ace-lab 0.4.0 → 0.5.0

data/lib/ace/lab/molecules/protected_cleanup_owner_client.rb

@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+require "ace/runtime/molecules/protected_socket"
+require "ace/assign/authority/transfer_codec"
+require "ace/assign/atoms/evidence_digest"
+require_relative "../atoms/protected_workspace_prune_input"
+require_relative "../atoms/service_input"
+require_relative "../atoms/protected_workspace_prune_preview"
+
+module Ace
+  module Lab
+    module Molecules
+      # Fixed installed endpoint. A fresh execute connection must independently
+      # match the original canonical binding; identity EOF is never permission.
+      class ProtectedCleanupOwnerClient
+        PATH = "/run/lab/protected-workspace-cleanup.sock"
+        SCHEMA = "lab.protected-workspace-cleanup-control/v1"
+        LIMIT = 16_384
+
+        def initialize(observer:, scratch_root:, wire: Ace::Runtime::Molecules::ProtectedSocket)
+          @observer, @wire = observer, wire
+          @codec = Ace::Assign::Authority::TransferCodec.new(root: scratch_root)
+        end
+
+        def identity!
+          deadline = @wire.deadline(5)
+          connect(deadline) do |socket, binding|
+            @wire.write(socket, {"schema" => SCHEMA, "kind" => "identity"}, deadline: deadline, limit: LIMIT)
+            socket.shutdown(Socket::SHUT_WR)
+            guarded = Ace::Runtime::Molecules::ProtectedSocket::Ingress.new(socket)
+            reply = @wire.read(guarded, deadline: deadline, limit: LIMIT)
+            eof!(guarded, deadline)
+            unless reply.is_a?(Hash) && reply.keys.sort == %w[kind operation_owner_binding schema] &&
+                reply["schema"] == SCHEMA && reply["kind"] == "identity" &&
+                digest(reply["operation_owner_binding"]) == digest(binding)
+              raise SecurityError, "cleanup identity reply differs from observed original owner"
+            end
+            binding
+          end
+        end
+
+        def preview!(intent:, maintenance_context:, deadline: @wire.deadline(5))
+          intent = Atoms::ProtectedWorkspacePrunePreview.intent!(JSON.parse(JSON.generate(intent)))
+          context = Atoms::ProtectedWorkspacePrunePreview.context!(JSON.parse(JSON.generate(maintenance_context)))
+          raise SecurityError, "preview maintenance differs" unless intent.fetch("maintenance") == context.fetch("maintenance")
+          connect(deadline) do |socket, _original|
+            @wire.write(socket, {"schema" => SCHEMA, "kind" => "preview", "intent" => intent,
+              "maintenance_context" => context}, deadline: deadline, limit: 65_536)
+            socket.shutdown(Socket::SHUT_WR)
+            guarded = Ace::Runtime::Molecules::ProtectedSocket::Ingress.new(socket)
+            result = @wire.read(guarded, deadline: deadline, limit: LIMIT)
+            eof!(guarded, deadline)
+            Atoms::ProtectedWorkspacePrunePreview.result!(result, intent: intent, context: context)
+          end
+        end
+
+        def execute!(request:, operation_owner_binding:)
+          request = JSON.parse(JSON.generate(request), create_additions: false, max_nesting: 16)
+          fields = %w[request_id input_digest claim_binding request_event_digest dispatch_event_digest input]
+          Atoms::ProtectedWorkspacePruneInput.object!(request, fields)
+          Atoms::ProtectedWorkspacePruneInput.token!(request.fetch("request_id"))
+          (fields - %w[request_id input]).each { |key| Atoms::ProtectedWorkspacePruneInput.digest!(request.fetch(key)) }
+          bytes = JSON.generate(request.fetch("input"))
+          input = Atoms::ProtectedWorkspacePruneInput.parse(bytes)
+          unless Atoms::ServiceInput.digest(input) == request.fetch("input_digest")
+            raise SecurityError, "cleanup execute input differs"
+          end
+          Atoms::ProtectedWorkspacePruneInput.freeze_value(request)
+          deadline = @wire.deadline(300)
+          admission_deadline = [deadline, @wire.deadline(5)].min
+          connect(admission_deadline) do |socket, observed|
