ace-lab 0.3.1 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1cd47480daa53d48cead3bb733e54223a0614394f27614248829ee4566a71da3
-  data.tar.gz: 6960967135776f222d2b2c638a0317e3a2b1afceb811155046f87fb41d476d65
+  metadata.gz: 6e017c2a3431b82dc516951d8a3acc00eb8aac7965c037d921edd2c7b5f5a8a0
+  data.tar.gz: 53c907e67ab172535e09c7e046f939b1f59d8cf01cc2f18e0f6d0b1540cc8b4b
 SHA512:
-  metadata.gz: 10939c1ffa2ca6045f8f6e526f9fc96be4dba7c4d453e483a785e4570c57356ad6f3bfaf62cf8b4a20c0373cce8f5a261d18ec77ec2607393bcc3cc1facd2e21
-  data.tar.gz: 5f0d847b422a83437fd6431de880b7aa4f6e72c44dff00df9e0d359a85ba30600e0f70dbcb31d910ae34aa1f2a8a0419867c9b018f78b53273e588cc6645098e
+  metadata.gz: e3d6659be2c485710cca9d405e592c9783ab8cc07fd79aa23aa32e29a69d968f867889a540be6e5a7b3591b785853e9e1cff5f0ad19c75995e0f56950ffbf13a
+  data.tar.gz: c7e9961a4c48a8ae919ab3813286022897793ac1b52859bd8f634de7a2a4084531e521fc6039cdd9b2c81591a82621a81339dbdee94cffccacae06ad0a8c4fc1

data/CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.0] - 2026-10-08
+
+### Added
+
+- Deliver scoped RubyGems publication through the fixed receiver and canonical HITL authorization, preserving original request, OTP challenge and publication-result evidence.
+
+### Changed
+
+- Compose actual service/result owners without a read-proof completion handler; retain authenticated service settlement and cleanup boundaries.
+
+### Fixed
+
+- Load protected policy/listener dependencies directly and keep cleanup inspection tied to the original receiver and immutable result evidence.
+
+## [0.4.0] - 2026-10-05
+
+### Added
+
+- Protected service policy, receiver and authority composition; incomplete full-service startup remains refused.
+- Resolve immutable second-commander proposals through confirmed-delivery sixteen-hour policy and canonical Assign authorization.
+
+### Changed
+
+- Declare the required direct dependencies and minimum producer versions for this coordinated release: `ace-assign ~> 0.64`, `ace-runtime ~> 0.2`.
+
 ## [0.3.1] - 2026-10-04
 
 ### Changed

data/docs/usage.md

@@ -282,3 +282,13 @@ reads; it never provisions.
 
   `ace-assign`'s evidence journal. The Lab execution binary
   (`/usr/local/bin/lab`) is never invoked or required.
+
+### Protected handler cleanup boundary
+
+Handlers retain the fixed closed environment and 30-second execution deadline, with 16KiB stdout and 8KiB stderr caps. Owned cleanup adds at most one second of confirmed reaping; unresolved cleanup remains uncertain and cannot return a service receipt. It cannot establish an arbitrary domain target or surviving writer is absent. The gad.b operation-specific fresh inspector remains required source work; installed verification is centralized in gad.2.
+
+### Selected receiver no-effect recovery
+
+The existing protected receiver exposes `recover_no_effect(binding:, input_bytes:, mutation_id:, expected_generation:)`. Supply the original assignment/attempt/candidate/head/request binding, original structured input, stable mutation ID and unchanged original positive authority generation. The receiver snapshots those inputs, authenticates canonical status and input before any settled return, and adopts an already accepted current challenge without claiming again. A needed claim uses the supplied generation unchanged. Lost acknowledgements remain uncertain; status retry never repeats the original effect.
+
+Trusted operation configuration must provide a distinct fixed `no_effect_argv` for the original project/service/executor. Inspection may proceed after the effect lease expires, but it never renews effect permission or selects normal effect argv. The selected inspector must produce operation-specific original target/handler/writer observations and existing strict challenge-bound artifacts; only the authority's canonical import can establish `failed-settled`. This source API and controlled composition do not deliver the outstanding gad.b inspector or installed acceptance.

