ace-lab 0.4.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bbfb351af77987d179094c39d14b12ac6209ba6825bc680e932df4fcf484684d
-  data.tar.gz: 92d60f3d735582fc4371569d1f2d19691820d924855564ac95ac71eba9e06ecf
+  metadata.gz: c50694633d1faa21137c917494c8ca7c285f05b84660e1d6054114de62803e14
+  data.tar.gz: 88d0d94b87fed92e00cd0e4cc8a93e8e40821da3967fe7a92283c13efbf813a9
 SHA512:
-  metadata.gz: a088f9ce2372cf71bfabe2df3f58b578ced3b1dae4f28ac1d791c90af64b4ac2795020e3d7ecbd8158cab7c75e2be6413250b22a7413459e466dc5d155404fe9
-  data.tar.gz: 38031154d986e6d25fcfac08ee890cf619553ff26536327b128076f4fbec7c862a76bf6e04c438aea2bd87a6eb566aa82299959809c44fefd00c1edb0ab7433f
+  metadata.gz: b62e4b53841b9104643d6e432cd8d80e298c9508f7b9d9b630b683ef0065826b0664109f2bb84247addaa9eca5c854ba5d042adaa548930792321e64cbf0d926
+  data.tar.gz: 9697250de3414f290990c5cfadec04a9ad206f17fc98f57edfc3d47f38d0d37c42192145de69c5e806cd3f61ced375d9ee216ee2573deca04fb35757e02b6129

data/CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.1] - 2026-10-10
+
+### Fixed
+
+- Require the published producer and consumer patch versions containing the protected context and managed-attempt APIs; exclude incompatible prior dependency graphs.
+
+## [0.5.0] - 2026-10-08
+
+### Added
+
+- Deliver scoped RubyGems publication through the fixed receiver and canonical HITL authorization, preserving original request, OTP challenge and publication-result evidence.
+
+### Changed
+
+- Compose actual service/result owners without a read-proof completion handler; retain authenticated service settlement and cleanup boundaries.
+
+### Fixed
+
+- Load protected policy/listener dependencies directly and keep cleanup inspection tied to the original receiver and immutable result evidence.
+
 ## [0.4.0] - 2026-10-05
 
 ### Added

data/docs/usage.md

@@ -282,3 +282,13 @@ reads; it never provisions.
 
   `ace-assign`'s evidence journal. The Lab execution binary
   (`/usr/local/bin/lab`) is never invoked or required.
+
+### Protected handler cleanup boundary
+
+Handlers retain the fixed closed environment and 30-second execution deadline, with 16KiB stdout and 8KiB stderr caps. Owned cleanup adds at most one second of confirmed reaping; unresolved cleanup remains uncertain and cannot return a service receipt. It cannot establish an arbitrary domain target or surviving writer is absent. The gad.b operation-specific fresh inspector remains required source work; installed verification is centralized in gad.2.
+
+### Selected receiver no-effect recovery
+
+The existing protected receiver exposes `recover_no_effect(binding:, input_bytes:, mutation_id:, expected_generation:)`. Supply the original assignment/attempt/candidate/head/request binding, original structured input, stable mutation ID and unchanged original positive authority generation. The receiver snapshots those inputs, authenticates canonical status and input before any settled return, and adopts an already accepted current challenge without claiming again. A needed claim uses the supplied generation unchanged. Lost acknowledgements remain uncertain; status retry never repeats the original effect.
+
+Trusted operation configuration must provide a distinct fixed `no_effect_argv` for the original project/service/executor. Inspection may proceed after the effect lease expires, but it never renews effect permission or selects normal effect argv. The selected inspector must produce operation-specific original target/handler/writer observations and existing strict challenge-bound artifacts; only the authority's canonical import can establish `failed-settled`. This source API and controlled composition do not deliver the outstanding gad.b inspector or installed acceptance.