+            unless digest(observed) == digest(operation_owner_binding)
+              raise SecurityError, "cleanup execute owner differs from original dispatch"
+            end
+            frame = request.merge("schema" => SCHEMA, "kind" => "execute",
+              "operation_owner_binding_digest" => digest(observed))
+            @wire.write(socket, frame, deadline: admission_deadline, limit: 65_536)
+            socket.shutdown(Socket::SHUT_WR)
+            guarded = Ace::Runtime::Molecules::ProtectedSocket::Ingress.new(socket)
+            reply = @wire.read(guarded, deadline: deadline, limit: LIMIT)
+            unless reply.is_a?(Hash) && reply.keys.sort == %w[input_digest kind receipt_ref request_id schema] &&
+                reply.values_at("schema", "kind", "request_id", "input_digest") ==
+                  [SCHEMA, "result", request.fetch("request_id"), request.fetch("input_digest")]
+              raise SecurityError, "cleanup result identity differs"
+            end
+            ref = reply.fetch("receipt_ref")
+            Atoms::ProtectedWorkspacePruneInput.reference!(ref)
+            descriptor = {"version" => 1, "bytes" => ref.fetch("bytes"), "sha256" => ref.fetch("sha256"),
+              "parts" => [ref.slice("bytes", "sha256")]}
+            @codec.receive(guarded, descriptor: descriptor, purpose: :artifacts, deadline: deadline) do |received|
+              Atoms::ProtectedWorkspacePruneInput.freeze_value(ref)
+              {receipt_ref: ref, bytes: received.bytes.freeze}.freeze
+            end
+          end
+        end
+
+        def inspect!(request:, operation_owner_binding:)
+          request = JSON.parse(JSON.generate(request), create_additions: false, max_nesting: 16)
+          fields = %w[request_id input_digest claim_binding request_event_digest dispatch_event_digest input challenge_ref]
+          Atoms::ProtectedWorkspacePruneInput.object!(request, fields)
+          Atoms::ProtectedWorkspacePruneInput.token!(request.fetch("request_id"))
+          (fields - %w[request_id input challenge_ref]).each { |key| Atoms::ProtectedWorkspacePruneInput.digest!(request.fetch(key)) }
+          Atoms::ProtectedWorkspacePruneInput.object!(request.fetch("challenge_ref"), %w[challenge_event_digest])
+          Atoms::ProtectedWorkspacePruneInput.digest!(request.dig("challenge_ref", "challenge_event_digest"))
+          input = Atoms::ProtectedWorkspacePruneInput.parse(JSON.generate(request.fetch("input")))
+          raise SecurityError, "cleanup inspection input differs" unless Atoms::ServiceInput.digest(input) == request.fetch("input_digest")
+          frame = request.merge("schema" => SCHEMA, "kind" => "inspect", "operation_owner_binding_digest" => digest(operation_owner_binding))
+          Atoms::ProtectedWorkspacePruneInput.freeze_value(frame)
+          deadline = @wire.deadline(300)
+          admission_deadline = [deadline, @wire.deadline(5)].min
+          connect(admission_deadline) do |socket, _observed|
+            @wire.write(socket, frame, deadline: admission_deadline, limit: 65_536)
+            socket.shutdown(Socket::SHUT_WR)
+            guarded = Ace::Runtime::Molecules::ProtectedSocket::Ingress.new(socket)
+            reply = @wire.read(guarded, deadline: deadline, limit: LIMIT)
+            success = reply.is_a?(Hash) && reply["kind"] == "completed-result"
+            ref_key = success ? "receipt_ref" : "inspection_ref"
+            unless reply.is_a?(Hash) && reply.keys.sort == (["input_digest", ref_key, "kind", "request_id", "schema"].sort) &&
+                reply.values_at("schema", "kind", "request_id", "input_digest") ==
+                  [SCHEMA, success ? "completed-result" : "inspection", request.fetch("request_id"), request.fetch("input_digest")]
+              raise SecurityError, "cleanup inspection result differs"
+            end
+            ref = reply.fetch(ref_key)
+            Atoms::ProtectedWorkspacePruneInput.reference!(ref)
