ace-lab 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 521f7150bb3da5fcc12c475b5c2fce6c78808e78315e05731b43dc6632ffa599
-  data.tar.gz: 32a8f1106ff9321c5e6971411be50fad60497c770d7fcb38d19623e270700258
+  metadata.gz: bbfb351af77987d179094c39d14b12ac6209ba6825bc680e932df4fcf484684d
+  data.tar.gz: 92d60f3d735582fc4371569d1f2d19691820d924855564ac95ac71eba9e06ecf
 SHA512:
-  metadata.gz: e8e32415403e0235b9e6fd4f9862aed6b1577d98d651a5984ae10f3073be918248766542dca0dfe58555ecb0843d8d7df85e869b8751b9b28d5a28e447ca6cdd
-  data.tar.gz: a12d71e70fc25b27fb2b85aeda273713dcbcebb477b29ada5a415b2f007ec3368fa6d8b5d2c8e9258bca8d4e63e7ff9965efa0d05be0f9534bdd739284eb38e1
+  metadata.gz: a088f9ce2372cf71bfabe2df3f58b578ced3b1dae4f28ac1d791c90af64b4ac2795020e3d7ecbd8158cab7c75e2be6413250b22a7413459e466dc5d155404fe9
+  data.tar.gz: 38031154d986e6d25fcfac08ee890cf619553ff26536327b128076f4fbec7c862a76bf6e04c438aea2bd87a6eb566aa82299959809c44fefd00c1edb0ab7433f

data/CHANGELOG.md

@@ -7,12 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-10-05
+
+### Added
+
+- Protected service policy, receiver and authority composition; incomplete full-service startup remains refused.
+- Resolve immutable second-commander proposals through confirmed-delivery sixteen-hour policy and canonical Assign authorization.
+
+### Changed
+
+- Declare the required direct dependencies and minimum producer versions for this coordinated release: `ace-assign ~> 0.64`, `ace-runtime ~> 0.2`.
+
+## [0.3.1] - 2026-10-04
+
+### Changed
+- Track the runtime-neutral ace-assign 0.62 line (the published 0.3.0 still allows `~> 0.61`, which resolves 0.62 — this release ships the tightened constraint).
+
 ## [0.3.0] - 2026-10-04
 
 ### Added
 - **HITL delivery authorization policy (spec 8wq.t.34i)**: `Molecules::HitlAuthorizer` derives the lab-side transport facts (trusted transport uids, trusted HITL service identity, per-project Captain visibility) from the SAME trusted deployment document the grant resolver reads — uid-exact, project-scoped, never from claimed names or the cascade.
 
-
 ## [0.2.0] - 2026-10-02
 
 ### Added

data/lib/ace/lab/molecules/grant_resolver.rb

@@ -33,7 +33,9 @@ module Ace
               raise Ace::Lab::InvalidConfigurationError,
                 "invalid lab configuration: trusted authorization file must contain a mapping"
             end
-            document
+            # Use the same principal schema and the same verified bytes for
+            # policy composition, rather than reading a second grants snapshot.
+            document.merge("principals" => parse_grants(content, path).fetch("principals"))
           rescue Psych::Exception
             raise Ace::Lab::InvalidConfigurationError,
               "invalid lab configuration: trusted authorization file could not be parsed"

