ace-lab 0.3.1 → 0.5.0

data/lib/ace/lab/organisms/protected_service_recovery.rb

@@ -0,0 +1,185 @@
+# frozen_string_literal: true
+
+module Ace
+  module Lab
+    module Organisms
+      class ProtectedServiceReceiver
+        RECOVERY_BINDING = %w[assignment_id attempt_id candidate_generation head request_id].freeze
+        RECOVERY_EXECUTION = %w[mapping_id candidate_generation head claim_binding dispatch_phase].freeze
+        CLEANUP_RECOVERY_EXECUTION = (RECOVERY_EXECUTION + %w[operation_owner_binding executor_process_binding
+          request_event_digest dispatch_event_digest]).freeze
+        RECOVERY_CHALLENGE = %w[request_id input_digest claim_binding no_effect_challenge challenge_generation
+          failure_event_digest failure_generation challenge_event_digest].freeze
+
+        def recover_no_effect(binding:, input_bytes:, mutation_id:, expected_generation:)
+          request_id = nil
+          recovery_binding!(binding, input_bytes, mutation_id, expected_generation)
+          params = immutable(binding)
+          input_bytes = input_bytes.dup.freeze
+          mutation_id = mutation_id.dup.freeze
+          recovery_binding!(params, input_bytes, mutation_id, expected_generation)
+          request_id = params.fetch("request_id")
+          recovery_executor!
+          status, context, input = recovery_status!(params, input_bytes)
+          return projection(status) if %w[succeeded failed-settled].include?(status.fetch("state"))
+          unless context["challenge"]
+            claim_params = params.merge("expected_generation" => expected_generation)
+            begin
+              @client.call("claim_service_settlement", claim_params, mutation_id: mutation_id)
+            rescue Ace::Runtime::RuntimeUnavailableError
+              # Recover a possibly accepted challenge through current status,
+              # never refreshing the original generation or silently claiming.
+            end
+            status, context, input = recovery_status!(params, input_bytes)
+            return projection(status) if %w[succeeded failed-settled].include?(status.fetch("state"))
+            return uncertain(request_id) unless context["challenge"]
+          end
+          operation = recovery_inspector!(context)
+          root = Ace::Assign::Authority::PrivateDirectory.verify!(@receiver.fetch("staging_root"))
+          directory = Dir.mktmpdir("recovery-", root)
+          File.chmod(0o700, directory)
+          identity = File.lstat(directory)
+          envelope = immutable("version" => 1, "kind" => "service_no_effect_inspection",
+            "request" => context.fetch("request"), "input" => input.fetch(:input),
+            "execution" => context.fetch("execution"), "challenge" => context.fetch("challenge"))
+          # The selected inspector supplies retained success or positive absence;
+          # neither follows from a timeout or process/scope cleanup.
+          if context.dig("request", "operation") == "prune-preserved-workspace"
+            return uncertain(request_id) unless @cleanup_owner && context.dig("execution", "dispatch_phase") == "dispatch_started"
+            inspected_kind, artifacts = cleanup_inspection_evidence!(context, input.fetch(:input))
+            if inspected_kind == "succeeded"
+              evidence = artifacts.each_with_index.map do |artifact, index|
+                {"ref" => "cleanup-#{index}", "sha256" => Digest::SHA256.hexdigest(artifact)}
+              end
+              receipt = JSON.generate(context.fetch("request").merge("outcome" => "succeeded", "evidence" => evidence))
+              completion = params.merge("claim_binding" => context.dig("execution", "claim_binding"),
+                "receipt_sha256" => Digest::SHA256.hexdigest(receipt))
+              @client.call("complete_service", completion,
+                mutation_id: Digest::SHA256.hexdigest("cleanup-completed:#{mutation_id}"),
+                upload_parts: [receipt] + artifacts, purpose: :receipt_artifacts)
+              completed, = recovery_status!(params, input_bytes)
+              return uncertain(request_id) unless completed["state"] == "succeeded"
+              cleanup_staging(directory, identity, prefix: "recovery-")
+              return projection(completed)
+            end
+            response = {"outcome" => "failed", "request_id" => request_id,
+              "input_digest" => context.dig("request", "input_digest"), "evidence" => artifacts.each_with_index.map do |artifact, index|