+            descriptor = {"version" => 1, "bytes" => ref.fetch("bytes"), "sha256" => ref.fetch("sha256"), "parts" => [ref.slice("bytes", "sha256")]}
+            @codec.receive(guarded, descriptor: descriptor, purpose: :artifacts, deadline: deadline) do |received|
+              Atoms::ProtectedWorkspacePruneInput.freeze_value(ref)
+              {kind: success ? "succeeded" : "failed-no-effect", receipt_ref: ref, bytes: received.bytes.freeze}.freeze
+            end
+          end
+        end
+
+        private
+
+        def digest(value) = Ace::Assign::Atoms::EvidenceDigest.digest(value)
+
+        def connect(deadline)
+          @wire.root_path!(File.dirname(PATH), directory: true)
+          before = @wire.socket_identity(PATH, mode: 0o660)
+          raise SecurityError, "cleanup endpoint owner differs" unless before.last == 0
+          @wire.connect(PATH, deadline: deadline) do |socket|
+            observed = @observer.observe!(socket: socket, deadline: deadline)
+            raise SecurityError, "cleanup endpoint was replaced" unless @wire.socket_identity(PATH, mode: 0o660) == before
+            yield socket, observed
+          end
+        rescue IOError, SystemCallError
+          raise Ace::Runtime::RuntimeUnavailableError, "cleanup original transport unavailable"
+        end
+
+        def eof!(socket, deadline)
+          loop do
+            remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            unless remaining.positive? && IO.select([socket], nil, nil, remaining)
+              raise Ace::Runtime::RuntimeUnavailableError, "cleanup reply EOF deadline expired"
+            end
+            byte = socket.read_nonblock(1, exception: false)
+            next if byte == :wait_readable
+            raise SecurityError, "cleanup reply has trailing bytes" unless byte.nil?
+            return
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/molecules/protected_cleanup_owner_identity.rb

@@ -0,0 +1,239 @@
+# frozen_string_literal: true
+
+require "fiddle"
+require "socket"
+require "ace/runtime/molecules/process_identity"
+require "ace/runtime/molecules/systemd_scope_manager"
+require "ace/runtime/molecules/protected_artifact_set"
+
+module Ace
+  module Lab
+    module Molecules
+      # Only trusted accepted-release composition constructs this observer.
+      # Root policy is fixed here; ordinary ProtectedLinux stays all-zero.
+      class ProtectedCleanupOwnerIdentity
+        Runtime = Ace::Runtime::Molecules
+        Unavailable = Ace::Runtime::RuntimeUnavailableError
+        DISABLE = "--disable=gems,rubyopt,did_you_mean,error_highlight,syntax_suggest"
+        UNIT_FIELDS = {"Id" => "s", "LoadState" => "s", "ActiveState" => "s", "SubState" => "s",
+          "InvocationID" => "ay", "FragmentPath" => "s", "DropInPaths" => "as"}.freeze
+        EMPTY_COMMANDS = %w[ExecConditionEx ExecStartPreEx ExecStartPostEx ExecReloadEx ExecStopEx ExecStopPostEx].freeze
+        ENVIRONMENT = %w[PATH=/usr/bin:/bin LANG=C LC_ALL=C HOME=/root].freeze
+        MANAGER_ENVIRONMENT = %w[PATH LANG LANGUAGE LC_ALL LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY
+          LC_MESSAGES LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT LC_IDENTIFICATION].freeze
+        ENVIRONMENT_FIELDS = {"Environment" => "as", "EnvironmentFiles" => "a(sb)", "PassEnvironment" => "as",
+          "UnsetEnvironment" => "as", "PAMName" => "s"}.freeze
+        SERVICE_FIELDS = {**ENVIRONMENT_FIELDS, **EMPTY_COMMANDS.to_h { |key| [key, "a(sasasttttuii)"] }, "Slice" => "s", "Type" => "s", "MainPID" => "u", "ControlPID" => "u", "ExecStartEx" => "a(sasasttttuii)"}.freeze
+
+        class Kernel
+          def initialize(identity: Runtime::ProcessIdentity.new, pidfd_open: nil)
+            @identity = identity
+            @pidfd_open = pidfd_open || method(:open_pidfd)
+          end
+
+          def capture(pid)
+            raise Unavailable, "root owner requires Linux" unless RUBY_PLATFORM.include?("linux") && File.binread("/proc/sys/kernel/yama/ptrace_scope", 128).strip == "2"
+            unless pid.is_a?(Integer) && pid.positive?
