ace-lab 0.14.1 → 0.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a3291bf80fb998a68f1e58c0427dfcaa77e8392761b329db1a637700037f3dfb
-  data.tar.gz: 657770601dfa66713d0f0b0de8fb6b9434348a236c486a111f46b8e8df75784c
+  metadata.gz: 3244c9ffaf1f5854e26967c6df9c6fa19f7b60a517acaa51a80a5788fbd31031
+  data.tar.gz: 52ef532f9422e18473e4921dfe200e1c45943f62a49bc0f7768abba9bba4df00
 SHA512:
-  metadata.gz: 3e3cb3595c7042859c5bd9b7dbe721657a614fffbeeac2a6c422d7607ca0ad0510460f68085a802eaacb71a60c723ba98301d3e44a13e7090f36d4e88c766069
-  data.tar.gz: e6dd9400e2424f955b178c394c042ce9b1a4aa42f7a854c6bdbd6965d9d43038fccc6d2a732a2e92896d5ec4f3737672578dc478e9996ea503e5606290bfcc92
+  metadata.gz: c271c58273db132886b0a74c1024a4757116f7369957f2eecb8dd325e7dfb7d855dd920983f31e5bd51193abeb488aae9f3feb9393dda28f0a0c723e68f3566d
+  data.tar.gz: 685fd0944e9485a54fa179c04d934310d476708382532731d0dafa46af50eb7fa9f318e7db83283825b00f00bfe7a3de3f46486112be977cd3fe9eeabfa18ac1

data/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.15.0] - 2026-11-10
+
+### Added
+
+- Configure ordinary role processes with project-scoped environment files; installation and verification require no session issuer service. Converge protected extension permissions and runtime dependency closure. Execute temporary grants in ordinary process groups with deadlines, cleanup, principal checks and durable interrupted-execution reconciliation; use repository-scoped Forgejo token APIs.
+
 ## [0.14.1] - 2026-10-31
 
 ### Fixed

data/docs/usage.md

@@ -108,9 +108,8 @@ conflated:
   carries the path-bearing message.
 
 Runtime *configuration* is echoed (project/user `runtime/config.yml`, then the
-`ACE_RUNTIME` environment variable) with its value and origin. No runtime
-detection and no `ace-runtime` dependency: runtime availability is
-`ace-herdr status`'s dimension.
+`ACE_RUNTIME` environment variable) with its value and origin. This status
+does not detect runtime availability; that is `ace-herdr status`'s dimension.
 
 Local state covers `.ace-tasks/`, `.ace-tasks/_overseer/` (presence only —
 private, never enumerated), `.ace-local/assign/`, `.ace-local/hitl/`,
@@ -167,6 +166,9 @@ projects:                    # optional (consumed by ace-lab install)
     path: /Users/ace/lab/atlas         # absolute, unique
     remote: git@forge:atlas/atlas.git  # optional clone source
     label: Atlas platform    # optional display label
+    environment_files:       # optional role-specific JSON environment sources
+      worker: /home/mo/.config/ace/atlas-worker.json
+      integrator: /home/mo/.config/ace/atlas-integrator.json
 grants:                      # optional: trusted-tier principal grants
   ace-overseer:              # principal → declared project ids
     - atlas
@@ -175,12 +177,39 @@ gemset:                      # optional (gad.2): target runtime + required gem s
   gems:                      # exact versions, unique names
     - name: ace-lab
       version: 0.13.0        # must be an exact gem version (no ranges)
+    - name: ace-wake
+      version: 0.2.0
   extensions:                # optional (8xs.t.pu0.0): harness extension projections
     - gem: ace-wake          # must be declared in gems above
-      path: /Users/overseer/.pi/agent/extensions  # absolute target directory
+      path: /opt/lab/pi-agent/extensions  # root-controlled operational directory
       account: lab-overseer  # must be a declared account (the loading executor)
+session_runtime:            # explicit installed Pi launch configuration
+  node: /opt/ace/node/bin/node
+  pi: /opt/ace/pi/node_modules/@mariozechner/pi-coding-agent/dist/cli.js
+  path: [/usr/bin]     # additional root-controlled executable directories
+  provider: zai
+  model: glm-5.3
+  credentials: /etc/lab/ace-lab/pi-auth.json # private Pi auth JSON; no inline secrets
 ```
 
+`session_runtime` selects the installed Pi command; it does not install Node,
+Pi or model credentials. The launcher starts an ordinary child in the selected
+project worktree with its explicit environment and `ACE_TOOLCHAIN=installed`.