data/lib/ace/lab/molecules/protected_service_handler.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "json"
+require "open3"
+require "timeout"
+require "ace/assign/authority/private_directory"
+
+module Ace
+  module Lab
+    module Molecules
+      # Source-owned receiver handler. Permission admission is a separate
+      # authority operation; this runner never grants or reconstructs it.
+      class ProtectedServiceHandler
+        MAX_STDOUT = 16 * 1024
+        MAX_STDERR = 8 * 1024
+
+        def execute(operation:, envelope:, candidate_root:)
+          unless Process.uid == operation.fetch("executor_uid") && Process.euid == operation.fetch("executor_uid")
+            raise SecurityError, "handler executor differs"
+          end
+          root = Ace::Assign::Authority::PrivateDirectory.verify!(candidate_root)
+          out = nil
+          Open3.popen3({"PATH" => "/usr/bin:/bin", "LANG" => "C.UTF-8", "HOME" => root},
+            *operation.fetch("argv"), chdir: root, pgroup: true, unsetenv_others: true) do |stdin, stdout, stderr, waiter|
+            readers = []
+            begin
+              Timeout.timeout(30) do
+                readers = [Thread.new { bounded(stdout, MAX_STDOUT) }, Thread.new { bounded(stderr, MAX_STDERR) }]
+                stdin.write(JSON.generate(envelope))
+                stdin.close
+                output, errors = readers.map(&:value)
+                unless output && errors && waiter.value.success?
+                  return nil
+                end
+                out = output
+              end
+            rescue Timeout::Error, IOError, SystemCallError
+              return nil
+            ensure
+              stdin.close unless stdin.closed?
+              # This group is created and owned by this receiver. Termination
+              # is cleanup, never proof that an arbitrary handler left no effect.
+              Process.kill("KILL", -waiter.pid) rescue nil
+              waiter.value
+              [stdout, stderr].each { |io| io.close unless io.closed? }
+              readers.each(&:join)
+            end
+          end
+          response = JSON.parse(out)
+          request = envelope.fetch("request")
+          unless response.is_a?(Hash) && response.keys.sort == %w[evidence input_digest outcome request_id] &&
+              response["request_id"] == request.fetch("request_id") && response["input_digest"] == request.fetch("input_digest") &&
+              %w[succeeded failed].include?(response["outcome"]) && response["evidence"].is_a?(Array)
+            return nil
+          end
+          response
+        rescue JSON::ParserError
+          nil
+        end
+
+        private
+
+        def bounded(io, limit)
+          bytes = io.read(limit + 1).to_s
+          bytes.bytesize <= limit ? bytes : nil
+        rescue IOError, SystemCallError
+          nil
+        ensure
+          io.close unless io.closed?
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/molecules/protected_service_policy.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+require "json"
+require "etc"
+require "ace/assign"
+
+module Ace
+  module Lab
+    module Molecules
+      # The receiver and authority share the existing input/policy owners.
+      # Only composition supplies collaborators; no wire-selected policy,
+      # executable, input path or caller identity is accepted here.
+      class ProtectedServicePolicy
+        def initialize(proposal_resolver:, document_loader: nil)
+          @proposal_resolver = proposal_resolver
+          @document_loader = document_loader || -> { GrantResolver.trusted_document(Ace::Lab.authorization_path) }
+        end
+
+        def input_binding(bytes, expected_digest:, expected_target:)
+          unless bytes.is_a?(String) && bytes.bytesize.between?(1, Atoms::ServiceInput::MAX_BYTES)
+            raise ArgumentError, "structured service input exceeds its fixed limit"
+          end
+          input = JSON.parse(bytes)
+          raise ArgumentError, "structured service input must be an object" unless input.is_a?(Hash)
+          Atoms::ServiceInput.validate!(input)
+          digest = Atoms::ServiceInput.digest(input)
+          target = Atoms::ServiceInput.target(input)
+          unless digest == expected_digest && target == expected_target
+            raise SecurityError, "structured service input differs from the bound digest or target"
+          end
+          deep_freeze(input: input, input_digest: digest, target: target)
+        rescue JSON::ParserError
+          raise ArgumentError, "structured service input must be valid JSON"
+        end
+
+        def prepare!(binding, input_bytes:)
+          input = input_binding(input_bytes, expected_digest: binding.fetch("input_digest"), expected_target: binding.fetch("target"))
+          authorized = authorize!(binding)
+          canonical = snapshot(binding).merge("executor_uid" => authorized.fetch(:operation).fetch("executor_uid"), "transport" => "unix")
+          deep_freeze(authorized.merge(binding: canonical, input: input.fetch(:input)))
+        end
+
+        # Called again inside each claim/begin CAS retry using the immutable
+        # binding and ephemeral parsed input, never a caller filesystem path.
+        def authorize!(binding)
+          uid = binding.fetch("caller_uid")
+          document = visible_document!(project: binding.fetch("project_id"), uid: uid)
+          resolver = ->(reference, exact) { @proposal_resolver.call(binding.fetch("project_id"), reference, exact) }
+          policy = ServicePolicy.new(document, resolver)
+          operation = policy.operation!(binding.fetch("operation"), project: binding.fetch("project_id"), service_id: binding.fetch("service_id"))
+          unless operation.fetch("transport", "local") == "local"
+            raise Ace::Lab::InvalidConfigurationError, "protected receiver requires a fixed local handler operation"
+          end
+          unless operation.fetch("executor_uid").positive? && operation.fetch("executor_uid") != uid
+            raise SecurityError, "protected executor must be a separate nonroot account"
+          end
+          if binding.key?("executor_uid") && binding["executor_uid"] != operation.fetch("executor_uid")
+            raise SecurityError, "configured executor differs from the recorded claim"
+          end
+          decision = policy.authorize!(binding.fetch("authorization"), binding)
+          digest = Ace::Assign::Atoms::EvidenceDigest.digest("operation" => operation, "authorization" => decision,
+            "caller_uid" => uid, "project_id" => binding.fetch("project_id"))
+          if binding.key?("policy_digest") && binding["policy_digest"] != digest
+            raise SecurityError, "service policy changed after claim"
+          end
+          deep_freeze(operation: snapshot(operation), policy_digest: digest,
+            operation_digest: Ace::Assign::Atoms::EvidenceDigest.digest(operation))
+        end
+
+        def visible!(project:, uid:)
+          visible_document!(project: project, uid: uid)
+          true
+        end
+
+        def authorize_update!(existing, replacement, _pending)
+          initial_effect = existing.nil? && %w[accepted uncertain].include?(replacement["state"])
+          fresh_dispatch = existing && existing["dispatch_phase"] == "issued" && replacement["dispatch_phase"] == "dispatch_started"
+          authorize!(replacement) if initial_effect || fresh_dispatch
+          true
+        end
+
+        private
+
+        def visible_document!(project:, uid:)
+          raise SecurityError, "protected caller UID is invalid" unless uid.is_a?(Integer) && uid.positive?
+          username = begin
+            Etc.getpwuid(uid).name
+          rescue ArgumentError
+            nil
+          end
+          document = @document_loader.call
+          identities = CallerAuthorizer.matchable_identities(username, uid)
+          visibility = CallerAuthorizer.new(principals: document.fetch("principals", {}), identity: identities)
+          raise SecurityError, "caller project grant has been revoked" unless visibility.authorized?(project)
+          document
+        end
+
+        def snapshot(value)
+          JSON.parse(JSON.generate(value))
+        end
+
+        def deep_freeze(value)
+          case value
+          when Hash then value.each { |key, item| deep_freeze(key); deep_freeze(item) }
+          when Array then value.each { |item| deep_freeze(item) }
+          end
+          value.freeze
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/molecules/service_policy.rb