+              raise Unavailable, "root owner PID is unavailable"
+            end
+            birth = @identity.send(:native_birth, pid)
+            raise Unavailable, "root owner birth is unavailable" unless birth
+            bytes = File.binread("/proc/#{pid}/status", 65_537)
+            raise Unavailable, "root owner status is oversized" if bytes.bytesize > 65_536
+            fields = bytes.lines.to_h { |line| line.strip.split(/:\s*/, 2) }
+            ids = %w[Uid Gid].map { |key| fields.fetch(key).split.map { |id| Integer(id, 10) } }
+            caps = %w[CapInh CapPrm CapEff CapBnd CapAmb].map { |key| Integer(fields.fetch(key), 16) }
+            groups = fields.fetch("Groups").split.map { |id| Integer(id, 10) }.sort
+            unless ids.all? { |value| value == [0, 0, 0, 0] } && groups == [0] &&
+                caps == [0, 2, 2, 2, 0] && fields.fetch("NoNewPrivs") == "1" &&
+                @identity.send(:native_birth, pid) == birth
+              raise Unavailable, "root owner kernel policy differs"
+            end
+            {"pid" => pid, "uid" => 0, "gid" => 0, "groups" => groups,
+              "started_at" => birth, "host" => Socket.gethostname,
+              "parent_pid" => Integer(fields.fetch("PPid"), 10)}
+          rescue IOError, SystemCallError, KeyError, ArgumentError
+            raise Unavailable, "root owner kernel policy is unavailable"
+          end
+
+          def pin(identity)
+            handle = @pidfd_open.call(identity.fetch("pid"))
+            unless handle.is_a?(IO) && !handle.closed?
+              raise Unavailable, "root owner pidfd is unavailable"
+            end
+            unless capture(identity.fetch("pid")) == identity
+              raise Unavailable, "root owner changed during pin acquisition"
+            end
+            handle
+          rescue Fiddle::DLError, SystemCallError, IOError
+            handle.close if handle.is_a?(IO) && !handle.closed?
+            raise Unavailable, "root owner pidfd capability is unavailable"
+          rescue Exception
+            handle.close if handle.is_a?(IO) && !handle.closed?
+            raise
+          end
+
+          def open_pidfd(pid)
+            function = Fiddle::Function.new(Fiddle::Handle::DEFAULT["pidfd_open"],
+              [Fiddle::TYPE_INT, Fiddle::TYPE_INT], Fiddle::TYPE_INT)
+            fd = function.call(pid, 0)
+            raise Unavailable, "root owner pidfd is unavailable" if fd.negative?
+            IO.for_fd(fd, autoclose: true)
+          end
+          private :open_pidfd
+
+          def exited?(handle) = !IO.select([handle], nil, nil, 0).nil?