+Standing instructions come from the selected role and resolve through installed
+ACE. Missing runtime is a readiness failure, never a checkout fallback.
+
+`projects[].environment_files` maps a role to a private JSON environment file;
+`coordinator.environment_files` does the same for the lab Overseer. Files must be
+mode 0600 and owned by the launch user or root. Only the selected project's role
+file is loaded. Values can point at a private provider login or contain an
+already repo-scoped token. The forge enforces the token's repository access;
+selecting environment variables does not narrow an administrator token.
+
+This is a worktree/process/environment boundary between trusted agents. It does
+not create a systemd service, change OS users, or protect against a malicious
+process running as the same account. The lab Overseer delegates bootstrap;
+project Overseers delegate implementation, review and integration.
+
 Statuses: accounts `created|exists|would_create|failed`; directories
 `created|exists|mode_fixed|would_create|would_fix_mode|failed`; keys
 `created|exists|would_create|would_repair_public|would_fix_mode|failed`
@@ -350,8 +379,18 @@ Behavior and guarantees:
 - **Extension projections (8xs.t.pu0.0).** Each `gemset.extensions`
   entry projects the installed gem's `handbook/extensions` tree — at
   its EXACT declared version, never the checkout and never a newer
-  sibling — into the declared target directory. The projection is
-  receipt-based: only files recorded in the target's
+  sibling — into the declared target directory. In `ACE_TOOLCHAIN=installed`
+  mode, the projection is root-owned; its source, destination,
+  receipt and existing ancestors must be root-controlled and not writable
+  by group or others. Configure the harness to load this protected location;
+  projecting files alone does not change the harness's extension discovery.
+  Installed Linux lab Pi starts use one shared `ace-wake` projection and
+  refuse an ambiguous manifest with multiple `ace-wake` entries. They also
+  require the Herdr Pi integration alongside it. Outside a configured lab,
+  installed Pi retains normal extension discovery. Configured lab launches
+  preserve the installed toolchain and load the declared operational extension
+  paths. No issuer socket or systemd invocation is needed for readiness.
+  The projection is receipt-based: only files recorded in the target's
   `.ace-lab-extension-projection.json` receipt are ever removed, so
   user-authored extensions in the same directory stay untouched. The
   report carries `loaded_version` (the version the running harness
@@ -662,10 +701,11 @@ auth:
       scopes: ["write:repository"]
       ttl_minutes: 30            # default 30; max 60 unless the host sets otherwise
       expiry_mode: host-revoke   # provider | host-revoke | process
-      issuer:                    # an ADMIN PAT: the token-authenticated admin API
+      issuer:                    # host-only administrator Basic credential
         url: https://forge.example.com
         account: lab-role-dev
-        token_file: /etc/lab/ace-lab/secrets/forgejo.admin.token
+        admin_username: forge-admin
+        password_file: /etc/lab/ace-lab/secrets/forgejo.admin.password
 ```
 
 ```bash
@@ -707,11 +747,17 @@ Contract highlights:
   returns the child's code after printing the report); on process success a
   cleanup failure is itself an error and the report carries both outcomes;
   one exec at a time per lease; normal end/cancel revokes immediately, a
-  SIGKILL'd executor is cleaned up no later than the recorded deadline (host
-  scheduler) and `reconcile` resolves interrupted cycles. The child runs with
-  an ALLOWLISTED environment (PATH/HOME &c. plus the leased credential
+  ordinary execution enforces its deadline and terminates its process group.
+  There is no background revoke scheduler. After a hard process death, run
+  `reconcile` before retrying; unconfirmed execution or revocation stays visibly
+  unresolved. Forgejo grants have no claimed native expiry; GitHub expiry is
+  accepted only when the provider returns a valid deadline. The child runs with
+  an ALLOWLISTED environment (PATH/HOME, ACE_TOOLCHAIN, GEM_HOME, GEM_PATH,
+  and the leased credential
   reference) — ambient credential overrides (GH_TOKEN, GIT_* auth, ...) are
   never inherited past the profile's scope.