+                {"ref" => index.zero? ? "cleanup-inspection-no-effect" : "cleanup-inspection-selection", "sha256" => Digest::SHA256.hexdigest(artifact)}
+              end}
+          else
+            response = @handler.execute(operation: immutable(operation), envelope: envelope, candidate_root: directory)
+          end
+          return uncertain(request_id) unless response && response["outcome"] == "failed" &&
+            response["request_id"] == request_id && response["input_digest"] == context.dig("request", "input_digest")
+          artifacts ||= Ace::Assign::Authority::EvidenceTransfer.read_staged(root: directory, evidence: response.fetch("evidence"))
+          receipt = context.fetch("request").merge("outcome" => "failed", "evidence" => response.fetch("evidence"))
+          bytes = JSON.generate(receipt)
+          completion_params = params.merge("claim_binding" => context.dig("execution", "claim_binding"),
+            "reconciliation_challenge" => context.fetch("challenge").slice("no_effect_challenge", "challenge_generation", "challenge_event_digest"),
+            "receipt_sha256" => Digest::SHA256.hexdigest(bytes))
+          @client.call("complete_no_effect", completion_params,
+            mutation_id: Digest::SHA256.hexdigest("no-effect:#{mutation_id}"),
+            upload_parts: [bytes] + artifacts, purpose: :receipt_artifacts)
+          # Protected status invokes the shared canonical receipt/import reader.
+          # Never accept a terminal state string without that authentication.
+          settled, = recovery_status!(params, input_bytes)
+          return uncertain(request_id) unless settled["state"] == "failed-settled"
+          cleanup_staging(directory, identity, prefix: "recovery-")
+          projection(settled)
+        rescue Ace::Assign::Error, Ace::Runtime::RuntimeUnavailableError, Ace::Lab::InvalidConfigurationError,
+          SecurityError, ArgumentError, KeyError, TypeError, SystemCallError
+          uncertain(request_id)
+        end
+
+        private
+
+        def recovery_binding!(binding, bytes, mutation_id, generation)
+          unless binding.is_a?(Hash) && binding.keys.sort == RECOVERY_BINDING.sort &&
+              %w[assignment_id attempt_id request_id].all? { |key| binding[key].is_a?(String) && binding[key].match?(Ace::Assign::Molecules::JournalMutation::ID) } &&
+              binding["head"].is_a?(String) && binding["head"].match?(Ace::Assign::Authority::CandidateTransfer::SHA) &&
+              binding["candidate_generation"].is_a?(Integer) && binding["candidate_generation"] >= 0 &&
+              generation.is_a?(Integer) && generation.positive? && bytes.is_a?(String) &&
+              mutation_id.is_a?(String) && mutation_id.match?(Ace::Assign::Molecules::JournalMutation::ID)
+            raise ArgumentError, "original recovery binding is invalid"
+          end
+        end
+
+        def recovery_executor!
+          me = @kernel.capture(Process.pid)
+          credentials = @project.fetch("peer_credentials").fetch(@receiver.fetch("executor_uid").to_s)
+          unless me["uid"] == @receiver.fetch("executor_uid") && me["gid"] == credentials.fetch("gid") &&
+              me["groups"] == credentials.fetch("groups")
+            raise SecurityError, "recovery executor differs"
+          end
+          @kernel.live!(me)
+        end
+
+        def recovery_status!(params, bytes)
+          reply = @client.call("service_status", params)
+          data = reply.data
+          context = data.fetch("settlement_context")
+          unless context.is_a?(Hash) && context.keys.sort == %w[version request execution challenge].sort &&
+              context["version"].is_a?(Integer) && context["version"] == 1
+            raise SecurityError, "canonical recovery context is malformed"
+          end
+          request, execution, challenge = context.values_at("request", "execution", "challenge")
+          execution_fields = request.is_a?(Hash) && request["operation"] == "prune-preserved-workspace" &&
+            execution.is_a?(Hash) && execution["dispatch_phase"] == "dispatch_started" ? CLEANUP_RECOVERY_EXECUTION : RECOVERY_EXECUTION
+          unless request.is_a?(Hash) && request.keys.sort == Ace::Assign::Molecules::EvidenceJournal::TERMINAL_BINDING_FIELDS.sort &&
+              execution.is_a?(Hash) && execution.keys.sort == execution_fields.sort &&
+              %w[assignment_id attempt_id request_id].all? { |key| request[key] == params.fetch(key) } &&