+
+          def peer(socket)
+            raise Unavailable, "root peer requires Linux" unless RUBY_PLATFORM.include?("linux")
+            socket.getsockopt(Socket::SOL_SOCKET, Socket::SO_PEERCRED).data.unpack("i!3")
+          end
+        end
+
+        def initialize(unit:, slice_unit:, entry:, interpreter:, closure:, load_paths:, manager:, kernel: Kernel.new, artifacts: nil)
+          unless unit.is_a?(String) && Runtime::SystemdScopeManager::UNIT.match?(unit) && unit.end_with?(".service") &&
+              slice_unit.is_a?(String) && Runtime::SystemdScopeManager::UNIT.match?(slice_unit) && slice_unit.end_with?(".slice") &&
+              !%w[system.slice user.slice machine.slice].include?(slice_unit) &&
+              closure.is_a?(Array) && closure.size.between?(1, 4094) &&
+              load_paths.is_a?(Array) && load_paths.size.between?(1, 64) && load_paths.uniq == load_paths &&
+              load_paths.all? { |path| path.is_a?(String) && path.start_with?("/") && !path.include?("\0") && !path.include?(":") && File.expand_path(path) == path }
+            raise ArgumentError, "cleanup identity requires a fixed accepted-release selection"
+          end
+          @unit = unit.dup.freeze
+          @slice_unit = slice_unit.dup.freeze
+          @references = [entry, interpreter, *closure].map { |ref| reference(ref) }.freeze
+          unless @references.map { |ref| ref.fetch("path") }.uniq.size == @references.size
+            raise ArgumentError, "cleanup closure has duplicate references"
+          end
+          unless load_paths.all? { |path| @references.any? { |ref| ref.fetch("path").start_with?(path + "/") } }
+            raise ArgumentError, "cleanup load path is outside the held closure"
+          end
+          @entry, @interpreter = @references.first(2)
+          @argv = [@interpreter.fetch("path"), DISABLE, "-I", load_paths.join(":"), @entry.fetch("path")].freeze
+          unless @argv.sum { |argument| argument.bytesize + 1 } <= 16_384
+            raise ArgumentError, "cleanup startup arguments exceed bound"
+          end
+          @manager, @kernel = manager, kernel
+          @verification = Mutex.new
+          @artifacts = artifacts || Runtime::ProtectedArtifactSet.new(file_limit: 32 * 1_048_576,
+            total_limit: 256 * 1_048_576, count_limit: 4096)
+        end
+
+        def observe!(socket:, deadline: Runtime::ProtectedSocket.deadline(5))
+          with_verification do
+            observe_held!(deadline: deadline, peer_join: ->(identity) {
+              @kernel.peer(socket) == [identity.fetch("pid"), 0, 0]
+            })
+          end
+        end
+
+        # Only the immutable installed listener calls this entrypoint. Its
+        # positive receiver peer is not the root process being measured.
+        def observe_self!(deadline: Runtime::ProtectedSocket.deadline(5))
+          pid = Process.pid
+          with_verification do
+            observe_held!(deadline: deadline, peer_join: ->(identity) {
+              identity.fetch("pid") == pid
+            })
+          end
+        end
+
+        def with_verification
+          unless @verification.try_lock
+            raise Unavailable, "cleanup identity verification is busy"
+          end
+          begin
+            yield
+          ensure
+            @verification.unlock
+          end
+        end
+        private :with_verification
+
+        def observe_held!(deadline:, peer_join:)
+          now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          unless deadline.is_a?(Numeric) && deadline.finite? && deadline > now
+            raise Unavailable, "cleanup identity observation deadline expired"
+          end
+          deadline = [deadline, now + 5].min
+          before = snapshot(deadline)
+          identity = @kernel.capture(before.fetch("MainPID"))
+          handle = @kernel.pin(identity)
+          @artifacts.with do |artifacts|
+            @references.each { |ref| artifacts.read!(ref) }
+            unless @references.any? { |ref| ref.fetch("path") == before.fetch("FragmentPath") }
+              raise Unavailable, "installed cleanup unit is outside the held closure"
+            end
+            join = @manager.unit_for_pidfd(handle: handle, timeout: remaining(deadline))
+            unless join == {"unit" => @unit, "invocation_id" => before.fetch("InvocationID")} &&
+                peer_join.call(identity) && !@kernel.exited?(handle) &&
+                @kernel.capture(identity.fetch("pid")) == identity && snapshot(deadline) == before
+              raise Unavailable, "cleanup peer differs from the original installed invocation"
+            end
+            artifacts.verify_unchanged!