@@ -12,9 +12,10 @@ module Ace
         NAME = /\A[a-z][a-z0-9-]{0,63}\z/
         ID = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/
 
-        def initialize(document)
+        def initialize(document, proposal_resolver = nil)
           @operations = document.fetch("operations", {})
           @authorizations = document.fetch("authorizations", {})
+          @proposal_resolver = proposal_resolver
           unless @operations.is_a?(Hash) && @authorizations.is_a?(Hash)
             raise Ace::Lab::InvalidConfigurationError, "trusted service policy must contain mappings"
           end
@@ -80,6 +81,14 @@ module Ace
 
         def authorize!(reference, binding)
           raise ArgumentError, "invalid authorization reference" unless reference.to_s.match?(ID)
+          if reference.start_with?("proposal-")
+            raise SecurityError, "canonical proposal authority is unavailable" unless @proposal_resolver
+            begin
+              return @proposal_resolver.call(reference, binding)
+            rescue Ace::Assign::Error
+              raise SecurityError, "canonical proposal does not authorize this exact effect"
+            end
+          end
           decision = @authorizations[reference]
           raise SecurityError, "authorization reference is unresolved" unless decision.is_a?(Hash)
           required = %w[operation project_id assignment_id attempt_id input_digest target candidate_head caller_uid]

