ace-lab 0.3.1 → 0.5.0

data/lib/ace/lab/molecules/protected_publication_publisher.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+require "json"
+require "digest"
+require "net/http"
+require "timeout"
+require "rubygems/package"
+require "etc"
+require "ace/herdr/molecules/bounded_process"
+require "ace/assign/authority/private_directory"
+
+module Ace
+  module Lab
+    module Molecules
+      # The admitted receiver owns permission. This boundary only invokes the
+      # existing single-artifact publisher and independently checks registry bytes.
+      class ProtectedPublicationPublisher
+        def initialize(process: Ace::Herdr::Molecules::BoundedProcess, http: Net::HTTP)
+          @process, @http = process, http
+        end
+
+        def verify!(publication:, artifact_digest:, platform:, deadline:)
+          remaining = remaining!(deadline)
+          path = "/api/v2/rubygems/#{publication.fetch('gem_name')}/versions/#{publication.fetch('version')}.json?platform=#{URI.encode_www_form_component(platform)}"
+          connection = @http.new("rubygems.org", 443, nil)
+          connection.use_ssl = true
+          connection.open_timeout = remaining
+          connection.read_timeout = remaining
+          connection.write_timeout = remaining
+          connection.max_retries = 0
+          response = nil
+          body = +""
+          Timeout.timeout(remaining, IOError) do
+            connection.start do |session|
+              connection.read_timeout = remaining!(deadline)
+            session.request(Net::HTTP::Get.new(path)) do |received|
+              response = received
+              received.read_body do |chunk|
+                remaining!(deadline)
+                raise IOError, "registry response exceeds bound" if body.bytesize + chunk.bytesize > 65_536
+                body << chunk
+                connection.read_timeout = remaining!(deadline)
+              end
+            end
+          end
+          end
+          remaining!(deadline)
+          return result("absent", "registry_version_absent") if response.is_a?(Net::HTTPNotFound)
+          return result("uncertain", "registry_verification_unavailable") unless response.is_a?(Net::HTTPSuccess)
+          value = JSON.parse(body, object_class: UniqueObject, max_nesting: 16)
+          unless value.is_a?(Hash) && value["name"] == publication.fetch("gem_name") &&
+              value["version"] == publication.fetch("version") && value["platform"] == platform &&
+              value["sha"].is_a?(String) && value["sha"].match?(/\A[0-9a-f]{64}\z/) && value["yanked"] == false
+            return result("uncertain", "registry_verification_invalid")
+          end
+          value["sha"] == artifact_digest ? result("succeeded", "registry_exact_artifact") : result("failed", "registry_artifact_conflict")
+        rescue StandardError
+          result("uncertain", "registry_verification_unavailable")
+        end
+
+        def push!(operation:, publication:, artifact:, artifact_digest:, otp:, deadline:)
+          unless Process.uid == operation.fetch("executor_uid") && Process.euid == Process.uid &&
+              operation.fetch("argv").last == "--scoped-publication" &&
+              (otp.nil? || otp.is_a?(String) && otp.match?(/\A[0-9]{6}\z/))
+            raise SecurityError, "fixed publication executor differs"
+          end
+          environment = {"PATH" => "/usr/bin:/bin", "LANG" => "C.UTF-8", "HOME" => Etc.getpwuid(Process.uid).dir}
+          environment["GEM_HOST_OTP_CODE"] = otp if otp
+          input = {"artifact" => artifact, "artifact_digest" => artifact_digest,
+            "gem_name" => publication.fetch("gem_name"), "version" => publication.fetch("version")}
+          process = @process.call(operation.fetch("argv"), stdin_data: JSON.generate(input),
+            timeout_s: [remaining!(deadline), 30].min, output_limit: 1024, stderr_limit: 1024,
+            cleanup_group: true, environment: environment, chdir: File.dirname(artifact))
+          remaining!(deadline)
+          return result("uncertain", "publisher_reply_unavailable") if process.oversized || !process.status.success?