data/lib/ace/lab/atoms/protected_publication_input.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require_relative "service_input"
+
+module Ace
+  module Lab
+    module Atoms
+      # One accepted artifact, never a queue selector or a build instruction.
+      module ProtectedPublicationInput
+        REGISTRY = "https://rubygems.org"
+        PUBLICATION_FIELDS = %w[gem_name version head registry artifact_relative_path].freeze
+        NAME = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/
+        VERSION = /\A[0-9]+(?:\.[0-9A-Za-z]+)*(?:-[0-9A-Za-z]+(?:\.[0-9A-Za-z]+)*)?\z/
+
+        def self.decode!(bytes)
+          unless bytes.is_a?(String) && bytes.bytesize.between?(1, ServiceInput::MAX_BYTES)
+            raise ArgumentError, "publication input exceeds its bound"
+          end
+          input = JSON.parse(bytes, allow_duplicate_key: false, allow_comments: false,
+            allow_nan: false, create_additions: false, max_nesting: 16)
+          validate!(input)
+        rescue JSON::ParserError
+          raise ArgumentError, "publication input must be valid JSON"
+        end
+
+        def self.validate!(input)
+          unless input.is_a?(Hash) && input.keys.sort == %w[publication target] &&
+              input["publication"].is_a?(Hash) && input["publication"].keys.sort == PUBLICATION_FIELDS.sort &&
+              input["target"].is_a?(Hash) && input["target"].keys.sort == %w[artifact_digest resource]
+            raise ArgumentError, "publication input fields differ"
+          end
+          value = input.fetch("publication")
+          name, version, head, registry, path = value.values_at(*PUBLICATION_FIELDS)
+          unless name.is_a?(String) && name.match?(NAME) && version.is_a?(String) &&
+              version.bytesize.between?(1, 128) && version.match?(VERSION) &&
+              head.is_a?(String) && head.match?(/\A[0-9a-f]{40}\z/) && registry == REGISTRY &&
+              path.is_a?(String) && path.bytesize.between?(1, 4096) && path.end_with?(".gem") &&
+              path.split("/", -1).all? { |part| part.match?(/\A[a-zA-Z0-9_.-]+\z/) && !%w[. ..].include?(part) } &&
+              input.dig("target", "resource") == "rubygems:#{name}:#{version}" &&
+              input.dig("target", "artifact_digest").is_a?(String) &&
+              input.dig("target", "artifact_digest").match?(ServiceInput::SHA256)
+            raise ArgumentError, "publication artifact selection differs"
+          end
+          ServiceInput.validate!(input)
+          input
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/atoms/protected_workspace_prune_input.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Ace
+  module Lab
+    module Atoms
+      # Structural input validation only. Canonical ownership, preservation and
+      # current permission are independently verified by the operation owners.
+      module ProtectedWorkspacePruneInput
+        MAX_BYTES = 65_536
+        ID = /\A[A-Za-z0-9_.-]{1,200}\z/
+        SHA = /\A[0-9a-f]{64}\z/
+        COMMIT = /\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/
+        ASSOCIATION = %w[project_id mapping_id assignment_id attempt_id].freeze
+
+        module_function
+
+        def parse(bytes)
+          reject! unless bytes.is_a?(String) && bytes.bytesize.between?(1, MAX_BYTES)
+          text = bytes.dup.force_encoding(Encoding::UTF_8)
+          reject! unless text.valid_encoding?
+          input = JSON.parse(text, create_additions: false, max_nesting: 16,
+            allow_nan: false, allow_comments: false, allow_duplicate_key: false)
+          object!(input, %w[schema maintenance target publication preservation])
+          reject! unless input.fetch("schema") == "ace.protected-workspace-prune/v1"
+          association!(input.fetch("maintenance"))
+          target = object!(input.fetch("target"), ASSOCIATION +