data/lib/ace/lab/organisms/authority_composition.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require "ace/assign/authority/server"
+require "ace/assign/authority/router"
+require "ace/assign/authority/launch_lifecycle"
+require "ace/assign/authority/endcap"
+require_relative "../molecules/protected_service_policy"
+
+module Ace
+  module Lab
+    module Organisms
+      # The only full-service composition. The deployed map chooses identity
+      # and placement; source selects all handlers, policy and evidence readers.
+      class AuthorityComposition
+        REQUIRED_ENDCAP = %w[submit_candidate export_candidate assign_review accept_review request_service
+          begin_dispatch complete_service complete_no_effect submit_result finish recover bind_inbox reconcile_inbox
+          service_status evidence_fetch].freeze
+
+        def initialize(authority_id:, deployment: Ace::Assign::Authority::Deployment.load,
+          kernel: Ace::Runtime::Molecules::ProtectedLinux.new)
+          @authority_id, @deployment, @kernel = authority_id, deployment, kernel
+        end
+
+        def build
+          @deployment.verify_composition!(@authority_id, composition: "services")
+          unless (REQUIRED_ENDCAP - Ace::Assign::Authority::Endcap::OPERATIONS).empty?
+            raise InvalidConfigurationError, "full-service source composition is incomplete"
+          end
+          projects = @deployment.data.fetch("launch_mappings").values
+            .select { |map| map.fetch("authority_id") == @authority_id }.map { |map| map.fetch("project_id") }.uniq
+          raise InvalidConfigurationError, "full-service authority has no projects" if projects.empty?
+          projects.each do |id|
+            project = @deployment.project(id)
+            unless project["service_receivers"].is_a?(Hash) && !project["service_receivers"].empty?
+              raise InvalidConfigurationError, "full-service project has no fixed receiver"
+            end
+          end
+
+          journals = {}
+          endcap = nil
+          projects.each do |id|
+            project = @deployment.project(id)
+            reader = nil
+            journal = Ace::Assign::Molecules::EvidenceJournal.new(repo_root: project.fetch("journal_repository"),
+              checkout_root: project.fetch("evidence_checkout_root"), ref: project.fetch("evidence_git_ref"), mode: :protected,
+              evidence_reader: ->(reference, record, state, pending) { reader.call(reference, record, state, pending) },
+              service_authorizer: ->(existing, replacement, pending) {
+                endcap.authorize_service_update!(journal: journals.fetch(id), existing: existing,
+                  replacement: replacement, pending: pending)
+              })
+            reader = Ace::Assign::Authority::ServiceEvidence.new(journal: journal)
+            journals[id] = journal
+          end
+          policy = Molecules::ProtectedServicePolicy.new(proposal_resolver: ->(project, reference, binding) {
+            journals.fetch(project).proposal_authorize!(reference, binding)
+          })
+          launch = Ace::Assign::Authority::LaunchLifecycle.new(deployment: @deployment, kernel: @kernel, journals: journals)
+          endcap = Ace::Assign::Authority::Endcap.new(deployment: @deployment, launch: launch, kernel: @kernel, service_policy: policy)
+          router = Ace::Assign::Authority::Router.new(launch: launch, handlers: [endcap])
+          Ace::Assign::Authority::Server.new(authority_id: @authority_id, deployment: @deployment, kernel: @kernel,
+            lifecycle: router, composition: "services")
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/organisms/protected_service_receiver.rb

