
 end

data/lib/ace/lab.rb

@@ -18,6 +18,7 @@ require_relative "lab/models/topology_entry"
 require_relative "lab/models/query_result"
 require_relative "lab/models/status_report"
 require_relative "lab/molecules/topology_loader"
+require_relative "lab/molecules/project_locations"
 require_relative "lab/molecules/config_state_classifier"
 require_relative "lab/molecules/lab_state_scanner"
 require_relative "lab/molecules/caller_authorizer"

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-lab
 version: !ruby/object:Gem::Version
-  version: 0.13.0
+  version: 0.14.0
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-20 00:00:00.000000000 Z
+date: 2026-10-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-support-cli
@@ -173,9 +173,19 @@ files:
 - lib/ace/lab/atoms/install_schema.rb
 - lib/ace/lab/atoms/public_projection.rb
 - lib/ace/lab/atoms/topology_schema.rb
+- lib/ace/lab/auth.rb
+- lib/ace/lab/auth/credential_handoff.rb
+- lib/ace/lab/auth/lease_store.rb
+- lib/ace/lab/auth/plugins/env_provider.rb
+- lib/ace/lab/auth/plugins/forgejo_provider.rb
+- lib/ace/lab/auth/plugins/github_provider.rb
+- lib/ace/lab/auth/profile_schema.rb
+- lib/ace/lab/auth/providers.rb
+- lib/ace/lab/auth/service.rb
 - lib/ace/lab/authorization_path.rb
 - lib/ace/lab/cli.rb
 - lib/ace/lab/cli/commands/agents.rb
+- lib/ace/lab/cli/commands/auth.rb
 - lib/ace/lab/cli/commands/install.rb
 - lib/ace/lab/cli/commands/prepare.rb
 - lib/ace/lab/cli/commands/project_add.rb
@@ -198,8 +208,11 @@ files:
 - lib/ace/lab/molecules/config_state_classifier.rb
 - lib/ace/lab/molecules/directory_provisioner.rb
 - lib/ace/lab/molecules/exact_resolver.rb
+- lib/ace/lab/molecules/extension_projection.rb
+- lib/ace/lab/molecules/extension_provisioner.rb
 - lib/ace/lab/molecules/forge_merge_config.rb
 - lib/ace/lab/molecules/forgejo_merge_adapter.rb
+- lib/ace/lab/molecules/gemset_provisioner.rb
 - lib/ace/lab/molecules/grant_provisioner.rb
 - lib/ace/lab/molecules/grant_resolver.rb
 - lib/ace/lab/molecules/hitl_routes.rb
@@ -208,6 +221,7 @@ files:
 - lib/ace/lab/molecules/key_provisioner.rb
 - lib/ace/lab/molecules/lab_state_scanner.rb
 - lib/ace/lab/molecules/overseer_provisioner.rb
+- lib/ace/lab/molecules/project_locations.rb
 - lib/ace/lab/molecules/project_registry.rb
 - lib/ace/lab/molecules/repository_provisioner.rb
 - lib/ace/lab/molecules/role_verifier.rb