+            %w[resource artifact_digest descriptor_sha256 binding_event_digest release_event_digest journal_commit])
+          ASSOCIATION.each { |field| token!(target.fetch(field)) }
+          %w[artifact_digest descriptor_sha256 binding_event_digest release_event_digest].each { |key| digest!(target.fetch(key)) }
+          commit!(target.fetch("journal_commit"))
+          resource = "workspace:#{target.fetch('project_id')}:#{target.fetch('mapping_id')}:#{target.fetch('assignment_id')}"
+          reject! unless resource.bytesize <= 256 && target.fetch("resource") == resource
+          publication = object!(input.fetch("publication"), %w[descriptor_sha256 installation_ref])
+          digest!(publication.fetch("descriptor_sha256"))
+          reference!(publication.fetch("installation_ref"))
+          preservation!(input.fetch("preservation"))
+          freeze_value(input)
+        rescue JSON::ParserError, JSON::NestingError, EncodingError
+          reject!
+        end
+
+        def preservation!(value)
+          object!(value, %w[head branch destinations manifest_sha256])
+          commit!(value.fetch("head"))
+          branch = value.fetch("branch")
+          unless branch.nil?
+            ref!(branch)
+            reject! unless branch.start_with?("refs/heads/")
+          end
+          digest!(value.fetch("manifest_sha256"))
+          destinations = value.fetch("destinations")
+          reject! unless destinations.is_a?(Array) && destinations.length <= 64
+          identities = destinations.map do |entry|
+            object!(entry, %w[repository_id ref head])
+            token!(entry.fetch("repository_id"))
+            ref!(entry.fetch("ref"))
+            commit!(entry.fetch("head"))
+            entry.values_at("repository_id", "ref", "head")
+          end
+          reject! unless identities == identities.sort && identities.uniq == identities
+        end
+
+        def association!(value)
+          object!(value, ASSOCIATION)
+          value.each_value { |item| token!(item) }
+        end
+
+        def reference!(value)
+          object!(value, %w[path bytes sha256])
+          path = value.fetch("path")
+          reject! unless path.is_a?(String) && path.bytesize.between?(2, 4096) &&
+            path.start_with?("/") && !path.include?("\0") && !path.end_with?("/") &&
+            path.split("/", -1).drop(1).all? { |part| !part.empty? && !%w[. ..].include?(part) }
+          reject! unless value.fetch("bytes").is_a?(Integer) && value.fetch("bytes").between?(1, MAX_BYTES)
+          digest!(value.fetch("sha256"))
+        end
+
+        def object!(value, fields)
+          reject! unless value.is_a?(Hash) && value.keys.sort == fields.sort
+          value
+        end
+
+        def token!(value)
+          reject! unless value.is_a?(String) && ID.match?(value)
+        end
+
+        def digest!(value)
+          reject! unless value.is_a?(String) && SHA.match?(value)
+        end
+
+        def commit!(value)
+          reject! unless value.is_a?(String) && COMMIT.match?(value)
+        end
+
+        def ref!(value)
+          reject! unless value.is_a?(String) && value.bytesize.between?(6, 256) &&
+            value.start_with?("refs/") && !value.match?(/[\x00-\x20\x7f~^:?*\[\\]/) &&
+            !value.include?("..") && !value.include?("@{") && !value.end_with?(".") &&
+            value.split("/", -1).all? { |part| !part.empty? && !part.start_with?(".") && !part.end_with?(".lock") }
+        end
+
+        def freeze_value(value)
+          value.each { |key, item| key.freeze; freeze_value(item) } if value.is_a?(Hash)
+          value.each { |item| freeze_value(item) } if value.is_a?(Array)
+          value.freeze
+        end
+
+        def reject! = raise(ArgumentError, "invalid protected prune input")
+      end
+    end
+  end
+end