+            unless !@kernel.exited?(handle) && @kernel.capture(identity.fetch("pid")) == identity &&
+                @manager.unit_for_pidfd(handle: handle, timeout: remaining(deadline)) == join
+              raise Unavailable, "cleanup owner changed after held source verification"
+            end
+            deep_freeze({"unit" => @unit, "invocation_id" => join.fetch("invocation_id"),
+              "process_binding" => identity, "entry_sha256" => @entry.fetch("sha256")})
+          end
+        ensure
+          handle&.close
+        end
+        private :observe_held!
+
+        private
+
+        def snapshot(deadline)
+          unit = @manager.typed_properties(unit: @unit, interface: "Unit", signatures: UNIT_FIELDS, timeout: remaining(deadline))
+          service = @manager.typed_properties(unit: @unit, interface: "Service", signatures: SERVICE_FIELDS, timeout: remaining(deadline))
+          environment = @manager.manager_environment(timeout: remaining(deadline))
+          unless environment.is_a?(Array) && environment.all? { |entry| entry.is_a?(String) && MANAGER_ENVIRONMENT.include?(entry.split("=", 2).first) } &&
+              service.fetch("Environment").sort == ENVIRONMENT.sort &&
+              %w[EnvironmentFiles PassEnvironment UnsetEnvironment].all? { |key| service.fetch(key) == [] } && service.fetch("PAMName") == ""
+            raise Unavailable, "cleanup original startup environment differs"
+          end
+          start = service.fetch("ExecStartEx")
+          unless unit.values_at("Id", "LoadState", "ActiveState", "SubState", "DropInPaths") == [@unit, "loaded", "active", "running", []] &&
+              unit.fetch("InvocationID").match?(/\A[0-9a-f]{32}\z/) && unit.fetch("InvocationID") != "0" * 32 &&
+              service.fetch("Slice") == @slice_unit &&
+              EMPTY_COMMANDS.all? { |key| service[key] == [] } && service.fetch("Type") == "exec" && service.fetch("MainPID").is_a?(Integer) && service.fetch("MainPID").positive? &&
+              service.fetch("ControlPID") == 0 && start.is_a?(Array) && start.size == 1 &&
+              start[0][0] == @interpreter.fetch("path") && start[0][1] == @argv && start[0][2] == [] &&
+              start[0][3].positive? && start[0][7] == service.fetch("MainPID") && start[0][8..9] == [0, 0]
+            raise Unavailable, "cleanup unit execution-start configuration differs"
+          end
+          unit.merge(service).merge("EffectiveManagerEnvironment" => environment)
+        rescue KeyError, NoMethodError, TypeError
+          raise Unavailable, "cleanup unit execution facts are unavailable"
+        end
+
+        def remaining(deadline)
+          value = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          raise Unavailable, "cleanup identity observation deadline expired" unless value.positive?
+          [value, 5].min
+        end
+
+        def reference(ref)
+          unless ref.is_a?(Hash) && ref.keys.sort == %w[bytes path sha256] &&
+              ref["path"].is_a?(String) && ref["path"].start_with?("/") && !ref["path"].include?("\0") && File.expand_path(ref["path"]) == ref["path"] &&
+              ref["sha256"].is_a?(String) && ref["sha256"].match?(/\A[0-9a-f]{64}\z/) &&
+              ref["bytes"].is_a?(Integer) && ref["bytes"].between?(1, 32 * 1_048_576)
+            raise ArgumentError, "cleanup closure reference is malformed"
+          end
+          deep_freeze(ref)
+        end
+
+        def deep_freeze(value)
+          case value
+          when Hash then value.to_h { |key, item| [key.dup.freeze, deep_freeze(item)] }.freeze
+          when Array then value.map { |item| deep_freeze(item) }.freeze
+          when String then value.dup.freeze
+          else value.freeze
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/molecules/protected_publication_publisher.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+require "json"
+require "digest"
+require "net/http"
+require "timeout"
+require "rubygems/package"
+require "etc"
+require "ace/herdr/molecules/bounded_process"
+require "ace/assign/authority/private_directory"
+
+module Ace
+  module Lab
+    module Molecules
+      # The admitted receiver owns permission. This boundary only invokes the
+      # existing single-artifact publisher and independently checks registry bytes.