@@ -0,0 +1,177 @@
+# frozen_string_literal: true
+
+require "json"
+require "digest"
+require "fileutils"
+require "ace/assign/authority/client"
+require "ace/assign/authority/candidate_transfer"
+require "ace/assign/authority/evidence_transfer"
+require_relative "../molecules/protected_service_handler"
+require_relative "../molecules/protected_service_policy"
+
+module Ace
+  module Lab
+    module Organisms
+      # Fixed executor-side orchestration. All durable permission and outcome
+      # state remains in the existing authority journal. Transport supplies
+      # the kernel peer; submitted actor strings are never accepted.
+      class ProtectedServiceReceiver
+        SUBMISSION = %w[assignment_id attempt_id expected_generation candidate_generation head request_id
+          operation input_digest target authorization].freeze
+
+        def initialize(mapping_id:, service_id:, deployment: Ace::Assign::Authority::Deployment.load,
+          kernel: Ace::Runtime::Molecules::ProtectedLinux.new, client: nil,
+          handler: Molecules::ProtectedServiceHandler.new)
+          @mapping_id, @service_id, @deployment, @kernel, @handler = mapping_id, service_id, deployment, kernel, handler
+          @map = deployment.mapping(mapping_id)
+          deployment.verify_composition!(@map.fetch("authority_id"), composition: "services")
+          @project = deployment.project(@map.fetch("project_id"))
+          @receiver = @project.fetch("service_receivers").fetch(service_id)
+          @client = client || Ace::Assign::Authority::Client.new(mapping_id: mapping_id, deployment: deployment, kernel: kernel)
+          @inputs = Molecules::ProtectedServicePolicy.new(proposal_resolver: ->(*) { raise SecurityError, "proposal decisions belong to authority" })
+        end
+
+        def execute(submission:, peer:, input_bytes:, mutation_id:)
+          contacted = false
+          request_id = nil
+          unless submission.is_a?(Hash) && submission.keys.sort == SUBMISSION.sort &&
+              peer.fetch("uid") == @map.fetch("worker_uid") && peer["gid"] == @map.fetch("worker_gid") &&
+              peer["groups"] == @map.fetch("worker_groups")
+            raise SecurityError, "receiver submission or peer differs"
+          end
+          params = immutable(submission.merge("service_id" => @service_id, "worker_process_binding" => peer))
+          id = params.fetch("request_id")
+          unless id.is_a?(String) && id.match?(Ace::Assign::Molecules::JournalMutation::ID)
+            raise ArgumentError, "receiver request identity is invalid"
+          end
+          request_id = id
+          peer = params.fetch("worker_process_binding")
+          @kernel.live!(peer)
+          me = @kernel.capture(Process.pid)
+          credentials = @project.fetch("peer_credentials").fetch(@receiver.fetch("executor_uid").to_s)
+          unless me["uid"] == @receiver["executor_uid"] && me["gid"] == credentials["gid"] && me["groups"] == credentials["groups"]
+            raise SecurityError, "receiver principal differs"
+          end
+          unless input_bytes.is_a?(String) && mutation_id.is_a?(String) && mutation_id.match?(Ace::Assign::Molecules::JournalMutation::ID)
+            raise ArgumentError, "receiver input or mutation identity is invalid"
+          end
+          bytes = input_bytes.dup.freeze
+          input = @inputs.input_binding(bytes, expected_digest: params.fetch("input_digest"), expected_target: params.fetch("target"))
+          contacted = true
+          claim = @client.call("request_service", params, mutation_id: mutation_id, upload_parts: [bytes], purpose: :service_input)
+          unless !claim.replayed && claim.data["claim"] == "created"
+            return projection(claim.data)
+          end
+          binding = params.slice("assignment_id", "attempt_id", "candidate_generation", "head", "request_id")
+          exported = @client.call("export_candidate", binding.except("request_id").merge("purpose_id" => params.fetch("request_id")),
+            download: true, purpose: :candidate, timeout: 30)
+          unless exported.parts.is_a?(Array) && exported.parts.length == 1
+            raise SecurityError, "candidate export is incomplete"
+          end
+          materialized = Ace::Assign::Authority::CandidateTransfer.new(root: @receiver.fetch("staging_root")).materialize(
+            bytes: exported.parts.first, sha256: exported.data.fetch("sha256"), size: exported.data.fetch("bytes"),
+            head: binding.fetch("head"), tree: exported.data.fetch("tree"), root: @receiver.fetch("staging_root"))
+          staging_identity = File.lstat(materialized.fetch("directory"))
+          begin_params = binding.merge("claim_binding" => claim.data.fetch("claim_binding"), "expected_generation" => claim.data.fetch("generation"))
+          started = @client.call("begin_dispatch", begin_params, mutation_id: Digest::SHA256.hexdigest("begin:#{mutation_id}"), upload_parts: [bytes], purpose: :service_input)
+          return projection(started.data) unless !started.replayed && started.data["invocation"] == "permitted"
+
+          document = Molecules::GrantResolver.trusted_document(Ace::Lab.authorization_path)
+          operation = Molecules::ServicePolicy.new(document).operation!(params.fetch("operation"),
+            project: @map.fetch("project_id"), service_id: @service_id)
+          authorization = @client.call("service_authorization", binding.merge("claim_binding" => claim.data.fetch("claim_binding"),
+            "input_digest" => params.fetch("input_digest")), upload_parts: [bytes], purpose: :service_input)
+          expected = binding.slice("head", "candidate_generation", "request_id").merge("claim_binding" => claim.data.fetch("claim_binding"),