data/lib/ace/lab/atoms/protected_workspace_prune_preview.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require_relative "protected_workspace_prune_input"
+require "ace/assign/molecules/execution_scope_lineage"
+require "ace/assign/atoms/evidence_digest"
+
+module Ace
+  module Lab
+    module Atoms
+      # Closed transport data only; canonical and physical owners must
+      # independently authenticate these selectors before any effect.
+      module ProtectedWorkspacePrunePreview
+        Input = ProtectedWorkspacePruneInput
+        CONTEXT = %w[journal_commit maintenance head candidate_generation worker_process_binding caller_process_binding].freeze
+        RESULT = %w[schema kind intent_digest publication maintenance maintenance_context target preservation inventory_sha256 file_count total_bytes].freeze
+        module_function
+
+        def intent!(value)
+          Input.object!(value, %w[schema maintenance target publication destinations])
+          Input.reject! unless value["schema"] == "ace.protected-workspace-prune-preview/v1"
+          Input.association!(value.fetch("maintenance"))
+          target = value.fetch("target")
+          Input.object!(target, Input::ASSOCIATION + %w[resource descriptor_sha256 binding_event_digest release_event_digest journal_commit])
+          Input::ASSOCIATION.each { |key| Input.token!(target.fetch(key)) }
+          %w[descriptor_sha256 binding_event_digest release_event_digest].each { |key| Input.digest!(target.fetch(key)) }
+          Input.commit!(target.fetch("journal_commit"))
+          expected = "workspace:#{target.fetch('project_id')}:#{target.fetch('mapping_id')}:#{target.fetch('assignment_id')}"
+          Input.reject! unless expected.bytesize <= 256 && target["resource"] == expected
+          publication = Input.object!(value.fetch("publication"), %w[descriptor_sha256 installation_ref])
+          Input.digest!(publication.fetch("descriptor_sha256"))
+          Input.reference!(publication.fetch("installation_ref"))
+          # Reuse the existing exact destination/ref owner, without accepting
+          # or manufacturing a preservation authority assertion.
+          destinations!(value.fetch("destinations"))
+          Input.reject! if JSON.generate(value).bytesize > Input::MAX_BYTES
+          Input.freeze_value(value)
+        end
+
+        def destinations!(destinations)
+          Input.reject! unless destinations.is_a?(Array) && destinations.length <= 64
+          ids = destinations.map do |entry|
+            Input.object!(entry, %w[repository_id ref head])
+            Input.token!(entry.fetch("repository_id")); Input.ref!(entry.fetch("ref")); Input.commit!(entry.fetch("head"))
+            entry.values_at("repository_id", "ref", "head")
+          end
+          Input.reject! unless ids == ids.sort && ids == ids.uniq
+        end
+
+        def context!(value)
+          Input.object!(value, CONTEXT)
+          Input.commit!(value.fetch("journal_commit"))
+          Input.association!(value.fetch("maintenance"))
+          Input.commit!(value.fetch("head"))
+          Input.reject! unless value["candidate_generation"].is_a?(Integer) && value["candidate_generation"].positive?
+          original = value.fetch("worker_process_binding")
+          birth = original.is_a?(Hash) && original["started_at"]
+          boot = birth.is_a?(String) && birth.match(/\Alinux:([0-9a-f-]{36}):[0-9]+\z/)&.captures&.first
+          %w[worker_process_binding caller_process_binding].each do |key|
+            Ace::Assign::Molecules::ExecutionScopeLineage.validate_process_identity!(value.fetch(key), boot_id: boot)
+          end
+          Input.reject! if JSON.generate(value).bytesize > 16_384
+          Input.freeze_value(value)
+        end
+
+        def result!(value, intent:, context:)
+          Input.object!(value, RESULT)
+          Input.reject! unless value.values_at("schema", "kind") == ["ace.protected-workspace-prune-preview-result/v1", "preview"]
+          Input.reject! unless value["intent_digest"] == Ace::Assign::Atoms::EvidenceDigest.digest(intent) &&
+            value["maintenance_context"] == context && value["maintenance"] == intent["maintenance"] &&
+            value["publication"] == intent["publication"] && value.fetch("target").except("artifact_digest") == intent["target"]
+          input = {"schema" => "ace.protected-workspace-prune/v1"}.merge(value.slice("maintenance", "target", "publication", "preservation"))
+          Input.parse(JSON.generate(input))
+          Input.digest!(value.fetch("inventory_sha256"))
+          Input.reject! unless value["inventory_sha256"] == value.dig("preservation", "manifest_sha256")
+          Input.reject! unless value["file_count"].is_a?(Integer) && value["file_count"].between?(0, 4096) &&
+            value["total_bytes"].is_a?(Integer) && value["total_bytes"].between?(0, 256 * 1024 * 1024)
+          Input.reject! unless value.dig("preservation", "destinations") == intent["destinations"] &&
+            value.dig("target", "artifact_digest") == Ace::Assign::Atoms::EvidenceDigest.digest(
+              "target" => intent.fetch("target"), "preservation" => value.fetch("preservation"))
+          Input.reject! if JSON.generate(value).bytesize > 16_384
+          Input.freeze_value(value)
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/atoms/service_input.rb