data/lib/ace/lab/atoms/protected_publication_input.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require_relative "service_input"
+
+module Ace
+  module Lab
+    module Atoms
+      # One accepted artifact, never a queue selector or a build instruction.
+      module ProtectedPublicationInput
+        REGISTRY = "https://rubygems.org"
+        PUBLICATION_FIELDS = %w[gem_name version head registry artifact_relative_path].freeze
+        NAME = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/
+        VERSION = /\A[0-9]+(?:\.[0-9A-Za-z]+)*(?:-[0-9A-Za-z]+(?:\.[0-9A-Za-z]+)*)?\z/
+
+        def self.decode!(bytes)
+          unless bytes.is_a?(String) && bytes.bytesize.between?(1, ServiceInput::MAX_BYTES)
+            raise ArgumentError, "publication input exceeds its bound"
+          end
+          input = JSON.parse(bytes, allow_duplicate_key: false, allow_comments: false,
+            allow_nan: false, create_additions: false, max_nesting: 16)
+          validate!(input)
+        rescue JSON::ParserError
+          raise ArgumentError, "publication input must be valid JSON"
+        end
+
+        def self.validate!(input)
+          unless input.is_a?(Hash) && input.keys.sort == %w[publication target] &&
+              input["publication"].is_a?(Hash) && input["publication"].keys.sort == PUBLICATION_FIELDS.sort &&
+              input["target"].is_a?(Hash) && input["target"].keys.sort == %w[artifact_digest resource]
+            raise ArgumentError, "publication input fields differ"
+          end
+          value = input.fetch("publication")
+          name, version, head, registry, path = value.values_at(*PUBLICATION_FIELDS)
+          unless name.is_a?(String) && name.match?(NAME) && version.is_a?(String) &&
+              version.bytesize.between?(1, 128) && version.match?(VERSION) &&
+              head.is_a?(String) && head.match?(/\A[0-9a-f]{40}\z/) && registry == REGISTRY &&
+              path.is_a?(String) && path.bytesize.between?(1, 4096) && path.end_with?(".gem") &&
+              path.split("/", -1).all? { |part| part.match?(/\A[a-zA-Z0-9_.-]+\z/) && !%w[. ..].include?(part) } &&
+              input.dig("target", "resource") == "rubygems:#{name}:#{version}" &&
+              input.dig("target", "artifact_digest").is_a?(String) &&
+              input.dig("target", "artifact_digest").match?(ServiceInput::SHA256)
+            raise ArgumentError, "publication artifact selection differs"
+          end
+          ServiceInput.validate!(input)
+          input
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/atoms/protected_workspace_prune_input.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Ace
+  module Lab
+    module Atoms
+      # Structural input validation only. Canonical ownership, preservation and
+      # current permission are independently verified by the operation owners.
+      module ProtectedWorkspacePruneInput
+        MAX_BYTES = 65_536
+        ID = /\A[A-Za-z0-9_.-]{1,200}\z/
+        SHA = /\A[0-9a-f]{64}\z/
+        COMMIT = /\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/
+        ASSOCIATION = %w[project_id mapping_id assignment_id attempt_id].freeze
+
+        module_function
+
+        def parse(bytes)
+          reject! unless bytes.is_a?(String) && bytes.bytesize.between?(1, MAX_BYTES)
+          text = bytes.dup.force_encoding(Encoding::UTF_8)
+          reject! unless text.valid_encoding?
+          input = JSON.parse(text, create_additions: false, max_nesting: 16,
+            allow_nan: false, allow_comments: false, allow_duplicate_key: false)
+          object!(input, %w[schema maintenance target publication preservation])
+          reject! unless input.fetch("schema") == "ace.protected-workspace-prune/v1"
+          association!(input.fetch("maintenance"))
+          target = object!(input.fetch("target"), ASSOCIATION +