+  When the selected toolchain is `installed`, its runtime paths also take
+  precedence over caller and provider environment values.
 - Refusals are non-zero with a reason and the escalation addressee; there is
   no fallback identity. A network-shaped revoke stays visibly
   `revoke-pending` — a revocation is never claimed before the provider
@@ -720,12 +766,15 @@ Contract highlights:
   LEASE --force` → forced-terminal with the unconfirmed outcome recorded),
   never silently marked revoked.
 - Plugins (explicit registry, like the ace-git providers): `forgejo` (one
-  scoped token per lease through the TOKEN-AUTHENTICATED ADMIN API
-  (`/api/v1/admin/users/{account}/tokens`; the user endpoint requires
-  BasicAuth, not a PAT) with owner/name RepoTargetOption repository targets —
+  scoped token per lease through `/api/v1/users/{account}/tokens`, using
+  administrator Basic authentication and a `Sudo` header. The setup process
+  reads the configured source credential and passes only the resulting
+  project-scoped token to the child. Remote
+  issuers require HTTPS; plain HTTP is accepted only on loopback. Tokens use
+  owner/name RepoTargetOption repository targets —
   a repo without an owner is refused, never an all-repositories token — and
-  the response's granted scopes validated against the request; revoke deletes
-  that exact token name, 404 = already invalid), `github` (App JWT →
+  the response must confirm exactly the requested scopes and repositories.
+  Revoke deletes that exact token name; 404 = already invalid), `github` (App JWT →
   installation token for chosen repos/permissions with the real `expires_at`;
   DELETE to revoke; 401 = already invalid), `env` (named values of configured
   safe sources, process-scoped only — a standalone env profile cannot declare
@@ -736,3 +785,16 @@ Contract highlights:
   Forgejo-shaped subjects like `write:repository`. Provider Authorization
   headers travel in 0600 ephemeral files (`curl -H @file`), never in argv
   visible to `ps`.
+
+  During a Forgejo `auth exec` on Linux, the child receives a private temporary `fj`
+  login and Git askpass bound to the issuer origin and role account. Ambient
+  credential helpers are disabled for that child. The projection is removed
+  on exit or by lease cleanup after an interrupted executor. Other platforms
+  refuse this projection rather than falling back to ambient credentials.
+
+A pre-existing project-scoped token supplied through a role environment file is
+static configuration: ending the session removes its local projection, not the
+remote token shared by other sessions. Temporary grants created by `auth request`
+use `auth exec` and its normal revoke/reconcile lifecycle. Secret values belong
+only to private files or the child environment, never prompts, argv, task records
+or reports.

data/lib/ace/lab/atoms/install_schema.rb

@@ -15,13 +15,13 @@ module Ace
         SCHEMA_VERSION = 1
         TOP_LEVEL_KEYS =
           %w[schema_version machine accounts directories keys roles projects grants
-             adapters tools gemset].freeze
+             adapters tools gemset session_runtime coordinator].freeze
         ENTRY_KEYS = {
           "accounts" => %w[username role create home],
           "directories" => %w[path owner mode],
           "keys" => %w[account type path],
           "roles" => %w[id account instructions],
-          "projects" => %w[id path remote label],
+          "projects" => %w[id path remote label environment_files],
           "adapters" => %w[id kind command config]
         }.freeze
         USERNAME_PATTERN = /\A[a-z_][a-z0-9_-]{0,31}\z/
@@ -66,6 +66,7 @@ module Ace
             accounts = normalize_accounts(document["accounts"], os)
             usernames = accounts.map { |account| account["username"] }
             projects = normalize_projects(document["projects"])
+            coordinator = normalize_coordinator(document["coordinator"], projects)
 
             {
               "schema_version" => SCHEMA_VERSION,
@@ -75,15 +76,78 @@ module Ace
               "keys" => normalize_keys(document["keys"], accounts),
               "roles" => normalize_roles(document["roles"], usernames),
               "projects" => projects,
-              "grants" => normalize_grants(document["grants"], projects.map { |p| p["id"] }),
+              "coordinator" => coordinator,
+              "grants" => normalize_grants(document["grants"], projects.map { |p| p["id"] } + [coordinator&.fetch("id")].compact),
               "adapters" => normalize_adapters(document["adapters"]),
               "tools" => normalize_tools(document["tools"]),
-              "gemset" => normalize_gemset(document["gemset"], accounts.map { |a| a["username"] })
+              "gemset" => normalize_gemset(document["gemset"], accounts.map { |a| a["username"] }),
+              "session_runtime" => normalize_session_runtime(document["session_runtime"])
             }
           end
 
           private
 
+          def normalize_coordinator(raw, projects)
+            return nil if raw.nil?
