ace-lab 0.2.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c6487b764fe853b0272a43afa43fd2e6819669c6dc3593022ab55946925b2a2e
-  data.tar.gz: c588bd4bc130eff246e02546b40a11fa9ed06e8c575560d292a291c5d2d1665e
+  metadata.gz: 1cd47480daa53d48cead3bb733e54223a0614394f27614248829ee4566a71da3
+  data.tar.gz: 6960967135776f222d2b2c638a0317e3a2b1afceb811155046f87fb41d476d65
 SHA512:
-  metadata.gz: 3c6974042b3ac8cc638d3782b3d2e4c4be19de2de5860cc6c91e3d020cdc0338e7cb187d932ae64353f7994304b3b0f284533cef21b6919233e313a7af1bea6a
-  data.tar.gz: 2e6908502fdd3870f7403e7d6f56b07d1b5edb07acbdc6591135aae8a0227ae85ab8724c7e079e4a1d91bbf61a53277d0a84e38c23be958e540c1b9c7d8306ae
+  metadata.gz: 10939c1ffa2ca6045f8f6e526f9fc96be4dba7c4d453e483a785e4570c57356ad6f3bfaf62cf8b4a20c0373cce8f5a261d18ec77ec2607393bcc3cc1facd2e21
+  data.tar.gz: 5f0d847b422a83437fd6431de880b7aa4f6e72c44dff00df9e0d359a85ba30600e0f70dbcb31d910ae34aa1f2a8a0419867c9b018f78b53273e588cc6645098e

data/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.1] - 2026-10-04
+
+### Changed
+- Track the runtime-neutral ace-assign 0.62 line (the published 0.3.0 still allows `~> 0.61`, which resolves 0.62 — this release ships the tightened constraint).
+
+## [0.3.0] - 2026-10-04
+
+### Added
+- **HITL delivery authorization policy (spec 8wq.t.34i)**: `Molecules::HitlAuthorizer` derives the lab-side transport facts (trusted transport uids, trusted HITL service identity, per-project Captain visibility) from the SAME trusted deployment document the grant resolver reads — uid-exact, project-scoped, never from claimed names or the cascade.
+
 ## [0.2.0] - 2026-10-02
 
 ### Added

data/lib/ace/lab/atoms/service_input.rb

@@ -16,8 +16,17 @@ module Ace
 
         def self.load(path)
           raise ArgumentError, "input file is missing" unless File.file?(path)
-          raise ArgumentError, "input exceeds #{MAX_BYTES} bytes" if File.size(path) > MAX_BYTES
-          data = JSON.parse(File.read(path))
+          # One handle bounds the read: a file replaced or grown between a
+          # size check and a separate read cannot bypass the limit.
+          begin
+            data = File.open(path, "rb") do |file|
+              content = file.read(MAX_BYTES + 1)
+              raise ArgumentError, "input exceeds #{MAX_BYTES} bytes" if content && content.bytesize > MAX_BYTES
+              JSON.parse(content.to_s)
+            end
+          rescue Errno::EACCES, Errno::EISDIR
+            raise ArgumentError, "input file is unreadable"
+          end
           raise ArgumentError, "input must be a JSON object" unless data.is_a?(Hash)
           validate!(data)
           data

data/lib/ace/lab/models/service_receipt.rb

@@ -7,7 +7,7 @@ module Ace
       # The coordinator independently verifies every binding before acceptance.
       module ServiceReceipt
         BINDING_FIELDS = %w[request_id assignment_id attempt_id project_id operation
-          input_digest target candidate_head].freeze
+          input_digest target candidate_head executor_uid transport].freeze
 
         def self.build(binding, executor_result)
           BINDING_FIELDS.to_h { |field| [field, binding.fetch(field)] }.merge(executor_result)