+              request["project_id"] == @map.fetch("project_id") && request["executor_uid"] == @receiver.fetch("executor_uid") &&
+              request["transport"] == "unix" && request["candidate_head"] == params.fetch("head") &&
+              execution["mapping_id"] == @mapping_id && execution["candidate_generation"] == params.fetch("candidate_generation") &&
+              execution["head"] == params.fetch("head") && %w[issued dispatch_started].include?(execution["dispatch_phase"]) &&
+              %w[uncertain failed succeeded failed-settled].include?(data["state"]) &&
+              data["request_id"] == params.fetch("request_id") && data["service_id"] == @service_id
+            raise SecurityError, "canonical recovery original binding differs"
+          end
+          if !challenge.nil? && (!challenge.is_a?(Hash) || challenge.keys.sort != RECOVERY_CHALLENGE.sort ||
+              !%w[challenge_generation failure_generation].all? { |key| challenge[key].is_a?(Integer) && challenge[key].positive? } ||
+              challenge["request_id"] != request["request_id"] || challenge["input_digest"] != request["input_digest"] ||
+              challenge["claim_binding"] != execution["claim_binding"])
+            raise SecurityError, "canonical recovery challenge differs"
+          end
+          input = @inputs.input_binding(bytes, expected_digest: request.fetch("input_digest"),
+            expected_target: request.fetch("target"), operation: request.fetch("operation"))
+          [data, immutable(context), input]
+        end
+
+        def cleanup_inspection_evidence!(context, input)
+          request, execution = context.values_at("request", "execution")
+          result = @cleanup_owner.inspect!(request: request.slice("request_id", "input_digest").merge(
+            "claim_binding" => execution.fetch("claim_binding"),
+            "request_event_digest" => execution.fetch("request_event_digest"),
+            "dispatch_event_digest" => execution.fetch("dispatch_event_digest"), "input" => input,
+            "challenge_ref" => context.fetch("challenge").slice("challenge_event_digest")),
+            operation_owner_binding: execution.fetch("operation_owner_binding"))
+          unless result.is_a?(Hash) && result.keys.sort == %i[bytes kind receipt_ref] &&
+              %w[succeeded failed-no-effect].include?(result[:kind])
+            raise SecurityError, "original cleanup inspection kind differs"
+          end
+          success = result.fetch(:kind) == "succeeded"
+          ref, bytes = result.values_at(:receipt_ref, :bytes)
+          unless ref.is_a?(Hash) && ref.keys.sort == %w[bytes path sha256] && bytes.is_a?(String) &&
+              bytes.bytesize.between?(1, 65_536) && ref["bytes"].is_a?(Integer) && ref["bytes"] == bytes.bytesize &&
+              ref["sha256"] == Digest::SHA256.hexdigest(bytes)
+            raise SecurityError, "original cleanup inspection result differs"
+          end
+          selection = {"schema" => success ? Ace::Assign::Authority::ServiceCleanupEvidence::ROOT_SELECTION_SCHEMA : Ace::Assign::Authority::ServiceCleanupEvidence::ROOT_INSPECTION_SELECTION_SCHEMA,
+            "request_id" => request.fetch("request_id"), "input_digest" => request.fetch("input_digest"),
+            "operation_owner_binding_digest" => Ace::Assign::Atoms::EvidenceDigest.digest(execution.fetch("operation_owner_binding")),
+            (success ? "receipt_ref" : "inspection_ref") => ref}
+          [result.fetch(:kind), [bytes, JSON.generate(selection)].freeze].freeze
+        end
+
+        def recovery_inspector!(context)
+          request = context.fetch("request")
+          policy = Molecules::ServicePolicy.new(Molecules::GrantResolver.trusted_document(Ace::Lab.authorization_path))
+          policy.inspection!(request.fetch("operation"), project: @map.fetch("project_id"),
+            service_id: @service_id, executor_uid: @receiver.fetch("executor_uid"))
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/organisms/protected_service_request.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+require "ace/assign/authority/protected_assignment_context"
+require "ace/assign/organisms/protected_delivery_coordinator"
+require_relative "protected_service_client"
+require "ace/git/atoms/service_pr_input"
+
+module Ace
+  module Lab
+    module Organisms
+      # Public selection adapter. The original authority and fixed receiver
+      # own every grant/effect; this adapter has no local journal or executor.