+            %w[resource artifact_digest descriptor_sha256 binding_event_digest release_event_digest journal_commit])
+          ASSOCIATION.each { |field| token!(target.fetch(field)) }
+          %w[artifact_digest descriptor_sha256 binding_event_digest release_event_digest].each { |key| digest!(target.fetch(key)) }
+          commit!(target.fetch("journal_commit"))
+          resource = "workspace:#{target.fetch('project_id')}:#{target.fetch('mapping_id')}:#{target.fetch('assignment_id')}"
+          reject! unless resource.bytesize <= 256 && target.fetch("resource") == resource
+          publication = object!(input.fetch("publication"), %w[descriptor_sha256 installation_ref])
+          digest!(publication.fetch("descriptor_sha256"))
+          reference!(publication.fetch("installation_ref"))
+          preservation!(input.fetch("preservation"))
+          freeze_value(input)
+        rescue JSON::ParserError, JSON::NestingError, EncodingError
+          reject!
+        end
+
+        def preservation!(value)
+          object!(value, %w[head branch destinations manifest_sha256])
+          commit!(value.fetch("head"))
+          branch = value.fetch("branch")
+          unless branch.nil?
+            ref!(branch)
+            reject! unless branch.start_with?("refs/heads/")
+          end
+          digest!(value.fetch("manifest_sha256"))
+          destinations = value.fetch("destinations")
+          reject! unless destinations.is_a?(Array) && destinations.length <= 64
+          identities = destinations.map do |entry|
+            object!(entry, %w[repository_id ref head])
+            token!(entry.fetch("repository_id"))
+            ref!(entry.fetch("ref"))
+            commit!(entry.fetch("head"))
+            entry.values_at("repository_id", "ref", "head")
+          end
+          reject! unless identities == identities.sort && identities.uniq == identities
+        end
+
+        def association!(value)
+          object!(value, ASSOCIATION)
+          value.each_value { |item| token!(item) }
+        end
+
+        def reference!(value)
+          object!(value, %w[path bytes sha256])
+          path = value.fetch("path")
+          reject! unless path.is_a?(String) && path.bytesize.between?(2, 4096) &&
+            path.start_with?("/") && !path.include?("\0") && !path.end_with?("/") &&
+            path.split("/", -1).drop(1).all? { |part| !part.empty? && !%w[. ..].include?(part) }
+          reject! unless value.fetch("bytes").is_a?(Integer) && value.fetch("bytes").between?(1, MAX_BYTES)
+          digest!(value.fetch("sha256"))
+        end
+
+        def object!(value, fields)
+          reject! unless value.is_a?(Hash) && value.keys.sort == fields.sort
+          value
+        end
+
+        def token!(value)
+          reject! unless value.is_a?(String) && ID.match?(value)
+        end
+
+        def digest!(value)
+          reject! unless value.is_a?(String) && SHA.match?(value)
+        end
+
+        def commit!(value)
+          reject! unless value.is_a?(String) && COMMIT.match?(value)
+        end
+
+        def ref!(value)
+          reject! unless value.is_a?(String) && value.bytesize.between?(6, 256) &&
+            value.start_with?("refs/") && !value.match?(/[\x00-\x20\x7f~^:?*\[\\]/) &&
+            !value.include?("..") && !value.include?("@{") && !value.end_with?(".") &&
+            value.split("/", -1).all? { |part| !part.empty? && !part.start_with?(".") && !part.end_with?(".lock") }
+        end
+
+        def freeze_value(value)
+          value.each { |key, item| key.freeze; freeze_value(item) } if value.is_a?(Hash)
+          value.each { |item| freeze_value(item) } if value.is_a?(Array)
+          value.freeze
+        end
+
+        def reject! = raise(ArgumentError, "invalid protected prune input")
+      end
+    end
+  end
+end