data/lib/ace/lab/molecules/hitl_authorizer.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+require "etc"
+
+module Ace
+  module Lab
+    module Molecules
+      # The lab-side HITL delivery authorization (spec 8wq.t.34i): which
+      # authenticated transport may submit correlated answers for a
+      # Captain, derived from the SAME trusted deployment document that
+      # carries the service principals — read through the grant
+      # resolver's verified traversal, never from the cascade. The peer
+      # uid is a KERNEL fact resolved by the HITL boundary; this policy
+      # never trusts a claimed name.
+      class HitlAuthorizer
+        # @param principals [Hash] authorization.principals from the
+        #   trusted document (uid-string or username keys, per-project)
+        # @param transport_uids [Array<Integer>] uids authorized to act
+        #   as the configured transport
+        # @param service_uid [Integer, nil] the trusted HITL service uid
+        def initialize(principals: {}, transport_uids: [], service_uid: nil)
+          @principals = principals || {}
+          @transport_uids = Array(transport_uids)
+          @service_uid = service_uid
+        end
+
+        # Build from the trusted deployment document at a fixed path
+        # (same file the service policy resolves principals from).
+        # @return [HitlAuthorizer]
+        def self.from_trusted_document(path, loader = GrantResolver)
+          document = loader.trusted_document(path)
+          hitl = document["hitl"].is_a?(Hash) ? document["hitl"] : {}
+          principals = document.dig("authorization", "principals")
+          new(
+            principals: principals.is_a?(Hash) ? principals : {},
+            transport_uids: Array(hitl["transport_uids"]),
+            service_uid: hitl["service_uid"]
+          )
+        end
+
+        # @return [Integer, nil] the trusted HITL service identity
+        def service_uid
+          @service_uid.is_a?(Integer) ? @service_uid : nil
+        end
+
+        # The transport may submit a correlated answer from an authorized
+        # Captain when its KERNEL-VERIFIED uid is a configured transport
+        # AND the transport's principal is visible for the request's
+        # project. Unknown identity is an error-shaped refusal, never
+        # permission.
+        def delivery_authorized?(uid:, project_id:)
+          return false unless @transport_uids.include?(uid)
+
+          policy = @principals[uid.to_s]
+          return false unless policy.is_a?(Hash)
+
+          projects = Array(policy["projects"]).map(&:to_s)
+          projects.empty? || projects.include?(project_id.to_s)
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/molecules/service_executor.rb

@@ -13,12 +13,21 @@ module Ace
       # Domain handlers receive structured JSON on stdin and return a small
       # receipt; their stdout/stderr are never journaled or returned to callers.
       class ServiceExecutor
-        def execute(operation:, request:, input:, policy:, authorization:)
-          current = policy.operation!(request.fetch("operation"), project: request.fetch("project_id"),
+        # The trusted policy is reloaded through +policy_loader+ immediately
+        # before the effect: a revocation or operation change after the claim
+        # must still stop dispatch. The candidate head is revalidated through
+        # +head_loader+ for the same reason: a concurrent commit must not let
+        # a stale reviewed candidate execute.
+        def execute(operation:, request:, input:, policy_loader:, authorization:, head_loader:)
+          fresh = policy_loader.call
+          current = fresh.operation!(request.fetch("operation"), project: request.fetch("project_id"),
             service_id: request.fetch("service_id"))
           raise SecurityError, "executor operation changed before dispatch" unless current == operation
-          policy.authorize!(authorization, request)
-          if Time.iso8601(operation.fetch("lease_expires_at")) <= Time.now.utc
+          fresh.authorize!(authorization, request)
+          unless head_loader.call == request.fetch("candidate_head")
+            raise SecurityError, "candidate head changed before dispatch"
+          end
+          if Time.iso8601(current.fetch("lease_expires_at")) <= Time.now.utc
             raise SecurityError, "executor lease has expired"
           end
           out = if operation.fetch("transport", "local") == "unix"
@@ -30,36 +39,75 @@ module Ace
           response = JSON.parse(out)
           return nil unless valid_response?(response, request)
           {"outcome" => response.fetch("outcome"), "evidence" => response.fetch("evidence"),
-           "executor_uid" => operation.fetch("executor_uid")}
-        rescue JSON::ParserError, Errno::ENOENT, Errno::EACCES, Errno::ECONNREFUSED, EOFError, Timeout::Error
+           "executor_uid" => current.fetch("executor_uid")}
+        rescue JSON::ParserError, Timeout::Error, SystemCallError, IOError
+          # Transport failures after the claim (broken pipe, connection
+          # reset, socket loss) leave the effect unknown: uncertainty, not a
+          # classified crash, is the honest outcome.
           nil
         end
 