+            unless raw.is_a?(Hash) && (raw.keys - %w[id path environment_files]).empty? && (%w[id path] - raw.keys).empty? &&
+                raw["id"].is_a?(String) && ROLE_ID_PATTERN.match?(raw["id"]) &&
+                raw["path"].is_a?(String) && raw["path"].match?(%r{\A/lab(?:/[a-zA-Z0-9][a-zA-Z0-9_.-]*)?\z}) &&
+                File.expand_path(raw["path"]) == raw["path"] && !raw["path"].match?(/[[:cntrl:]]/)
+              raise_invalid "coordinator requires an id and canonical absolute path"
+            end
+            if projects.any? { |project| project["id"] == raw["id"] || project["path"] == raw["path"] }
+              raise_invalid "coordinator must be distinct from projects"
+            end
+            raw.key?("environment_files") ? raw.merge("environment_files" => normalize_environment_files(raw["environment_files"])) : raw.dup
+          end
+
+          def normalize_environment_files(raw)
+            return {} if raw.nil?
+            roles = %w[lab-overseer project-overseer worker verifier integrator]
+            unless raw.is_a?(Hash) && raw.all? { |role, path|
+              roles.include?(role) && path.is_a?(String) && path.start_with?("/") &&
+                File.expand_path(path) == path && !path.match?(/[[:cntrl:]]/)
+            }
+              raise_invalid "environment_files must map execution roles to canonical absolute paths"
+            end
+            raw.dup
+          end
+
+          def normalize_session_runtime(raw)
+            return nil if raw.nil?
+            keys = %w[node pi path provider model credentials]
+            unless raw.is_a?(Hash) && (raw.keys - keys - ["herdr"]).empty? && (keys - raw.keys).empty?
+              raise_invalid "session_runtime requires exactly node, pi, path, provider, model and credentials"
+            end
+            %w[node pi credentials].each do |key|
+              path = raw[key]
+              unless path.is_a?(String) && path.start_with?("/") && File.expand_path(path) == path && !path.match?(/[[:cntrl:]]/)
+                raise_invalid "session_runtime #{key} must be a canonical absolute path"
+              end
+            end
+            paths = raw["path"]
+            unless paths.is_a?(Array) && !paths.empty? && paths.uniq == paths && paths.all? { |path|
+              path.is_a?(String) && path.start_with?("/") && File.expand_path(path) == path && !path.match?(/[[:cntrl:]:]/)
+            }
+              raise_invalid "session_runtime path must contain unique canonical absolute directories"
+            end
+            %w[provider model].each do |key|
+              unless raw[key].is_a?(String) && raw[key].match?(%r{\A[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}\z})
+                raise_invalid "session_runtime #{key} is invalid"
+              end
+            end
+            if raw.key?("herdr")
+              endpoint = raw["herdr"]
+              unless endpoint.is_a?(Hash) && endpoint.keys.sort == %w[account socket] &&
+                  endpoint["account"].is_a?(String) && endpoint["account"].match?(/\A[a-z_][a-z0-9_-]*\z/) &&
+                  endpoint["socket"].is_a?(String) && endpoint["socket"].start_with?("/") &&
+                  File.expand_path(endpoint["socket"]) == endpoint["socket"] && !endpoint["socket"].match?(/[[:cntrl:]]/)
+                raise_invalid "session_runtime herdr requires an account and canonical socket path"
+              end
+            end
+            raw.transform_values { |value| value.is_a?(Array) ? value.map(&:dup) : value.dup }
+          end
+
           def raise_invalid(reason)
             raise Ace::Lab::InvalidConfigurationError,
               "invalid lab install manifest: #{reason}"
@@ -229,7 +293,9 @@ module Ace
               remote = optional_string(entry, "projects", "remote")
               label = optional_string(entry, "projects", "label")
 
-              {"id" => id, "path" => path, "remote" => remote, "label" => label}
+              normalized = {"id" => id, "path" => path, "remote" => remote, "label" => label}
+              normalized["environment_files"] = normalize_environment_files(entry["environment_files"]) if entry.key?("environment_files")
+              normalized
             end.tap do |projects|
               duplicates_of(projects.map { |project| project["id"] }) do |_id|
                 raise_invalid_entry("projects", "id is declared more than once")

data/lib/ace/lab/auth/credential_handoff.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "fileutils"
+require "tempfile"
 