+      class ProtectedPublicationPublisher
+        def initialize(process: Ace::Herdr::Molecules::BoundedProcess, http: Net::HTTP)
+          @process, @http = process, http
+        end
+
+        def verify!(publication:, artifact_digest:, platform:, deadline:)
+          remaining = remaining!(deadline)
+          path = "/api/v2/rubygems/#{publication.fetch('gem_name')}/versions/#{publication.fetch('version')}.json?platform=#{URI.encode_www_form_component(platform)}"
+          connection = @http.new("rubygems.org", 443, nil)
+          connection.use_ssl = true
+          connection.open_timeout = remaining
+          connection.read_timeout = remaining
+          connection.write_timeout = remaining
+          connection.max_retries = 0
+          response = nil
+          body = +""
+          Timeout.timeout(remaining, IOError) do
+            connection.start do |session|
+              connection.read_timeout = remaining!(deadline)
+            session.request(Net::HTTP::Get.new(path)) do |received|
+              response = received
+              received.read_body do |chunk|
+                remaining!(deadline)
+                raise IOError, "registry response exceeds bound" if body.bytesize + chunk.bytesize > 65_536
+                body << chunk
+                connection.read_timeout = remaining!(deadline)
+              end
+            end
+          end
+          end
+          remaining!(deadline)
+          return result("absent", "registry_version_absent") if response.is_a?(Net::HTTPNotFound)
+          return result("uncertain", "registry_verification_unavailable") unless response.is_a?(Net::HTTPSuccess)
+          value = JSON.parse(body, object_class: UniqueObject, max_nesting: 16)
+          unless value.is_a?(Hash) && value["name"] == publication.fetch("gem_name") &&
+              value["version"] == publication.fetch("version") && value["platform"] == platform &&
+              value["sha"].is_a?(String) && value["sha"].match?(/\A[0-9a-f]{64}\z/) && value["yanked"] == false
+            return result("uncertain", "registry_verification_invalid")
+          end
+          value["sha"] == artifact_digest ? result("succeeded", "registry_exact_artifact") : result("failed", "registry_artifact_conflict")
+        rescue StandardError
+          result("uncertain", "registry_verification_unavailable")
+        end
+
+        def push!(operation:, publication:, artifact:, artifact_digest:, otp:, deadline:)
+          unless Process.uid == operation.fetch("executor_uid") && Process.euid == Process.uid &&
+              operation.fetch("argv").last == "--scoped-publication" &&
+              (otp.nil? || otp.is_a?(String) && otp.match?(/\A[0-9]{6}\z/))
+            raise SecurityError, "fixed publication executor differs"
+          end
+          environment = {"PATH" => "/usr/bin:/bin", "LANG" => "C.UTF-8", "HOME" => Etc.getpwuid(Process.uid).dir}
+          environment["GEM_HOST_OTP_CODE"] = otp if otp
+          input = {"artifact" => artifact, "artifact_digest" => artifact_digest,
+            "gem_name" => publication.fetch("gem_name"), "version" => publication.fetch("version")}
+          process = @process.call(operation.fetch("argv"), stdin_data: JSON.generate(input),
+            timeout_s: [remaining!(deadline), 30].min, output_limit: 1024, stderr_limit: 1024,
+            cleanup_group: true, environment: environment, chdir: File.dirname(artifact))
+          remaining!(deadline)
+          return result("uncertain", "publisher_reply_unavailable") if process.oversized || !process.status.success?