         private
 
+        # Handler output is bounded DURING execution: a noisy handler is
+        # killed and reaped once its response exceeds the receipt limit
+        # instead of being buffered without bound in this process.
         def invoke_local(operation, request, input)
           unless Process.uid == operation.fetch("executor_uid") && Process.euid == operation.fetch("executor_uid")
             raise SecurityError, "current OS identity is not the configured executor"
           end
-          out, _stderr, status = Timeout.timeout(30) do
-            Open3.capture3(*operation.fetch("argv"),
-              stdin_data: JSON.generate({"request" => request, "input" => input}))
+          out = nil
+          status = nil
+          Open3.popen3(*operation.fetch("argv")) do |stdin, stdout, stderr, waiter|
+            pid = waiter.pid
+            begin
+              Timeout.timeout(30) do
+                stdin.write(JSON.generate({"request" => request, "input" => input}))
+                stdin.close
+                errors = Thread.new { bounded_read(stderr, 8192) }
+                out = bounded_read(stdout, 16 * 1024 + 1)
+                errors.join
+                Process.kill("KILL", pid) if out && out.bytesize > 16 * 1024
+                status = waiter.value
+              end
+            rescue Timeout::Error
+              Process.kill("KILL", pid) rescue nil
+              waiter.value
+              raise
+            end
           end
-          status.success? ? out : nil
+          out if out && out.bytesize <= 16 * 1024 && status&.success?
         end
 
+        def bounded_read(io, limit)
+          io.read(limit).to_s
+        rescue IOError, Errno::EBADF
+          ""
+        ensure
+          begin
+            io.close
+          rescue IOError, Errno::EBADF
+            nil
+          end
+        end
+
+
         def invoke_unix(operation, request, input)
           path = operation.fetch("socket_path")
           stat = File.lstat(path)
           unless stat.socket? && stat.uid == operation.fetch("executor_uid") && (stat.mode & 0o002).zero?
             raise SecurityError, "service socket owner or permissions do not match the executor"
           end
-          UNIXSocket.open(path) do |socket|
-            peer_uid, = socket.getpeereid
-            raise SecurityError, "service peer identity does not match the executor" unless peer_uid == stat.uid
-            socket.write(JSON.generate({"request" => request, "input" => input}) + "\n")
-            socket.flush
-            Timeout.timeout(30) { socket.gets(16 * 1024 + 1) }
+          # One deadline covers connecting, writing, and reading: a stalled
+          # peer must leave the claimed effect uncertain, never block.
+          Timeout.timeout(30) do
+            UNIXSocket.open(path) do |socket|
+              peer_uid, = socket.getpeereid
+              raise SecurityError, "service peer identity does not match the executor" unless peer_uid == stat.uid
+              socket.write(JSON.generate({"request" => request, "input" => input}) + "\n")
+              socket.flush
+              socket.gets(16 * 1024 + 1)
+            end
           end
         end
 

data/lib/ace/lab/molecules/service_policy.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "pathname"
 require "time"
 