data/lib/ace/lab/atoms/protected_workspace_prune_preview.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require_relative "protected_workspace_prune_input"
+require "ace/assign/molecules/execution_scope_lineage"
+require "ace/assign/atoms/evidence_digest"
+
+module Ace
+  module Lab
+    module Atoms
+      # Closed transport data only; canonical and physical owners must
+      # independently authenticate these selectors before any effect.
+      module ProtectedWorkspacePrunePreview
+        Input = ProtectedWorkspacePruneInput
+        CONTEXT = %w[journal_commit maintenance head candidate_generation worker_process_binding caller_process_binding].freeze
+        RESULT = %w[schema kind intent_digest publication maintenance maintenance_context target preservation inventory_sha256 file_count total_bytes].freeze
+        module_function
+
+        def intent!(value)
+          Input.object!(value, %w[schema maintenance target publication destinations])
+          Input.reject! unless value["schema"] == "ace.protected-workspace-prune-preview/v1"
+          Input.association!(value.fetch("maintenance"))
+          target = value.fetch("target")
+          Input.object!(target, Input::ASSOCIATION + %w[resource descriptor_sha256 binding_event_digest release_event_digest journal_commit])
+          Input::ASSOCIATION.each { |key| Input.token!(target.fetch(key)) }
+          %w[descriptor_sha256 binding_event_digest release_event_digest].each { |key| Input.digest!(target.fetch(key)) }
+          Input.commit!(target.fetch("journal_commit"))
+          expected = "workspace:#{target.fetch('project_id')}:#{target.fetch('mapping_id')}:#{target.fetch('assignment_id')}"
+          Input.reject! unless expected.bytesize <= 256 && target["resource"] == expected
+          publication = Input.object!(value.fetch("publication"), %w[descriptor_sha256 installation_ref])
+          Input.digest!(publication.fetch("descriptor_sha256"))
+          Input.reference!(publication.fetch("installation_ref"))
+          # Reuse the existing exact destination/ref owner, without accepting
+          # or manufacturing a preservation authority assertion.
+          destinations!(value.fetch("destinations"))
+          Input.reject! if JSON.generate(value).bytesize > Input::MAX_BYTES
+          Input.freeze_value(value)
+        end
+
+        def destinations!(destinations)
+          Input.reject! unless destinations.is_a?(Array) && destinations.length <= 64
+          ids = destinations.map do |entry|
+            Input.object!(entry, %w[repository_id ref head])
+            Input.token!(entry.fetch("repository_id")); Input.ref!(entry.fetch("ref")); Input.commit!(entry.fetch("head"))
+            entry.values_at("repository_id", "ref", "head")
+          end
+          Input.reject! unless ids == ids.sort && ids == ids.uniq
+        end
+
+        def context!(value)
+          Input.object!(value, CONTEXT)
+          Input.commit!(value.fetch("journal_commit"))
+          Input.association!(value.fetch("maintenance"))
+          Input.commit!(value.fetch("head"))
+          Input.reject! unless value["candidate_generation"].is_a?(Integer) && value["candidate_generation"].positive?
+          original = value.fetch("worker_process_binding")
+          birth = original.is_a?(Hash) && original["started_at"]
+          boot = birth.is_a?(String) && birth.match(/\Alinux:([0-9a-f-]{36}):[0-9]+\z/)&.captures&.first
+          %w[worker_process_binding caller_process_binding].each do |key|
+            Ace::Assign::Molecules::ExecutionScopeLineage.validate_process_identity!(value.fetch(key), boot_id: boot)
+          end
+          Input.reject! if JSON.generate(value).bytesize > 16_384
+          Input.freeze_value(value)
+        end
+
+        def result!(value, intent:, context:)
+          Input.object!(value, RESULT)
+          Input.reject! unless value.values_at("schema", "kind") == ["ace.protected-workspace-prune-preview-result/v1", "preview"]
+          Input.reject! unless value["intent_digest"] == Ace::Assign::Atoms::EvidenceDigest.digest(intent) &&
+            value["maintenance_context"] == context && value["maintenance"] == intent["maintenance"] &&
+            value["publication"] == intent["publication"] && value.fetch("target").except("artifact_digest") == intent["target"]
+          input = {"schema" => "ace.protected-workspace-prune/v1"}.merge(value.slice("maintenance", "target", "publication", "preservation"))
+          Input.parse(JSON.generate(input))
+          Input.digest!(value.fetch("inventory_sha256"))
+          Input.reject! unless value["inventory_sha256"] == value.dig("preservation", "manifest_sha256")
+          Input.reject! unless value["file_count"].is_a?(Integer) && value["file_count"].between?(0, 4096) &&
+            value["total_bytes"].is_a?(Integer) && value["total_bytes"].between?(0, 256 * 1024 * 1024)
+          Input.reject! unless value.dig("preservation", "destinations") == intent["destinations"] &&
+            value.dig("target", "artifact_digest") == Ace::Assign::Atoms::EvidenceDigest.digest(
+              "target" => intent.fetch("target"), "preservation" => value.fetch("preservation"))
+          Input.reject! if JSON.generate(value).bytesize > 16_384
+          Input.freeze_value(value)
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/atoms/service_input.rb