+      class ProtectedServiceRequest
+        FLAGS = %i[mapping scope service candidate_head candidate_generation expected_generation input_digest target artifact_digest].freeze
+        LIMIT = 16_384
+
+        def initialize(context: Ace::Assign::Authority::ProtectedAssignmentContext.load, ingress_factory: nil)
+          @context = context
+          @ingress = ingress_factory || ->(**selection) { ProtectedServiceClient.new(**selection) }
+        end
+
+        def selected?(options)
+          @context.protected_participant? || @context.mapping_hint? || FLAGS.any? { |key| !options[key].nil? }
+        end
+
+        def request(project:, assignment:, attempt:, operation:, input_path:, authorization:, request_id:, **options)
+          refuse_nonworker!
+          unless (options.keys - %i[mapping scope service candidate_head candidate_generation expected_generation dry_run]).empty?
+            raise ArgumentError, "protected request rejects incompatible options"
+          end
+          raise ArgumentError, "protected service request requires a fixed PR operation and no dry-run" unless Ace::Git::Atoms::ServicePrInput::OPERATIONS.include?(operation) && !options[:dry_run]
+          validate!(project, assignment, attempt, request_id, options)
+          unless authorization.is_a?(String) && authorization.match?(Molecules::ServicePolicy::ID) &&
+              options[:service].is_a?(String) && options[:service].match?(Molecules::ServicePolicy::ID) &&
+              options[:expected_generation].is_a?(Integer) && options[:expected_generation].positive?
+            raise ArgumentError, "protected service request requires receiver, authorization and original generation"
+          end
+          input = Atoms::ServiceInput.load(input_path)
+          Ace::Git::Atoms::ServicePrInput.validate(input, operation: operation)
+          target = Atoms::ServiceInput.target(input)
+          digest = Atoms::ServiceInput.digest(input)
+          prepared = resolve!(project, assignment, attempt, options)
+          selection = {"project_id" => project, "mapping_id" => options.fetch(:mapping), "assignment_id" => assignment,
+            "attempt_id" => attempt, "scope" => options.fetch(:scope), "service_id" => options.fetch(:service),
+            "candidate_head" => options.fetch(:candidate_head), "candidate_generation" => options.fetch(:candidate_generation),
+            "expected_generation" => options.fetch(:expected_generation), "request_id" => request_id,
+            "input_digest" => digest, "target" => target}
+          submission = {"assignment_id" => assignment, "attempt_id" => attempt, "expected_generation" => options.fetch(:expected_generation),
+            "candidate_generation" => options.fetch(:candidate_generation), "head" => options.fetch(:candidate_head),
+            "request_id" => request_id, "operation" => operation, "input_digest" => digest, "target" => target,
+            "authorization" => authorization}
+          mutation = Digest::SHA256.hexdigest("qkb.#{operation}.claim:v1:#{assignment}:#{attempt}:#{request_id}")
+          claim = @context.with_installed_selection(options: options, input: prepared) do |deployment, kernel, mapping|
+            @ingress.call(mapping_id: mapping, service_id: options.fetch(:service), deployment: deployment, kernel: kernel)
+              .submit(submission: submission, input_bytes: JSON.generate(input), mutation_id: mutation)
+          end
+          envelope = if claim.fetch("type") == "service_claim_accepted"
+            {"status" => "ok", "data" => {"selection" => selection, "claim" => claim}}
+          else
+            code = claim.fetch("type")
+            {"status" => "error", "error" => {"code" => code,
+              "message" => "inspect original canonical service status; no automatic resubmission",
+              "selection" => selection, "claim" => claim}}
+          end
+          bounded!(envelope, selection: selection)
+        end
+
+        def status(request_id:, **options)
+          refuse_nonworker!
+          unless (options.keys - %i[project assignment attempt mapping scope candidate_head candidate_generation input_digest target artifact_digest format]).empty?