+          value = JSON.parse(process.stdout, object_class: UniqueObject, max_nesting: 4)
+          allowed = {"otp-required" => "provider_rejected_before_acceptance", "otp-rejected" => "provider_rejected_before_acceptance",
+            "otp-expired" => "provider_rejected_before_acceptance", "failed" => %w[provider_rejected_non_otp executor_credentials_unavailable invalid_artifact_selection artifact_identity_mismatch artifact_metadata_mismatch invalid_scoped_input],
+            "uncertain" => %w[registry_verification_required provider_result_ambiguous unclassified_push_result publisher_interrupted artifact_changed_during_push]}
+          unless value.is_a?(Hash) && value.keys.sort == %w[classification code] && Array(allowed[value["classification"]]).include?(value["code"])
+            return result("uncertain", "publisher_reply_invalid")
+          end
+          value.freeze
+        rescue StandardError
+          result("uncertain", "publisher_reply_unavailable")
+        ensure
+          environment&.delete("GEM_HOST_OTP_CODE")
+        end
+
+        private
+
+        class UniqueObject < Hash
+          def []=(key, value)
+            raise JSON::ParserError, "duplicate registry field" if key?(key)
+            super
+          end
+        end
+
+        def remaining!(deadline)
+          value = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          raise IOError, "publication deadline expired" unless value.positive?
+          value
+        end
+
+        def result(classification, code)
+          {"classification" => classification, "code" => code}.freeze
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/molecules/protected_service_handler.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require "json"
+require "ace/herdr/molecules/bounded_process"
+require "timeout"
+require "ace/assign/authority/private_directory"
+
+module Ace
+  module Lab
+    module Molecules
+      # Source-owned receiver handler. Permission admission is a separate
+      # authority operation; this runner never grants or reconstructs it.
+      class ProtectedServiceHandler
+        MAX_STDOUT = 16 * 1024
+        MAX_STDERR = 8 * 1024
+
+        def execute(operation:, envelope:, candidate_root:)
+          unless Process.uid == operation.fetch("executor_uid") && Process.euid == operation.fetch("executor_uid")
+            raise SecurityError, "handler executor differs"
+          end
+          root = Ace::Assign::Authority::PrivateDirectory.verify!(candidate_root)
+          result = Ace::Herdr::Molecules::BoundedProcess.call(operation.fetch("argv"),
+            stdin_data: JSON.generate(envelope), timeout_s: 30,
+            output_limit: MAX_STDOUT, stderr_limit: MAX_STDERR, cleanup_group: true,
+            environment: {"PATH" => "/usr/bin:/bin", "LANG" => "C.UTF-8", "HOME" => root}, chdir: root)
+          return nil if result.oversized || !result.status.success?
+          out = result.stdout
+          response = JSON.parse(out)
+          request = envelope.fetch("request")
+          unless response.is_a?(Hash) && response.keys.sort == %w[evidence input_digest outcome request_id] &&
+              response["request_id"] == request.fetch("request_id") && response["input_digest"] == request.fetch("input_digest") &&
+              %w[succeeded failed].include?(response["outcome"]) && response["evidence"].is_a?(Array)
+            return nil
+          end
+          response
+        rescue JSON::ParserError, Timeout::Error, Ace::Herdr::Molecules::BoundedProcess::PostLaunchError,
+          IOError, SystemCallError
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/molecules/protected_service_policy.rb

@@ -0,0 +1,156 @@
+# frozen_string_literal: true
+
+require "json"
+require "etc"
+require "ace/assign/atoms/evidence_digest"
+require_relative "../authorization_path"
+require_relative "../atoms/service_input"
+require "ace/git/atoms/service_pr_input"
+require_relative "grant_resolver"
+require_relative "caller_authorizer"
+require_relative "service_policy"
+require_relative "../atoms/protected_workspace_prune_input"
+require_relative "../atoms/protected_publication_input"
+
+module Ace
+  module Lab
+    module Molecules
+      # The receiver and authority share the existing input/policy owners.
+      # Only composition supplies collaborators; no wire-selected policy,
+      # executable, input path or caller identity is accepted here.