+            "policy_digest" => claim.data.fetch("policy_digest"), "operation_digest" => Ace::Assign::Atoms::EvidenceDigest.digest(operation))
+          unless !authorization.replayed && authorization.data == expected
+            raise SecurityError, "current authority authorization differs"
+          end
+          # This successful fresh authority read is the admission point. A
+          # later veto cannot retroactively undo it; no read creates permission.
+          reloaded = Molecules::ServicePolicy.new(Molecules::GrantResolver.trusted_document(Ace::Lab.authorization_path)).operation!(
+            params.fetch("operation"), project: @map.fetch("project_id"), service_id: @service_id)
+          unless Ace::Assign::Atoms::EvidenceDigest.digest(reloaded) == expected.fetch("operation_digest")
+            raise SecurityError, "local operation changed after admission"
+          end
+          canonical = params.slice(*Ace::Assign::Molecules::EvidenceJournal::TERMINAL_BINDING_FIELDS, "authorization", "service_id").merge(
+            "project_id" => @map.fetch("project_id"), "candidate_head" => binding.fetch("head"),
+            "caller_uid" => peer.fetch("uid"), "executor_uid" => @receiver.fetch("executor_uid"), "transport" => "unix")
+          envelope = immutable("version" => 1, "request" => canonical, "input" => input.fetch(:input), "execution" => {
+            "executor_uid" => @receiver.fetch("executor_uid"), "authority_id" => @map.fetch("authority_id"),
+            "claim_binding" => claim.data.fetch("claim_binding"), "candidate_generation" => binding.fetch("candidate_generation"),
+            "head" => binding.fetch("head"), "staging_id" => File.basename(materialized.fetch("directory"))})
+          response = @handler.execute(operation: immutable(operation), envelope: envelope, candidate_root: materialized.fetch("directory"))
+          return uncertain(params.fetch("request_id")) unless response
+          artifacts = Ace::Assign::Authority::EvidenceTransfer.read_staged(root: materialized.fetch("directory"), evidence: response.fetch("evidence"))
+          receipt = canonical.slice(*Ace::Assign::Molecules::EvidenceJournal::TERMINAL_BINDING_FIELDS).merge(
+            "outcome" => response.fetch("outcome"), "evidence" => response.fetch("evidence"))
+          receipt_bytes = JSON.generate(receipt)
+          completion = @client.call("complete_service", binding.merge("claim_binding" => claim.data.fetch("claim_binding"),
+            "receipt_sha256" => Digest::SHA256.hexdigest(receipt_bytes)),
+            mutation_id: Digest::SHA256.hexdigest("complete:#{mutation_id}"), upload_parts: [receipt_bytes] + artifacts, purpose: :receipt_artifacts)
+          unless completion.data["request_id"] == request_id && %w[succeeded failed].include?(completion.data["state"])
+            return uncertain(request_id)
+          end
+          cleanup_staging(materialized.fetch("directory"), staging_identity)
+          projection(completion.data)
+        rescue Ace::Assign::Error, Ace::Runtime::RuntimeUnavailableError, Ace::Lab::InvalidConfigurationError,
+          SecurityError, ArgumentError, KeyError, SystemCallError
+          contacted ? uncertain(request_id) : {"request_id" => request_id, "state" => "refused", "code" => "invalid_receiver_admission"}
+        end
+
+        private
+
+        def cleanup_staging(directory, identity)
+          quarantine = nil
+          root = File.expand_path(@receiver.fetch("staging_root"))
+          Ace::Assign::Authority::PrivateDirectory.verify!(root)
+          current = File.lstat(directory)
+          return unless File.dirname(directory) == root && File.basename(directory).start_with?("candidate-") &&
+            current.directory? && current.uid == Process.uid && current.dev == identity.dev && current.ino == identity.ino
+          # Capture the pathname atomically before checking the object we will
+          # delete. A concurrent replacement at the original name must survive.
+          quarantine = Dir.mktmpdir(".receiver-cleanup-", root)
+          File.chmod(0o700, quarantine)
+          captured = File.join(quarantine, "candidate")
+          File.rename(directory, captured)
+          moved = File.lstat(captured)
+          return unless moved.directory? && moved.uid == Process.uid &&
+            moved.dev == identity.dev && moved.ino == identity.ino
+          FileUtils.remove_entry_secure(captured)
+        rescue Ace::Assign::Error, SystemCallError
+          # A cleanup failure cannot change already-confirmed canonical truth.
+          # Never fall back to cleaning the staging root or another directory.
+          nil
+        ensure
+          if quarantine
+            begin
+              # Never recursively remove a mismatched captured object.
+              Dir.rmdir(quarantine)
+            rescue SystemCallError
+              nil
+            end
+          end
+        end
+
+        def projection(data)
+          data.slice("request_id", "state", "dispatch_phase", "claim", "generation", "journal_commit")
+        end
+
+        def uncertain(id)
+          {"request_id" => id, "state" => "uncertain", "required_action" => "inspect_canonical_service_status_and_record_exact_outcome"}
+        end
+
+        def immutable(value)
+          copy = JSON.parse(JSON.generate(value))
+          freeze_value(copy)
+        end
+
+        def freeze_value(value)
+          value.each_value { |child| freeze_value(child) } if value.is_a?(Hash)
+          value.each { |child| freeze_value(child) } if value.is_a?(Array)
+          value.freeze
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/organisms/service_request_service.rb