 module Ace
   module Lab
@@ -12,35 +13,58 @@ module Ace
       # REFERENCE (path), never the value in argv or the serialized
       # report. Removal after the lease is idempotent.
       class CredentialHandoff
-        def initialize(credentials_dir, recipient: )
+        def self.projection_prefix(credential)
+          "#{File.basename(credential)}.forgejo-session-"
+        end
+
+        def initialize(credentials_dir, recipient:)
           @credentials_dir = credentials_dir
           @recipient = recipient
         end
 
         def path(lease_id)
+          raise Error, "invalid credential lease id" unless lease_id.to_s.match?(/\Alease-[a-zA-Z0-9_-]+\z/)
           File.join(@credentials_dir, "#{lease_id}-#{@recipient}")
         end
 
-        # @return [String] the credential file path (the reference)
         def deliver(lease_id, secret)
-          FileUtils.mkdir_p(@credentials_dir)
+          FileUtils.mkdir_p(@credentials_dir, mode: 0o700)
           target = path(lease_id)
-          raise Error, "credential handoff path is a symlink; refusing" if File.symlink?(target)
-
-          temporary = "#{target}.#{Process.pid}.tmp"
-          File.write(temporary, secret.to_s)
-          FileUtils.chmod(0o400, temporary)
-          File.rename(temporary, target)
-          target
+          deliver_into(@credentials_dir, target, secret)
         end
 
         def clear(lease_id)
           target = path(lease_id)
           File.delete(target) if File.file?(target) && !File.symlink?(target)
+          # A killed Forgejo executor may leave its private fj login
+          # projection behind; it belongs to this same handoff lifecycle.
+          prefix = self.class.projection_prefix(target)
+          Dir.children(@credentials_dir).grep(/^#{Regexp.escape(prefix)}/).each do |name|
+            dir = File.join(@credentials_dir, name)
+            raise Error, "session projection is a symlink; refusing cleanup" if File.symlink?(dir)
+            FileUtils.remove_entry_secure(dir) if File.directory?(dir)
+          end
           :cleared
         rescue Errno::ENOENT
           :cleared
         end
+
+        private
+
+        def deliver_into(directory, public_target, secret)
+          target = File.join(directory, File.basename(public_target))
+          raise Error, "credential handoff path is a symlink; refusing" if File.symlink?(target)
+
+          Tempfile.create([".credential-", ".tmp"], directory) do |temporary|
+            temporary.write(secret.to_s)
+            temporary.flush
+            temporary.fsync
+            temporary.chmod(0o400)
+            File.rename(temporary.path, target)
+          end
+          public_target
+        end
+
       end
     end
   end

data/lib/ace/lab/auth/error.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require "ace/lab"
+
+module Ace
+  module Lab
+    module Auth
+      class Error < ::Ace::Lab::Error; end
+      class Refusal < Error; end
+      class ExecutionCleanupError < Error; end
+    end
+  end
+end

data/lib/ace/lab/auth/lease_store.rb

@@ -5,6 +5,7 @@ require "json"
 require "fileutils"
 require "digest"
 require "time"
+require_relative "error"
 
 module Ace
   module Lab
@@ -46,6 +47,9 @@ module Ace
         # @return [Hash] the created (PREPARING) lease record
         def create(profile:, role:, principal:, task:, assignment:, repos:,
           use_until:, provider_expiry:, token_ref: nil, id: nil)
+          unless [profile, role, principal, task, assignment].all? { |value| value.is_a?(String) && value.valid_encoding? && !value.strip.empty? }
+            raise Error, "lease correlation is incomplete"
+          end
           lease = {"id" => id || "lease-#{SecureRandom.hex(8)}",
                    "profile" => profile, "role" => role, "principal" => principal,
                    "task" => task, "assignment" => assignment, "repos" => repos.sort,
@@ -64,8 +68,8 @@ module Ace
         # scope-changed correlation does not match, and
         # DEADLINE-AWARENESS is part of the match: an issued record
         # past its use_until/provider expiry is not returned, so a
-        # retry mints a fresh grant while reconcile retires the expired
-        # one — an expired grant is never handed back as "live".