+          value = JSON.parse(process.stdout, object_class: UniqueObject, max_nesting: 4)
+          allowed = {"otp-required" => "provider_rejected_before_acceptance", "otp-rejected" => "provider_rejected_before_acceptance",
+            "otp-expired" => "provider_rejected_before_acceptance", "failed" => %w[provider_rejected_non_otp executor_credentials_unavailable invalid_artifact_selection artifact_identity_mismatch artifact_metadata_mismatch invalid_scoped_input],
+            "uncertain" => %w[registry_verification_required provider_result_ambiguous unclassified_push_result publisher_interrupted artifact_changed_during_push]}
+          unless value.is_a?(Hash) && value.keys.sort == %w[classification code] && Array(allowed[value["classification"]]).include?(value["code"])
+            return result("uncertain", "publisher_reply_invalid")
+          end
+          value.freeze
+        rescue StandardError
+          result("uncertain", "publisher_reply_unavailable")
+        ensure
+          environment&.delete("GEM_HOST_OTP_CODE")
+        end
+
+        private
+
+        class UniqueObject < Hash
+          def []=(key, value)
+            raise JSON::ParserError, "duplicate registry field" if key?(key)
+            super
+          end
+        end
+
+        def remaining!(deadline)
+          value = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          raise IOError, "publication deadline expired" unless value.positive?
+          value
+        end
+
+        def result(classification, code)
+          {"classification" => classification, "code" => code}.freeze
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/molecules/protected_service_handler.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require "json"
-require "open3"
+require "ace/herdr/molecules/bounded_process"
 require "timeout"
 require "ace/assign/authority/private_directory"
 
@@ -19,33 +19,12 @@ module Ace
             raise SecurityError, "handler executor differs"
           end
           root = Ace::Assign::Authority::PrivateDirectory.verify!(candidate_root)
-          out = nil
-          Open3.popen3({"PATH" => "/usr/bin:/bin", "LANG" => "C.UTF-8", "HOME" => root},
-            *operation.fetch("argv"), chdir: root, pgroup: true, unsetenv_others: true) do |stdin, stdout, stderr, waiter|
-            readers = []
-            begin
-              Timeout.timeout(30) do
-                readers = [Thread.new { bounded(stdout, MAX_STDOUT) }, Thread.new { bounded(stderr, MAX_STDERR) }]
-                stdin.write(JSON.generate(envelope))
-                stdin.close
-                output, errors = readers.map(&:value)
-                unless output && errors && waiter.value.success?
-                  return nil
-                end
-                out = output
-              end
-            rescue Timeout::Error, IOError, SystemCallError
-              return nil
-            ensure
-              stdin.close unless stdin.closed?
-              # This group is created and owned by this receiver. Termination
-              # is cleanup, never proof that an arbitrary handler left no effect.
-              Process.kill("KILL", -waiter.pid) rescue nil
-              waiter.value
-              [stdout, stderr].each { |io| io.close unless io.closed? }
-              readers.each(&:join)
-            end
-          end
+          result = Ace::Herdr::Molecules::BoundedProcess.call(operation.fetch("argv"),
+            stdin_data: JSON.generate(envelope), timeout_s: 30,
+            output_limit: MAX_STDOUT, stderr_limit: MAX_STDERR, cleanup_group: true,
+            environment: {"PATH" => "/usr/bin:/bin", "LANG" => "C.UTF-8", "HOME" => root}, chdir: root)
+          return nil if result.oversized || !result.status.success?
+          out = result.stdout
           response = JSON.parse(out)
           request = envelope.fetch("request")
           unless response.is_a?(Hash) && response.keys.sort == %w[evidence input_digest outcome request_id] &&
@@ -54,19 +33,9 @@ module Ace
             return nil
           end
           response
-        rescue JSON::ParserError
-          nil
-        end
-
-        private
-
-        def bounded(io, limit)
-          bytes = io.read(limit + 1).to_s
-          bytes.bytesize <= limit ? bytes : nil
-        rescue IOError, SystemCallError
+        rescue JSON::ParserError, Timeout::Error, Ace::Herdr::Molecules::BoundedProcess::PostLaunchError,
+          IOError, SystemCallError
           nil
-        ensure
-          io.close unless io.closed?
         end
       end
     end