 module Ace
@@ -41,19 +42,38 @@ module Ace
           end
           uid = operation["executor_uid"]
           raise Ace::Lab::InvalidConfigurationError, "configured executor UID is invalid" unless uid.is_a?(Integer) && uid >= 0
-          validate_executable!(operation["argv"].first, uid) if transport == "local"
+          if transport == "local"
+            # Every path component is validated (symlinks resolved, writable
+            # ancestors rejected) and the validated resolved file replaces
+            # the configured argv entry, so execution cannot be redirected
+            # between validation and dispatch.
+            resolved = trusted_executable!(operation["argv"].first, uid)
+            operation = operation.merge("argv" => [resolved] + operation["argv"][1..])
+          end
           expires_at = parse_time(operation["lease_expires_at"])
           raise SecurityError, "executor lease has expired" if expires_at <= Time.now.utc
           if operation["host_maintenance"] == true
-            deployment = operation["deployment_root"].to_s
-            sink = operation["evidence_sink"].to_s
+            # Maintenance executes a fixed updater outside the replaced
+            # deployment; a socket-only operation has no executable to place
+            # and cannot prove the maintenance boundary.
+            unless transport == "local"
+              raise Ace::Lab::InvalidConfigurationError,
+                "host maintenance requires a local executable transport"
+            end
+            deployment_root = operation["deployment_root"].to_s
+            sink_path = operation["evidence_sink"].to_s
+            unless deployment_root.start_with?("/") && sink_path.start_with?("/")
+              raise Ace::Lab::InvalidConfigurationError,
+                "host maintenance needs absolute deployment and evidence sink paths"
+            end
+            deployment = resolved_path(deployment_root)
+            sink = resolved_path(sink_path)
             executable = operation.dig("argv", 0).to_s
             unless deployment.start_with?("/") && sink.start_with?("/") && executable.start_with?("/") &&
                 !inside?(executable, deployment) && !inside?(sink, deployment)
               raise Ace::Lab::InvalidConfigurationError,
                 "host maintenance needs executable and evidence sink outside the replaced deployment"
             end
-            validate_executable!(executable, uid)
           end
           operation
         end
@@ -72,15 +92,24 @@ module Ace
 
         private
 
-        def validate_executable!(path, uid)
-          file = File.stat(path)
-          parent = File.stat(File.dirname(File.realpath(path)))
-          unless [0, uid].include?(file.uid) && [0, uid].include?(parent.uid) &&
-              (file.mode & 0o022).zero? && (parent.mode & 0o022).zero?
-            raise Ace::Lab::InvalidConfigurationError,
-              "configured executable or containing directory is writable by another identity"
+        # Validate the executable and every directory component on its
+        # resolved path: each must be owned by root or the executor and not
+        # group/other-writable, so no ancestor or symlink component can
+        # redirect the fixed argv. Returns the resolved file path.
+        def trusted_executable!(path, uid)
+          resolved = resolved_path(path.to_s)
+          unless resolved.start_with?("/") && File.file?(resolved) && File.executable?(resolved)
+            raise Ace::Lab::InvalidConfigurationError, "configured executable is unavailable"
           end
-        rescue Errno::ENOENT, Errno::EACCES
+          Pathname.new(resolved).descend do |component|
+            stat = File.stat(component)
+            unless [0, uid].include?(stat.uid) && (stat.mode & 0o022).zero?
+              raise Ace::Lab::InvalidConfigurationError,
+                "configured executable path has a writable or foreign-owned component: #{component}"
+            end
+          end
+          resolved
+        rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
           raise Ace::Lab::InvalidConfigurationError, "configured executable is unavailable"
         end
 
@@ -90,6 +119,48 @@ module Ace
           expanded == base || expanded.start_with?(base + File::SEPARATOR)
         end
 