+        # retry must settle the expired grant before minting a replacement;
+        # an expired grant is never handed back as "live".
         def find_live(task:, assignment:, profile:, role:)
           all.filter_map do |lease|
             next unless lease["task"] == task && lease["assignment"] == assignment &&
@@ -77,9 +81,11 @@ module Ace
 
         def load(id)
           path = lease_path(id)
-          raise Error, "unknown lease '#{id}'" unless File.file?(path)
-
-          JSON.parse(File.read(path))
+          parse_record(path)
+        rescue Errno::ENOENT
+          raise Error, "unknown lease '#{id}'"
+        rescue SystemCallError => e
+          raise Error, "lease record '#{id}' is unavailable (#{e.class})"
         rescue JSON::ParserError
           raise Error, "lease record '#{id}' is unreadable"
         end
@@ -89,13 +95,17 @@ module Ace
         # problem (the remote token may still be live) — never a
         # silently skipped entry that disappears from reconcile.
         def all
-          return [] unless Dir.exist?(@dir)
-
-          Dir.glob(File.join(@dir, "*.json")).sort.filter_map do |path|
-            JSON.parse(File.read(path))
-          rescue Errno::EACCES
-            nil
-          rescue JSON::ParserError
+          names = begin
+            Dir.children(@dir)
+          rescue Errno::ENOENT
+            return []
+          rescue SystemCallError => e
+            raise Error, "lease inventory is unavailable (#{e.class})"
+          end
+          names.reject { |name| name.start_with?(".") }.select { |name| name.end_with?(".json") }.sort.filter_map do |name|
+            path = File.join(@dir, name)
+            parse_record(path)
+          rescue SystemCallError, JSON::ParserError
             {"id" => File.basename(path, ".json"), "state" => nil,
              "corrupt" => true, "_path" => path}
           end
@@ -110,8 +120,8 @@ module Ace
           path = lease_path(id)
           with_write_lock(id) do
             lease = begin
-              JSON.parse(File.read(path))
-            rescue JSON::ParserError, Errno::ENOENT => e
+              parse_record(path)
+            rescue JSON::ParserError, SystemCallError => e
               # A corrupt/missing record is a named store failure, never a
               # raw parser error escaping through the update seam.
               raise Error, "lease '#{id}' cannot be read at #{path}: #{e.class} #{e.message}"
@@ -128,10 +138,12 @@ module Ace
         end
 
         def with_write_lock(id)
-          FileUtils.mkdir_p(@dir)
-          File.open(File.join(@dir, "#{id}.write.lock"), File::CREAT | File::RDWR) do |lock|
-            lock.flock(File::LOCK_EX)
+          lock = open_lock(File.join(@dir, "#{id}.write.lock"))
+          begin
+            lock_flock(lock, File::LOCK_EX)
             yield
+          ensure
+            lock.close
           end
         end
 