@@ -69,7 +69,8 @@ module Ace
           return route.envelope unless route.ok?
           service_id = route.data.fetch("entry").fetch("id")
           trusted = Molecules::GrantResolver.trusted_document(Ace::Lab.authorization_path) unless @policy
-          policy = @policy || Molecules::ServicePolicy.new(trusted)
+          policy = @policy || Molecules::ServicePolicy.new(trusted,
+            ->(reference, exact) { @coordinator.proposal_authorization(reference, exact) })
           head = current_head
           binding = {"request_id" => request_id, "assignment_id" => assignment, "attempt_id" => attempt,
                      "project_id" => project, "operation" => operation,
@@ -212,7 +213,8 @@ module Ace
           if @policy
             -> { @policy }
           else
-            -> { Molecules::ServicePolicy.new(Molecules::GrantResolver.trusted_document(Ace::Lab.authorization_path)) }
+            -> { Molecules::ServicePolicy.new(Molecules::GrantResolver.trusted_document(Ace::Lab.authorization_path),
+              ->(reference, exact) { @coordinator.proposal_authorization(reference, exact) }) }
           end
         end
 

data/lib/ace/lab/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Lab
-    VERSION = "0.3.0"
+    VERSION = "0.4.0"
   end
 end

metadata

@@ -1,14 +1,28 @@
 --- !ruby/object:Gem::Specification
 name: ace-lab
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-04 00:00:00.000000000 Z
+date: 2026-10-05 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: ace-runtime
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.2'
 - !ruby/object:Gem::Dependency
   name: ace-support-cli
   requirement: !ruby/object:Gem::Requirement
@@ -57,14 +71,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.61'
+        version: '0.64'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.61'
+        version: '0.64'
 - !ruby/object:Gem::Dependency
   name: ace-support-test-helpers
   requirement: !ruby/object:Gem::Requirement
@@ -189,9 +203,13 @@ files:
 - lib/ace/lab/molecules/grant_resolver.rb
 - lib/ace/lab/molecules/hitl_authorizer.rb
 - lib/ace/lab/molecules/inventory_query.rb
+- lib/ace/lab/molecules/protected_service_handler.rb
+- lib/ace/lab/molecules/protected_service_policy.rb
 - lib/ace/lab/molecules/service_executor.rb
 - lib/ace/lab/molecules/service_policy.rb
 - lib/ace/lab/molecules/topology_loader.rb
+- lib/ace/lab/organisms/authority_composition.rb
+- lib/ace/lab/organisms/protected_service_receiver.rb
 - lib/ace/lab/organisms/service_request_service.rb
 - lib/ace/lab/organisms/topology_service.rb
 - lib/ace/lab/version.rb