+            raise ArgumentError, "protected status rejects incompatible options"
+          end
+          project, assignment, attempt = options.values_at(:project, :assignment, :attempt)
+          validate!(project, assignment, attempt, request_id, options)
+          unless options[:input_digest].is_a?(String) && options[:input_digest].match?(Atoms::ServiceInput::SHA256)
+            raise ArgumentError, "protected status requires original input digest"
+          end
+          target = Atoms::ServiceInput.target({"target" => {"resource" => options[:target], "artifact_digest" => options[:artifact_digest]}})
+          resolve!(project, assignment, attempt, options)
+          data = Ace::Assign::Organisms::ProtectedDeliveryCoordinator.new(client: @context.client(options: options), project_id: project)
+            .perform(assignment_id: assignment, attempt_id: attempt, operation: "status", service_request_id: request_id,
+              candidate_head: options.fetch(:candidate_head), candidate_generation: options.fetch(:candidate_generation),
+              input_digest: options.fetch(:input_digest), target: target)
+          bounded!({"status" => "ok", "data" => data})
+        end
+
+        private
+
+        def refuse_nonworker!
+          if @context.protected_participant? && !@context.protected_worker?
+            raise Ace::Assign::AttemptErrors::EvidenceUnavailable, "protected service request/status is worker-only"
+          end
+        end
+
+        def validate!(project, assignment, attempt, request_id, options)
+          unless [project, assignment, attempt, request_id, options[:mapping]].all? { |value| value.is_a?(String) && value.match?(Molecules::ServicePolicy::ID) } &&
+              options[:scope].is_a?(String) && options[:scope].match?(Ace::Assign::Authority::PreparedWork::SCOPE) &&
+              options[:candidate_head].is_a?(String) && options[:candidate_head].match?(/\A[0-9a-f]{40}\z/) &&
+              options[:candidate_generation].is_a?(Integer) && options[:candidate_generation].positive?
+            raise ArgumentError, "protected service requires exact original scoped selectors"
+          end
+        end
+
+        def resolve!(project, assignment, attempt, options)
+          input = @context.resolve(options: options.merge(attempt: attempt), assignment_id: assignment, scope: options.fetch(:scope))
+          unless input && input.descriptor.values_at("project_id", "assignment_id", "attempt_id", "scope", "mapping_id") ==
+              [project, assignment, attempt, options.fetch(:scope), options.fetch(:mapping)]
+            raise Ace::Assign::AttemptErrors::EvidenceUnavailable, "original prepared service selection differs"
+          end
+          input
+        end
+
+        def bounded!(envelope, selection: nil)
+          return envelope if JSON.generate(envelope).bytesize <= LIMIT
+          if selection
+            # Submission may already be durable. Never classify lost output as
+            # a pre-effect refusal or retry; retain the original lookup tuple.
+            envelope = {"status" => "error", "error" => {"code" => "service_claim_unconfirmed",
+              "message" => "claim output unavailable; inspect original canonical service status without resubmission",
+              "selection" => selection, "claim" => {"version" => 1, "type" => "service_claim_unconfirmed",
+                "required_action" => "inspect_canonical_service_status"}}}
+            return envelope if JSON.generate(envelope).bytesize <= LIMIT
+          end
+          raise Ace::Assign::AttemptErrors::EvidenceUnavailable, "protected status output exceeds bound"
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/organisms/protected_service_worker.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require_relative "protected_service_receiver"
+
+module Ace
+  module Lab
+    module Organisms
+      # One admitted worker for one installed receiver. Capacity is acquired
+      # before the canonical claim, not after an accepted request. This owns
+      # execution lifetime only; it never substitutes for canonical status.
+      class ProtectedServiceWorker
+        def initialize(receiver:)
+          @receiver = receiver
+          @mutex = Mutex.new
+          @worker = nil
+          @closing = false
+        end
+
+        def start(submission:, peer:, input_bytes:, mutation_id:, on_claim:, deadline: nil)
+          raise ArgumentError, "receiver acceptance callback unavailable" unless on_claim.respond_to?(:call)
+          now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          deadline ||= now + 5
+          unless deadline.is_a?(Numeric) && deadline.finite? && deadline > now && deadline <= now + 5
+            raise ArgumentError, "receiver acceptance deadline is invalid"
+          end
+          # Hold independent copies before returning to the socket handler.