+      class ProtectedServicePolicy
+        def initialize(proposal_resolver:, document_loader: nil, cleanup_owner: nil)
+          @proposal_resolver = proposal_resolver
+          @cleanup_owner = cleanup_owner
+          @document_loader = document_loader || -> { GrantResolver.trusted_document(Ace::Lab.authorization_path) }
+        end
+
+        def input_binding(bytes, expected_digest:, expected_target:, operation:)
+          unless bytes.is_a?(String) && bytes.bytesize.between?(1, Atoms::ServiceInput::MAX_BYTES)
+            raise ArgumentError, "structured service input exceeds its fixed limit"
+          end
+          input = if operation == "prune-preserved-workspace"
+            Atoms::ProtectedWorkspacePruneInput.parse(bytes)
+          elsif operation == "publish"
+            Atoms::ProtectedPublicationInput.decode!(bytes)
+          else
+            JSON.parse(bytes)
+          end
+          raise ArgumentError, "structured service input must be an object" unless input.is_a?(Hash)
+          Atoms::ServiceInput.validate!(input)
+          if Ace::Git::Atoms::ServicePrInput::OPERATIONS.include?(operation)
+            Ace::Git::Atoms::ServicePrInput.validate(input, operation: operation)
+          end
+          digest = Atoms::ServiceInput.digest(input)
+          target = Atoms::ServiceInput.target(input)
+          unless digest == expected_digest && target == expected_target
+            raise SecurityError, "structured service input differs from the bound digest or target"
+          end
+          deep_freeze(input: input, input_digest: digest, target: target)
+        rescue JSON::ParserError
+          raise ArgumentError, "structured service input must be valid JSON"
+        end
+
+        def prepare!(binding, input_bytes:)
+          input = input_binding(input_bytes, expected_digest: binding.fetch("input_digest"),
+            expected_target: binding.fetch("target"), operation: binding.fetch("operation"))
+          if binding["operation"] == "publish" && input.fetch(:input).dig("publication", "head") != binding.fetch("candidate_head")
+            raise SecurityError, "publication input head differs from admitted candidate"
+          end
+          authorized = authorize!(binding)
+          canonical = snapshot(binding).merge("executor_uid" => authorized.fetch(:operation).fetch("executor_uid"), "transport" => "unix")
+          deep_freeze(authorized.merge(binding: canonical, input: input.fetch(:input)))
+        end
+
+        # Selected by installed composition, independently of receiver fields.
+        # Ordinary services never acquire this domain-specific root capability.
+        def dispatch_owner_binding!(binding)
+          return nil unless binding.fetch("operation") == "prune-preserved-workspace"
+          unless @cleanup_owner
+            raise SecurityError, "fixed cleanup owner composition is unavailable"
+          end
+          @cleanup_owner.identity!
+        end
+
+        # Called again inside each claim/begin CAS retry using the immutable
+        # binding and ephemeral parsed input, never a caller filesystem path.
+        def authorize!(binding)
+          uid = binding.fetch("caller_uid")
+          document = visible_document!(project: binding.fetch("project_id"), uid: uid)
+          resolver = ->(reference, exact) { @proposal_resolver.call(binding.fetch("project_id"), reference, exact) }
+          policy = ServicePolicy.new(document, resolver)
+          operation = policy.operation!(binding.fetch("operation"), project: binding.fetch("project_id"), service_id: binding.fetch("service_id"))
+          unless operation.fetch("transport", "local") == "local"
+            raise Ace::Lab::InvalidConfigurationError, "protected receiver requires a fixed local handler operation"
+          end
+          unless operation.fetch("executor_uid").positive? && operation.fetch("executor_uid") != uid
+            raise SecurityError, "protected executor must be a separate nonroot account"
+          end
+          if binding.key?("executor_uid") && binding["executor_uid"] != operation.fetch("executor_uid")
+            raise SecurityError, "configured executor differs from the recorded claim"
+          end
+          decision = policy.authorize!(binding.fetch("authorization"), binding)
+          digest = Ace::Assign::Atoms::EvidenceDigest.digest("operation" => operation, "authorization" => decision,
+            "caller_uid" => uid, "project_id" => binding.fetch("project_id"))
+          if binding.key?("policy_digest") && binding["policy_digest"] != digest
+            raise SecurityError, "service policy changed after claim"
+          end
+          deep_freeze(operation: snapshot(operation), policy_digest: digest,
+            operation_digest: Ace::Assign::Atoms::EvidenceDigest.digest(operation))
+        end
+
+        # Read-only selection of the installed named cleanup receiver; no
+        # proposal authorization or effect capability is minted by preview.
+        def workspace_prune_receiver!(project:, uid:, service_id:, executor_uid:)
+          document = visible_document!(project: project, uid: uid)
+          policy = ServicePolicy.new(document, ->(*) { raise SecurityError, "preview cannot resolve proposal grants" })
+          operation = policy.operation!("prune-preserved-workspace", project: project, service_id: service_id)
+          unless operation.fetch("executor_uid") == executor_uid && executor_uid.is_a?(Integer) && executor_uid.positive? && executor_uid != uid
+            raise SecurityError, "preview receiver differs from the installed cleanup operation"
+          end
+          true
+        end
+
+        def visible!(project:, uid:)
+          visible_document!(project: project, uid: uid)
+          true
+        end
+
+        def authorize_update!(existing, replacement, _pending)
+          initial_effect = existing.nil? && %w[accepted uncertain].include?(replacement["state"])
+          fresh_dispatch = existing && existing["dispatch_phase"] == "issued" && replacement["dispatch_phase"] == "dispatch_started"
+          authorize!(replacement) if initial_effect || fresh_dispatch
+          true
+        end
+
+        private
+
+        def visible_document!(project:, uid:)
+          raise SecurityError, "protected caller UID is invalid" unless uid.is_a?(Integer) && uid.positive?