@@ -15,16 +15,22 @@ module Ace
         RESOURCE = /\A[a-zA-Z0-9_.:\/-]{1,256}\z/
 
         def self.load(path)
-          raise ArgumentError, "input file is missing" unless File.file?(path)
-          # One handle bounds the read: a file replaced or grown between a
-          # size check and a separate read cannot bypass the limit.
           begin
-            data = File.open(path, "rb") do |file|
-              content = file.read(MAX_BYTES + 1)
-              raise ArgumentError, "input exceeds #{MAX_BYTES} bytes" if content && content.bytesize > MAX_BYTES
-              JSON.parse(content.to_s)
+            flags = File::RDONLY | File::NOFOLLOW | File::NONBLOCK
+            data = File.open(path, flags) do |file|
+              before = file.stat
+              unless before.file? && before.size <= MAX_BYTES && same_file?(before, File.lstat(path))
+                raise ArgumentError, "input must be a bounded regular file"
+              end
+              content = file.read(MAX_BYTES + 1).to_s
+              unless content.bytesize <= MAX_BYTES && same_file?(before, file.stat) &&
+                  same_file?(before, File.lstat(path))
+                raise ArgumentError, "input file changed while reading"
+              end
+              JSON.parse(content, allow_duplicate_key: false, allow_comments: false,
+                allow_nan: false, create_additions: false, max_nesting: 16)
             end
-          rescue Errno::EACCES, Errno::EISDIR
+          rescue SystemCallError, IOError
             raise ArgumentError, "input file is unreadable"
           end
           raise ArgumentError, "input must be a JSON object" unless data.is_a?(Hash)
@@ -34,6 +40,12 @@ module Ace
           raise ArgumentError, "input must be valid JSON"
         end
 
+        def self.same_file?(left, right)
+          [left.dev, left.ino, left.mode, left.uid, left.gid, left.size, left.mtime, left.ctime] ==
+            [right.dev, right.ino, right.mode, right.uid, right.gid, right.size, right.mtime, right.ctime]
+        end
+        private_class_method :same_file?
+
         def self.digest(data)
           Digest::SHA256.hexdigest(JSON.generate(canonical(data)))
         end

data/lib/ace/lab/authorization_path.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Ace
+  module Lab
+    # Authorization grants live in a single deployment-controlled file at a
+    # FIXED path — never in the caller-writable configuration cascade and
+    # never at a caller-selected location (review rounds 4-5, F3/F1). The
+    # file must be root-owned and not group/world-writable, including every
+    # directory on its real path; GrantResolver verifies and fails closed.
+    AUTHORIZATION_PATH = "/etc/lab/ace-lab/authorization.yml"
+
+    # Path of the trusted authorization grants document. A method (not a
+    # bare constant reference) so tests can stub the seam without any
+    # caller-controllable production override.
+    # @return [String]
+    def self.authorization_path
+      AUTHORIZATION_PATH
+    end
+  end
+end

data/lib/ace/lab/cli/commands/service.rb

@@ -3,6 +3,7 @@
 require "json"
 require "ace/support/cli"
 require_relative "support"
+require_relative "../../organisms/protected_service_request"
 
 module Ace
   module Lab
@@ -14,6 +15,16 @@ module Ace
               @service ||= Organisms::ServiceRequestService.new
             end
 