+          submission = copy(submission)
+          peer = copy(peer)
+          input_bytes = input_bytes.dup.freeze
+          mutation_id = mutation_id.dup.freeze
+          @mutex.synchronize do
+            raise Ace::Assign::AttemptErrors::Conflict, "receiver capacity unavailable" if @closing || @worker&.alive?
+
+            @worker = Thread.new do
+              remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+              next({"state" => "uncertain"}) unless remaining.positive?
+              result = @receiver.execute(submission: submission, peer: peer, input_bytes: input_bytes,
+                mutation_id: mutation_id, claim_timeout: [remaining, 5].min,
+                on_claim: lambda do |identity|
+                  begin
+                    on_claim.call(identity)
+                  rescue IOError, SystemCallError
+                    # A lost acceptance reply cannot cancel already admitted
+                    # work or cause a second execution. Status owns recovery.
+                    nil
+                  end
+                end)
+              if submission.fetch("operation") == "publish"
+                while @receiver.publication_active? && !@mutex.synchronize { @closing }
+                  result = @receiver.tick_publication!(request_id: submission.fetch("request_id"),
+                    deadline: Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30)
+                  sleep 0.25 if @receiver.publication_active?
+                end
+                @receiver.release_publication_lifetime!
+              end
+              result
+            end
+          end
+        end
+
+        # Stop admission before joining. A timed-out join preserves both the
+        # worker and closing state; the listener must retain its lifetime lock.
+        def close(timeout:)
+          unless timeout.is_a?(Numeric) && timeout.finite? && timeout >= 0
+            raise ArgumentError, "receiver close deadline is invalid"
+          end
+          worker = @mutex.synchronize do
+            @closing = true
+            @worker
+          end
+          !worker || !worker.join(timeout).nil?
+        end
+
+        private
+
+        def copy(value)
+          duplicate = JSON.parse(JSON.generate(value))
+          freeze_value(duplicate)
+        end
+
+        def freeze_value(value)
+          value.each_value { |child| freeze_value(child) } if value.is_a?(Hash)
+          value.each { |child| freeze_value(child) } if value.is_a?(Array)
+          value.freeze
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/organisms/service_request_service.rb

@@ -69,7 +69,8 @@ module Ace
           return route.envelope unless route.ok?
           service_id = route.data.fetch("entry").fetch("id")
           trusted = Molecules::GrantResolver.trusted_document(Ace::Lab.authorization_path) unless @policy
-          policy = @policy || Molecules::ServicePolicy.new(trusted)
+          policy = @policy || Molecules::ServicePolicy.new(trusted,
+            ->(reference, exact) { @coordinator.proposal_authorization(reference, exact) })
           head = current_head
           binding = {"request_id" => request_id, "assignment_id" => assignment, "attempt_id" => attempt,
                      "project_id" => project, "operation" => operation,
@@ -212,7 +213,8 @@ module Ace
           if @policy
             -> { @policy }
           else
-            -> { Molecules::ServicePolicy.new(Molecules::GrantResolver.trusted_document(Ace::Lab.authorization_path)) }
+            -> { Molecules::ServicePolicy.new(Molecules::GrantResolver.trusted_document(Ace::Lab.authorization_path),
+              ->(reference, exact) { @coordinator.proposal_authorization(reference, exact) }) }
           end
         end
 

data/lib/ace/lab/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Lab
-    VERSION = "0.3.1"
+    VERSION = "0.5.0"
   end
 end

data/lib/ace/lab.rb

@@ -3,14 +3,8 @@
 require_relative "lab/version"
 require "ace/support/config"
 
-module Ace
-  module Lab
-    class Error < StandardError; end
-
-    # Raised when topology configuration violates the schema contract
-    class InvalidConfigurationError < Error; end
-  end
-end
+require_relative "lab/errors"
+require_relative "lab/authorization_path"
 
 # Load all ace-lab components
 require_relative "lab/atoms/topology_schema"
@@ -63,20 +57,6 @@ module Ace
     # Same discovery the cascade resolver performs for this namespace
     LAB_FILE_PATTERNS = ["lab/config.yml", "lab/config.yaml"].freeze
 
-    # Authorization grants live in a single deployment-controlled file at a
-    # FIXED path — never in the caller-writable configuration cascade and
-    # never at a caller-selected location (review rounds 4-5, F3/F1). The
-    # file must be root-owned and not group/world-writable, including every
-    # directory on its real path; GrantResolver verifies and fails closed.