@@ -15,16 +15,22 @@ module Ace
         RESOURCE = /\A[a-zA-Z0-9_.:\/-]{1,256}\z/
 
         def self.load(path)
-          raise ArgumentError, "input file is missing" unless File.file?(path)
-          # One handle bounds the read: a file replaced or grown between a
-          # size check and a separate read cannot bypass the limit.
           begin
-            data = File.open(path, "rb") do |file|
-              content = file.read(MAX_BYTES + 1)
-              raise ArgumentError, "input exceeds #{MAX_BYTES} bytes" if content && content.bytesize > MAX_BYTES
-              JSON.parse(content.to_s)
+            flags = File::RDONLY | File::NOFOLLOW | File::NONBLOCK
+            data = File.open(path, flags) do |file|
+              before = file.stat
+              unless before.file? && before.size <= MAX_BYTES && same_file?(before, File.lstat(path))
+                raise ArgumentError, "input must be a bounded regular file"
+              end
+              content = file.read(MAX_BYTES + 1).to_s
+              unless content.bytesize <= MAX_BYTES && same_file?(before, file.stat) &&
+                  same_file?(before, File.lstat(path))
+                raise ArgumentError, "input file changed while reading"
+              end
+              JSON.parse(content, allow_duplicate_key: false, allow_comments: false,
+                allow_nan: false, create_additions: false, max_nesting: 16)
             end
-          rescue Errno::EACCES, Errno::EISDIR
+          rescue SystemCallError, IOError
             raise ArgumentError, "input file is unreadable"
           end
           raise ArgumentError, "input must be a JSON object" unless data.is_a?(Hash)
@@ -34,6 +40,12 @@ module Ace
           raise ArgumentError, "input must be valid JSON"
         end
 
+        def self.same_file?(left, right)
+          [left.dev, left.ino, left.mode, left.uid, left.gid, left.size, left.mtime, left.ctime] ==
+            [right.dev, right.ino, right.mode, right.uid, right.gid, right.size, right.mtime, right.ctime]
+        end
+        private_class_method :same_file?
+
         def self.digest(data)
           Digest::SHA256.hexdigest(JSON.generate(canonical(data)))
         end

data/lib/ace/lab/authorization_path.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Ace
+  module Lab
+    # Authorization grants live in a single deployment-controlled file at a
+    # FIXED path — never in the caller-writable configuration cascade and
+    # never at a caller-selected location (review rounds 4-5, F3/F1). The
+    # file must be root-owned and not group/world-writable, including every
+    # directory on its real path; GrantResolver verifies and fails closed.
+    AUTHORIZATION_PATH = "/etc/lab/ace-lab/authorization.yml"
+
+    # Path of the trusted authorization grants document. A method (not a
+    # bare constant reference) so tests can stub the seam without any
+    # caller-controllable production override.
+    # @return [String]
+    def self.authorization_path
+      AUTHORIZATION_PATH
+    end
+  end
+end

data/lib/ace/lab/cli/commands/service.rb

@@ -3,6 +3,7 @@
 require "json"
 require "ace/support/cli"
 require_relative "support"
+require_relative "../../organisms/protected_service_request"
 
 module Ace
   module Lab
@@ -14,6 +15,16 @@ module Ace
               @service ||= Organisms::ServiceRequestService.new
             end
 
+            def protected_service
+              @protected_service ||= Organisms::ProtectedServiceRequest.new
+            end
+
+            def protected_refusal(error)
+              code = error.is_a?(ArgumentError) || error.is_a?(SecurityError) ? "protected_service_refused" : "protected_service_unavailable"
+              message = error.is_a?(JSON::ParserError) ? "protected installed selection unavailable" : error.message.to_s.scrub[0, 512]
+              emit({"status" => "error", "error" => {"code" => code, "message" => message}})
+            end
+
             def emit(envelope)
               puts JSON.generate(envelope)
               return if envelope["status"] == "ok"
@@ -39,11 +50,26 @@ module Ace
             option :request_id, type: :string, required: true, desc: "Idempotency key"
             option :dry_run, type: :boolean, desc: "Validate without claiming or executing"
 