+          username = begin
+            Etc.getpwuid(uid).name
+          rescue ArgumentError
+            nil
+          end
+          document = @document_loader.call
+          identities = CallerAuthorizer.matchable_identities(username, uid)
+          visibility = CallerAuthorizer.new(principals: document.fetch("principals", {}), identity: identities)
+          raise SecurityError, "caller project grant has been revoked" unless visibility.authorized?(project)
+          document
+        end
+
+        def snapshot(value)
+          JSON.parse(JSON.generate(value))
+        end
+
+        def deep_freeze(value)
+          case value
+          when Hash then value.each { |key, item| deep_freeze(key); deep_freeze(item) }
+          when Array then value.each { |item| deep_freeze(item) }
+          end
+          value.freeze
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/molecules/service_policy.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../errors"
+require "ace/assign/errors"
 require "pathname"
 require "time"
 
@@ -12,9 +14,10 @@ module Ace
         NAME = /\A[a-z][a-z0-9-]{0,63}\z/
         ID = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/
 
-        def initialize(document)
+        def initialize(document, proposal_resolver = nil)
           @operations = document.fetch("operations", {})
           @authorizations = document.fetch("authorizations", {})
+          @proposal_resolver = proposal_resolver
           unless @operations.is_a?(Hash) && @authorizations.is_a?(Hash)
             raise Ace::Lab::InvalidConfigurationError, "trusted service policy must contain mappings"
           end
@@ -80,6 +83,14 @@ module Ace
 
         def authorize!(reference, binding)
           raise ArgumentError, "invalid authorization reference" unless reference.to_s.match?(ID)
+          if reference.start_with?("proposal-")
+            raise SecurityError, "canonical proposal authority is unavailable" unless @proposal_resolver
+            begin
+              return @proposal_resolver.call(reference, binding)
+            rescue Ace::Assign::Error
+              raise SecurityError, "canonical proposal does not authorize this exact effect"
+            end
+          end
           decision = @authorizations[reference]
           raise SecurityError, "authorization reference is unresolved" unless decision.is_a?(Hash)
           required = %w[operation project_id assignment_id attempt_id input_digest target candidate_head caller_uid]
@@ -90,6 +101,30 @@ module Ace
           decision
         end
 
+        # Inspection never renews effect permission or selects effect argv.
+        def inspection!(name, project:, service_id:, executor_uid:)
+          raise ArgumentError, "invalid inspection operation" unless name.is_a?(String) && name.match?(NAME)
+          operation = @operations[name]
+          unless operation.is_a?(Hash) && operation["project"] == project && operation["service_id"] == service_id &&
+              operation["executor_uid"].is_a?(Integer) && operation["executor_uid"] == executor_uid &&
+              operation.fetch("transport", "local") == "local"
+            raise SecurityError, "inspection does not match the selected original executor"
+          end
+          # This source-composed inspector uses the fixed original root SDK;
+          # configured handler argv cannot select or replace that owner.
+          if name == "prune-preserved-workspace"
+            return {"executor_uid" => executor_uid, "operation" => name}
+          end
+          argv = operation["no_effect_argv"]
+          unless argv.is_a?(Array) && argv.length.between?(1, 16) &&
+              argv.all? { |value| value.is_a?(String) && value.bytesize.between?(1, 1024) && !value.include?("\0") } &&
+              argv.first.start_with?("/")
+            raise Ace::Lab::InvalidConfigurationError, "operation has no fixed no-effect inspector"
+          end
+          executable = trusted_executable!(argv.first, executor_uid)
+          {"executor_uid" => executor_uid, "argv" => [executable] + argv.drop(1)}
+        end
+
         private
 
         # Validate the executable and every directory component on its

data/lib/ace/lab/organisms/authority_composition.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+require "ace/assign/authority/server"
+require "ace/assign/authority/router"
+require "ace/assign/authority/launch_lifecycle"
+require "ace/assign/authority/endcap"
+require_relative "../molecules/protected_service_policy"
+require "ace/hitl/providers/lab"
+require "ace/hitl/providers/lab/protected_assignment_binding"
+require "ace/hitl/lifecycle/service_publication_binding"
+require "ace/hitl/lifecycle/service"
+
+module Ace
+  module Lab
+    module Organisms
+      # The only full-service composition. The deployed map chooses identity
+      # and placement; source selects all handlers, policy and evidence readers.