+            def protected_service
+              @protected_service ||= Organisms::ProtectedServiceRequest.new
+            end
+
+            def protected_refusal(error)
+              code = error.is_a?(ArgumentError) || error.is_a?(SecurityError) ? "protected_service_refused" : "protected_service_unavailable"
+              message = error.is_a?(JSON::ParserError) ? "protected installed selection unavailable" : error.message.to_s.scrub[0, 512]
+              emit({"status" => "error", "error" => {"code" => code, "message" => message}})
+            end
+
             def emit(envelope)
               puts JSON.generate(envelope)
               return if envelope["status"] == "ok"
@@ -39,11 +50,26 @@ module Ace
             option :request_id, type: :string, required: true, desc: "Idempotency key"
             option :dry_run, type: :boolean, desc: "Validate without claiming or executing"
 
+            option :mapping, type: :string, desc: "Original protected mapping ID"
+            option :scope, type: :string, desc: "Original hierarchical prepared scope"
+            option :service, type: :string, desc: "Installed receiver ID"
+            option :candidate_head, type: :string, desc: "Exact approved candidate head"
+            option :candidate_generation, type: :integer, desc: "Original candidate generation"
+            option :expected_generation, type: :integer, desc: "Original authority generation"
+
             def call(project:, assignment:, attempt:, operation:, input:, authorization:, request_id:, **options)
               reject_identity_flags!(options)
+              selected = protected_service.selected?(options)
+              if selected
+                return emit(protected_service.request(project: project, assignment: assignment, attempt: attempt,
+                  operation: operation, input_path: input, authorization: authorization, request_id: request_id, **options))
+              end
               emit(service.request(project: project, assignment: assignment, attempt: attempt,
                 operation: operation, input_path: input, authorization: authorization,
                 request_id: request_id, dry_run: options[:dry_run]))
+            rescue ArgumentError, Ace::Assign::Error, Ace::Git::Error, Ace::Runtime::RuntimeUnavailableError, JSON::ParserError, SecurityError, KeyError, SystemCallError => error
+              raise if selected == false
+              protected_refusal(error)
             end
           end
 
@@ -56,9 +82,28 @@ module Ace
             option :request, type: :string, required: true, desc: "Request ID"
             option :format, type: :string, desc: "Output format (json only)"
 
+            option :project, type: :string, desc: "Original project ID"
+            option :assignment, type: :string, desc: "Original assignment ID"
+            option :attempt, type: :string, desc: "Original attempt ID"
+            option :mapping, type: :string, desc: "Original protected mapping ID"
+            option :scope, type: :string, desc: "Original hierarchical prepared scope"
+            option :candidate_head, type: :string, desc: "Exact approved candidate head"
+            option :candidate_generation, type: :integer, desc: "Original candidate generation"
+            option :input_digest, type: :string, desc: "Original normalized input SHA-256"
+            option :target, type: :string, desc: "Original target resource ID"
+            option :artifact_digest, type: :string, desc: "Original artifact SHA-256 (omit for null)"
+
             def call(request:, **options)
+              reject_identity_flags!(options)
               ensure_json_format!(options)
+              selected = protected_service.selected?(options)
+              if selected
+                return emit(protected_service.status(request_id: request, **options))
+              end
               emit(service.status(request_id: request))
+            rescue ArgumentError, Ace::Assign::Error, Ace::Git::Error, Ace::Runtime::RuntimeUnavailableError, JSON::ParserError, SecurityError, KeyError, SystemCallError => error
+              raise if selected == false
+              protected_refusal(error)
             end
           end
         end

data/lib/ace/lab/errors.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Ace
+  module Lab
+    class Error < StandardError; end
+
+    # Raised when topology configuration violates the schema contract
+    class InvalidConfigurationError < Error; end
+  end
+end
+

data/lib/ace/lab/molecules/grant_resolver.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
+require_relative "../errors"
 require "yaml"
+require "date"
 
 module Ace
   module Lab
@@ -33,7 +35,9 @@ module Ace
               raise Ace::Lab::InvalidConfigurationError,
                 "invalid lab configuration: trusted authorization file must contain a mapping"
             end
-            document
+            # Use the same principal schema and the same verified bytes for
+            # policy composition, rather than reading a second grants snapshot.
+            document.merge("principals" => parse_grants(content, path).fetch("principals"))
           rescue Psych::Exception
             raise Ace::Lab::InvalidConfigurationError,
               "invalid lab configuration: trusted authorization file could not be parsed"