+        # Resolve a configured path through symlinks so placement checks see
+        # the real location. Paths may not exist yet (an evidence sink is
+        # created on first use), so the deepest ancestor — counting symlink
+        # components themselves via lstat — is resolved instead of failing;
+        # a dangling symlink resolves through its own target chain rather
+        # than hiding behind its parent.
+        MAX_SYMLINK_DEPTH = 16
+
+        def resolved_path(path, depth = 0)
+          raise Ace::Lab::InvalidConfigurationError, "trusted policy path has a symlink cycle" if depth > MAX_SYMLINK_DEPTH
+          expanded = File.expand_path(path)
+          candidate = expanded
+          candidate = File.dirname(candidate) until candidate == "/" || lstat?(candidate)
+          resolved = begin
+            File.realpath(candidate)
+          rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
+            dangling_target(candidate, depth) || candidate
+          end
+          return resolved unless resolved == candidate && lstat?(candidate) && File.symlink?(candidate)
+          dangling_target(candidate, depth) || resolved
+        rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
+          expanded
+        end
+
+        # Follow a dangling symlink's own target chain; nil when the link
+        # cannot be resolved to any concrete location.
+        def dangling_target(link, depth = 0)
+          raise Ace::Lab::InvalidConfigurationError, "trusted policy path has a symlink cycle" if depth > MAX_SYMLINK_DEPTH
+          target = File.readlink(link)
+          target = File.expand_path(target, File.dirname(link)) unless Pathname.new(target).absolute?
+          resolved_path(target, depth + 1)
+        rescue Errno::ENOENT, Errno::EACCES
+          nil
+        end
+
+        def lstat?(path)
+          File.lstat(path)
+          true
+        rescue Errno::ENOENT
+          false
+        end
+
         def parse_time(value)
           Time.iso8601(value.to_s)
         rescue ArgumentError

data/lib/ace/lab/organisms/service_request_service.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "digest"
+require "fileutils"
 require "open3"
 require "ace/assign"
 
@@ -9,12 +11,19 @@ module Ace
       # Coordinates the generic request contract. ace-assign owns the durable
       # claim and receipt; this class never writes evidence files directly.
       class ServiceRequestService
-        def initialize(topology: nil, policy: nil, coordinator: nil, executor: nil, repo_root: Dir.pwd)
+        # Immutable request identity: a replay must match every field; the
+        # candidate head is deliberately absent because replays return the
+        # head recorded at claim time.
+        SERVICE_REPLAY_FIELDS = %w[project_id operation input_digest assignment_id attempt_id
+          target authorization caller_uid request_id].freeze
+
+        def initialize(topology: nil, policy: nil, coordinator: nil, executor: nil, repo_root: nil)
           @topology = topology || TopologyService.from_config
           @policy = policy
-          @coordinator = coordinator || Ace::Assign::Organisms::AttemptCoordinator.new(repo_root: repo_root)
+          @repo_root = repo_root || git_toplevel
+          @coordinator = coordinator ||
+            Ace::Assign::Organisms::AttemptCoordinator.new(repo_root: @repo_root)
           @executor = executor || Molecules::ServiceExecutor.new
-          @repo_root = repo_root
         end
 
         def request(project:, assignment:, attempt:, operation:, input_path:, authorization:, request_id:, dry_run: false)
@@ -24,6 +33,38 @@ module Ace
           end
           input = Atoms::ServiceInput.load(input_path)
           target = Atoms::ServiceInput.target(input)
+          # An identical retry returns the stored outcome — with the head
+          # recorded at claim time — without re-checking attempt, policy, or
+          # routing: a completed request must survive attempt terminality,
+          # authorization expiry, routing changes, and candidate-head
+          # advance. Any changed immutable field under the same request ID is
+          # a conflict, never a replay.
+          existing = @coordinator.service_request_status(request_id)
+          if existing
+            # Current project visibility gates replays: a revoked grant must
+            # not expose stored receipts, though the old operation route and
+            # authorization decision do not need to remain active.
+            visibility = @topology.services(project: project)
+            return visibility.envelope unless visibility.ok?
+            supplied = {"request_id" => request_id, "assignment_id" => assignment, "attempt_id" => attempt,
+                        "project_id" => project, "operation" => operation,
+                        "input_digest" => Atoms::ServiceInput.digest(input), "target" => target,
+                        "caller_uid" => Process.uid, "authorization" => authorization}
+            changed = SERVICE_REPLAY_FIELDS.find do |field|
+              existing[field] != supplied.fetch(field)
+            end
+            if changed
+              raise Ace::Assign::AttemptErrors::Conflict,
+                "Service request #{request_id} has different #{changed}"
+            end
+            if dry_run
+              # A preview of an existing request still validates current
+              # eligibility and reports itself as a dry run.
+              @coordinator.request_eligible!(existing)
+              return {"status" => "ok", "data" => result(existing).fetch("data").merge("dry_run" => true)}
+            end
+            return result(existing)
+          end
           route = @topology.route(project: project, capability: operation)
           return route.envelope unless route.ok?
           service_id = route.data.fetch("entry").fetch("id")
@@ -45,22 +86,52 @@ module Ace
             @coordinator.reject_service_request(binding, reason: "policy_rejected") unless dry_run
             raise
           end
+          # The trusted policy owns executor identity and transport; the
+          # journaled claim binds them so only that executor identity can
+          # later complete the receipt. A local operation whose configured
+          # executor is not this process is refused before any claim, so no
+          # authorization is consumed by a dispatch that cannot happen.
+          binding["executor_uid"] = operation_policy.fetch("executor_uid")
+          binding["transport"] = transport = operation_policy.fetch("transport", "local")
+          if transport == "local" &&
+              (Process.uid != binding["executor_uid"] || Process.euid != binding["executor_uid"])
+            # A preview records nothing: the durable rejection is only for
+            # real submissions, so the request ID stays reusable.
+            @coordinator.reject_service_request(binding, reason: "executor_identity_unavailable") unless dry_run
+            raise SecurityError, "current OS identity is not the configured executor"
+          end
 