@@ -141,24 +153,28 @@ module Ace
         # against a concurrent identical request — the second caller
         # waits and then returns the first caller's live lease.
         def with_correlation_lock(task:, assignment:, profile:, role:)
-          FileUtils.mkdir_p(@dir)
-          key = Digest::SHA256.hexdigest([task, assignment, profile, role].join("\e"))
-          File.open(File.join(@dir, "correlation-#{key}.lock"), File::CREAT | File::RDWR) do |lock|
-            lock.flock(File::LOCK_EX)
+          key = Digest::SHA256.hexdigest(JSON.generate([task, assignment, profile, role]))
+          lock = open_lock(File.join(@dir, "correlation-#{key}.lock"))
+          begin
+            lock_flock(lock, File::LOCK_EX)
             yield
+          ensure
+            lock.close
           end
         end
 
         # One exec at a time per lease: an exclusive lock on the lease's
         # exec lockfile, non-blocking — a parallel exec is a refusal.
         def with_exec_lock(id)
-          FileUtils.mkdir_p(@dir)
-          File.open(File.join(@dir, "#{id}.exec.lock"), File::CREAT | File::RDWR) do |lock|
-            unless lock.flock(File::LOCK_EX | File::LOCK_NB)
+          lock = open_lock(File.join(@dir, "#{id}.exec.lock"))
+          begin
+            unless lock_flock(lock, File::LOCK_EX | File::LOCK_NB)
               raise Error, "lease '#{id}' already has a running exec"
             end
 
             yield
+          ensure
+            lock.close
           end
         end
 
@@ -168,33 +184,79 @@ module Ace
         # or is mid-revocation — neither is ever usable or "live".
         def live?(lease, at: Time.now)
           return false unless lease["state"] == "issued"
+          return false if lease.key?("execution") || lease["containment"] == "unconfirmed"
           return false if lease["use_until"] && Time.parse(lease["use_until"]) <= at
           if lease["provider_expiry"] && Time.parse(lease["provider_expiry"]) <= at
             return false
           end
 
           true
+        rescue ArgumentError, TypeError => e
+          raise Error, "lease deadline is invalid (#{e.class})"
         end
 
         private
 
+        def open_lock(path)
+          FileUtils.mkdir_p(@dir)
+          lock = File.open(path, File::CREAT | File::RDWR | File::NOFOLLOW, 0o600)
+          held, named = lock.stat, File.lstat(path)
+          unless held.file? && !named.symlink? && held.uid == Process::Sys.geteuid && held.nlink == 1 &&
+              (held.mode & 0o022).zero? && [held.dev, held.ino] == [named.dev, named.ino]
+            raise Error, "lease lock is not safely owned"
+          end
+          lock
+        rescue SystemCallError => e
+          lock&.close unless lock&.closed?
+          raise Error, "lease lock is unavailable (#{e.class})"
+        rescue Exception
+          lock&.close unless lock&.closed?
+          raise
+        end
+
+        def lock_flock(lock, flags)
+          lock.flock(flags)
+        rescue SystemCallError => e
+          raise Error, "lease lock could not be acquired (#{e.class})"
+        end
+
+        def parse_record(path)
+          record = JSON.parse(File.read(path))
+          unless record.is_a?(Hash) && record["id"] == File.basename(path, ".json")
+            raise JSON::ParserError, "lease record identity differs"
+          end
+          record
+        end
+
         def atomic_write(path, lease)
           FileUtils.mkdir_p(@dir)
-          temporary = "#{path}.#{Process.pid}.tmp"
-          File.open(temporary, "w") do |file|
+          temporary = "#{path}.#{SecureRandom.hex(16)}.tmp"
+          created = false
+          File.open(temporary, File::WRONLY | File::CREAT | File::EXCL, 0o600) do |file|
+            created = true
+            file.chmod(0o600)
             file.write(JSON.pretty_generate(lease))
             file.flush
             file.fsync
           end
-          # 0600 BEFORE the rename: the record never exists at the target
-          # path with umask-default permissions, even for an instant.
-          FileUtils.chmod(0o600, temporary)
           begin
             File.rename(temporary, path)
           rescue Errno::ENOENT
             FileUtils.mkdir_p(File.dirname(path))
             File.rename(temporary, path)
           end
+          # Persist the directory entry as well as the file data.
+          File.open(File.dirname(path), File::RDONLY) { |directory| directory.fsync }
+        rescue SystemCallError, IOError => e
+          raise Error, "lease record write is unavailable (#{e.class})"
+        ensure
+          if created
+            begin
+              File.unlink(temporary)
+            rescue SystemCallError
+              nil
+            end
+          end
         end
 
         def lease_path(id)