-    AUTHORIZATION_PATH = "/etc/lab/ace-lab/authorization.yml"
-
-    # Path of the trusted authorization grants document. A method (not a
-    # bare constant reference) so tests can stub the seam without any
-    # caller-controllable production override.
-    # @return [String]
-    def self.authorization_path
-      AUTHORIZATION_PATH
-    end
 
     # Load configuration using Ace::Support::Config cascade.
     # Load failures raise InvalidConfigurationError (classified by the query

metadata

@@ -1,14 +1,28 @@
 --- !ruby/object:Gem::Specification
 name: ace-lab
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.5.0
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-04 00:00:00.000000000 Z
+date: 2026-10-08 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: ace-runtime
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.2'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.2'
 - !ruby/object:Gem::Dependency
   name: ace-support-cli
   requirement: !ruby/object:Gem::Requirement
@@ -57,14 +71,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.62'
+        version: '0.66'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.66'
+- !ruby/object:Gem::Dependency
+  name: ace-hitl
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.13'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.62'
+        version: '0.13'
 - !ruby/object:Gem::Dependency
   name: ace-support-test-helpers
   requirement: !ruby/object:Gem::Requirement
@@ -168,9 +196,13 @@ files:
 - exe/ace-lab
 - lib/ace/lab.rb
 - lib/ace/lab/atoms/binding_freshness.rb
+- lib/ace/lab/atoms/protected_publication_input.rb
+- lib/ace/lab/atoms/protected_workspace_prune_input.rb
+- lib/ace/lab/atoms/protected_workspace_prune_preview.rb
 - lib/ace/lab/atoms/public_projection.rb
 - lib/ace/lab/atoms/service_input.rb
 - lib/ace/lab/atoms/topology_schema.rb
+- lib/ace/lab/authorization_path.rb
 - lib/ace/lab/cli.rb
 - lib/ace/lab/cli/commands/agents.rb
 - lib/ace/lab/cli/commands/projects.rb
@@ -179,6 +211,7 @@ files:
 - lib/ace/lab/cli/commands/service.rb
 - lib/ace/lab/cli/commands/services.rb
 - lib/ace/lab/cli/commands/support.rb
+- lib/ace/lab/errors.rb
 - lib/ace/lab/models/query_result.rb
 - lib/ace/lab/models/runtime_binding.rb
 - lib/ace/lab/models/service_receipt.rb
@@ -189,9 +222,24 @@ files:
 - lib/ace/lab/molecules/grant_resolver.rb
 - lib/ace/lab/molecules/hitl_authorizer.rb
 - lib/ace/lab/molecules/inventory_query.rb
+- lib/ace/lab/molecules/protected_cleanup_owner_admission.rb
+- lib/ace/lab/molecules/protected_cleanup_owner_client.rb
+- lib/ace/lab/molecules/protected_cleanup_owner_identity.rb
+- lib/ace/lab/molecules/protected_publication_publisher.rb
+- lib/ace/lab/molecules/protected_service_handler.rb
+- lib/ace/lab/molecules/protected_service_policy.rb
 - lib/ace/lab/molecules/service_executor.rb
 - lib/ace/lab/molecules/service_policy.rb
 - lib/ace/lab/molecules/topology_loader.rb
+- lib/ace/lab/organisms/authority_composition.rb
+- lib/ace/lab/organisms/protected_cleanup_owner.rb
+- lib/ace/lab/organisms/protected_service_client.rb
+- lib/ace/lab/organisms/protected_service_listener.rb
+- lib/ace/lab/organisms/protected_service_publication.rb
+- lib/ace/lab/organisms/protected_service_receiver.rb
+- lib/ace/lab/organisms/protected_service_recovery.rb
+- lib/ace/lab/organisms/protected_service_request.rb
+- lib/ace/lab/organisms/protected_service_worker.rb
 - lib/ace/lab/organisms/service_request_service.rb
 - lib/ace/lab/organisms/topology_service.rb
 - lib/ace/lab/version.rb