           if dry_run
+            # The preview applies the same read-only eligibility checks as
+            # the claim — review evidence for external effects and the
+            # current candidate head — so it cannot promise acceptance for a
+            # request that would fail on submission.
+            @coordinator.request_eligible!(binding)
             preview = {"outcome" => "accepted", "dry_run" => true, "request_id" => request_id,
                        "project" => project, "operation" => operation, "service_id" => service_id,
                        "target" => target, "candidate_head" => head}
             return {"status" => "ok", "data" => preview}
           end
 
+          # The claim itself records uncertain (dispatch intent): a crash
+          # after the claim leaves uncertainty, never a stranded accepted
+          # state that a retry would return without dispatching.
           claimed = @coordinator.claim_service_request(binding)
-          return result(claimed) unless claimed["state"] == "accepted" && claimed["journal_commit"]
+          return result(claimed) unless claimed["state"] == "uncertain" && claimed["journal_commit"]
 
-          # From here, a crash or lost executor response must not authorize a
-          # replay. Record uncertainty before invoking an external process.
-          @coordinator.transition_service_request(request_id, state: "uncertain")
-          receipt = @executor.execute(operation: operation_policy, request: binding, input: input,
-            policy: policy, authorization: authorization)
+          # The executor reloads the trusted policy from disk at the effect
+          # boundary: a revocation after the claim must still stop dispatch.
+          begin
+            receipt = @executor.execute(operation: operation_policy, request: binding, input: input,
+              policy_loader: policy_loader, authorization: authorization,
+              head_loader: -> { current_head })
+          rescue SecurityError, Ace::Lab::InvalidConfigurationError => e
+            # Refusal before invocation: no effect was attempted. When this
+            # process is the executor identity (local transport), record a
+            # proven no-effect settlement instead of stranding uncertainty.
+            settle_pre_invocation_refusal(binding, request_id, e)
+            raise
+          end
           return result(@coordinator.service_request_status(request_id)) if receipt.nil?
 