+      class AuthorityComposition
+        REQUIRED_ENDCAP = %w[submit_candidate export_candidate assign_review accept_review request_service
+          begin_dispatch publication_challenge publication_continue claim_service_settlement complete_service complete_no_effect submit_result finish recover bind_inbox
+          service_status evidence_fetch].freeze
+
+        def initialize(authority_id:, deployment: Ace::Assign::Authority::Deployment.load,
+          kernel: Ace::Runtime::Molecules::ProtectedLinux.new)
+          @authority_id, @deployment, @kernel = authority_id, deployment, kernel
+        end
+
+        def build
+          @deployment.verify_composition!(@authority_id, composition: "services")
+          unless (REQUIRED_ENDCAP - Ace::Assign::Authority::Endcap::OPERATIONS).empty?
+            raise InvalidConfigurationError, "full-service source composition is incomplete"
+          end
+          projects = @deployment.data.fetch("launch_mappings").values
+            .select { |map| map.fetch("authority_id") == @authority_id }.map { |map| map.fetch("project_id") }.uniq
+          raise InvalidConfigurationError, "full-service authority has no projects" if projects.empty?
+          projects.each do |id|
+            project = @deployment.project(id)
+            unless project["service_receivers"].is_a?(Hash) && !project["service_receivers"].empty?
+              raise InvalidConfigurationError, "full-service project has no fixed receiver"
+            end
+          end
+
+          journals = {}
+          endcap = nil
+          projects.each do |id|
+            project = @deployment.project(id)
+            reader = nil
+            journal = Ace::Assign::Molecules::EvidenceJournal.new(repo_root: project.fetch("journal_repository"),
+              checkout_root: project.fetch("evidence_checkout_root"), ref: project.fetch("evidence_git_ref"), mode: :protected,
+              evidence_reader: ->(reference, record, state, pending) { reader.call(reference, record, state, pending) },
+              service_authorizer: ->(existing, replacement, pending) {
+                endcap.authorize_service_update!(journal: journals.fetch(id), existing: existing,
+                  replacement: replacement, pending: pending)
+              })
+            reader = Ace::Assign::Authority::ServiceEvidence.new(journal: journal)
+            journals[id] = journal
+          end
+          policy = Molecules::ProtectedServicePolicy.new(proposal_resolver: ->(project, reference, binding) {
+            journals.fetch(project).proposal_authorize!(reference, binding)
+          })
+          history = Ace::Assign::Authority::DeploymentHistory.load
+          launch = Ace::Assign::Authority::LaunchLifecycle.new(deployment: @deployment, deployment_history: history,
+            kernel: @kernel, journals: journals)
+          endcap = Ace::Assign::Authority::Endcap.new(deployment: @deployment, launch: launch, kernel: @kernel,
+            service_policy: policy, deployment_history: history)
+          router = Ace::Assign::Authority::Router.new(launch: launch, handlers: [endcap])
+          Ace::Assign::Authority::Server.new(authority_id: @authority_id, deployment: @deployment, kernel: @kernel,
+            lifecycle: router, composition: "services", hitl_service: publication_hitl(endcap, journals))
+        end
+
+        private
+
+        def publication_hitl(endcap, journals)
+          provider = Ace::Hitl::Providers::Lab
+          policy = provider.grants_policy(grants_path: provider::DEFAULT_GRANTS_PATH)
+          unless policy.service_uid == @deployment.authority(@authority_id).fetch("uid")
+            raise InvalidConfigurationError, "protected HITL service principal differs from installed authority"
+          end
+          ordinary = provider::ProtectedAssignmentBinding.new(authority: endcap, kernel: @kernel, journals: journals)
+          binding = Ace::Hitl::Lifecycle::ServicePublicationBinding.new(ordinary: ordinary, authority: endcap, kernel: @kernel)
+          Ace::Hitl::Lifecycle::Service.new(root: provider::DEFAULT_STORE_ROOT,
+            socket_path: provider::DEFAULT_SOCKET_PATH, binding: binding, policy: policy)
+        end
+      end
+    end
+  end
+end