           state = receipt.fetch("outcome")
@@ -97,6 +168,54 @@ module Ace
 
         private
 
+        # A refusal raised before the handler was invoked proves no effect
+        # was attempted. When this process runs as the executor identity
+        # (local transport), record the proven no-effect settlement with an
+        # executor-owned attestation; otherwise the claim stays uncertain
+        # for evidence-based reconciliation.
+        def settle_pre_invocation_refusal(binding, request_id, error)
+          return unless binding["transport"] == "local" && Process.uid == binding["executor_uid"]
+          evidence_dir = File.join(@repo_root, "evidence", "service")
+          FileUtils.mkdir_p(evidence_dir)
+          attestation = File.join(evidence_dir, "#{request_id}-no-effect")
+          content = "ace-service-attestation request:#{request_id} " \
+            "input:#{binding.fetch("input_digest")} outcome:failed no-effect:true\n" \
+            "refusal: #{error.message}\n"
+          # Exclusive creation without following symlinks: the caller-controlled
+          # request ID must never truncate an existing file, and the artifact
+          # must stay private to pass the executor-owned verification.
+          File.open(attestation, File::WRONLY | File::CREAT | File::EXCL, 0600) do |file|
+            file.write(content)
+          end
+          receipt = Models::ServiceReceipt.build(binding, {
+            "outcome" => "failed",
+            "evidence" => [{"ref" => "evidence/service/#{request_id}-no-effect",
+                            "sha256" => Digest::SHA256.hexdigest(content)}],
+            "executor_uid" => binding.fetch("executor_uid")
+          })
+          @coordinator.reconcile_service_no_effect(request_id, receipt: receipt)
+        rescue Ace::Assign::AttemptErrors::InvalidState, Ace::Assign::AttemptErrors::ReceiptRejected,
+               Ace::Assign::AttemptErrors::NotFound, Errno::ENOENT, Errno::EACCES, Errno::EEXIST
+          nil
+        end
+
+        # The Git toplevel (not a package directory that happens to hold a
+        # Rakefile) bounds evidence verification for nested invocations.
+        def git_toplevel
+          out, status = Open3.capture2("git", "rev-parse", "--show-toplevel")
+          (status&.success? ? out.strip : Dir.pwd)
+        rescue Errno::ENOENT
+          Dir.pwd
+        end
+
+        def policy_loader
+          if @policy
+            -> { @policy }
+          else
+            -> { Molecules::ServicePolicy.new(Molecules::GrantResolver.trusted_document(Ace::Lab.authorization_path)) }
+          end
+        end
+
         def validate_attempt!(binding)
           attempt = @coordinator.service_attempt(binding)
           unless attempt.candidate_head.nil? || attempt.candidate_head == binding["candidate_head"]
@@ -113,7 +232,10 @@ module Ace
         def result(request)
           public = request.slice("request_id", "assignment_id", "attempt_id", "project_id", "operation",
             "input_digest", "target", "candidate_head", "service_id", "state", "receipt")
-          {"status" => "ok", "data" => public.merge("outcome" => request.fetch("state"))}
+          # failed-settled is internal bookkeeping: the documented public
+          # outcome stays "failed"; the state field distinguishes settlement.
+          outcome = request.fetch("state") == "failed-settled" ? "failed" : request.fetch("state")
+          {"status" => "ok", "data" => public.merge("outcome" => outcome)}
         end
 
         def failure(code, message)

data/lib/ace/lab/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Lab
-    VERSION = "0.2.0"
+    VERSION = "0.3.1"
   end
 end

data/lib/ace/lab.rb

@@ -24,6 +24,7 @@ require_relative "lab/models/query_result"
 require_relative "lab/molecules/topology_loader"
 require_relative "lab/molecules/caller_authorizer"
 require_relative "lab/molecules/grant_resolver"
+require_relative "lab/molecules/hitl_authorizer"
 require_relative "lab/molecules/service_policy"
 require_relative "lab/molecules/service_executor"
 require_relative "lab/molecules/inventory_query"

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-lab
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-02 00:00:00.000000000 Z
+date: 2026-10-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-support-cli
@@ -57,14 +57,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.61'
+        version: '0.62'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.61'
+        version: '0.62'
 - !ruby/object:Gem::Dependency
   name: ace-support-test-helpers
   requirement: !ruby/object:Gem::Requirement
@@ -187,6 +187,7 @@ files:
 - lib/ace/lab/molecules/capability_router.rb
 - lib/ace/lab/molecules/exact_resolver.rb
 - lib/ace/lab/molecules/grant_resolver.rb
+- lib/ace/lab/molecules/hitl_authorizer.rb
 - lib/ace/lab/molecules/inventory_query.rb
 - lib/ace/lab/molecules/service_executor.rb
 - lib/ace/lab/molecules/service_policy.rb