+            option :mapping, type: :string, desc: "Original protected mapping ID"
+            option :scope, type: :string, desc: "Original hierarchical prepared scope"
+            option :service, type: :string, desc: "Installed receiver ID"
+            option :candidate_head, type: :string, desc: "Exact approved candidate head"
+            option :candidate_generation, type: :integer, desc: "Original candidate generation"
+            option :expected_generation, type: :integer, desc: "Original authority generation"
+
             def call(project:, assignment:, attempt:, operation:, input:, authorization:, request_id:, **options)
               reject_identity_flags!(options)
+              selected = protected_service.selected?(options)
+              if selected
+                return emit(protected_service.request(project: project, assignment: assignment, attempt: attempt,
+                  operation: operation, input_path: input, authorization: authorization, request_id: request_id, **options))
+              end
               emit(service.request(project: project, assignment: assignment, attempt: attempt,
                 operation: operation, input_path: input, authorization: authorization,
                 request_id: request_id, dry_run: options[:dry_run]))
+            rescue ArgumentError, Ace::Assign::Error, Ace::Git::Error, Ace::Runtime::RuntimeUnavailableError, JSON::ParserError, SecurityError, KeyError, SystemCallError => error
+              raise if selected == false
+              protected_refusal(error)
             end
           end
 
@@ -56,9 +82,28 @@ module Ace
             option :request, type: :string, required: true, desc: "Request ID"
             option :format, type: :string, desc: "Output format (json only)"
 
+            option :project, type: :string, desc: "Original project ID"
+            option :assignment, type: :string, desc: "Original assignment ID"
+            option :attempt, type: :string, desc: "Original attempt ID"
+            option :mapping, type: :string, desc: "Original protected mapping ID"
+            option :scope, type: :string, desc: "Original hierarchical prepared scope"
+            option :candidate_head, type: :string, desc: "Exact approved candidate head"
+            option :candidate_generation, type: :integer, desc: "Original candidate generation"
+            option :input_digest, type: :string, desc: "Original normalized input SHA-256"
+            option :target, type: :string, desc: "Original target resource ID"
+            option :artifact_digest, type: :string, desc: "Original artifact SHA-256 (omit for null)"
+
             def call(request:, **options)
+              reject_identity_flags!(options)
               ensure_json_format!(options)
+              selected = protected_service.selected?(options)
+              if selected
+                return emit(protected_service.status(request_id: request, **options))
+              end
               emit(service.status(request_id: request))
+            rescue ArgumentError, Ace::Assign::Error, Ace::Git::Error, Ace::Runtime::RuntimeUnavailableError, JSON::ParserError, SecurityError, KeyError, SystemCallError => error
+              raise if selected == false
+              protected_refusal(error)
             end
           end
         end

data/lib/ace/lab/errors.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Ace
+  module Lab
+    class Error < StandardError; end
+
+    # Raised when topology configuration violates the schema contract
+    class InvalidConfigurationError < Error; end
+  end
+end
+

data/lib/ace/lab/molecules/grant_resolver.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
+require_relative "../errors"
 require "yaml"
+require "date"
 
 module Ace
   module Lab

data/lib/ace/lab/molecules/protected_cleanup_owner_admission.rb

@@ -0,0 +1,163 @@
+# frozen_string_literal: true
+
+require "ace/assign/authority/service_evidence"
+require_relative "protected_cleanup_owner_client"
+require "ace/assign/authority/endcap"
+require "ace/assign/authority/launch_lifecycle"
+
+module Ace
+  module Lab
+    module Molecules
+      # Only the fixed listener supplies the installed journal snapshot and its
+      # independently observed self binding. A frame selects neither owner.
+      class ProtectedCleanupOwnerAdmission
+        FIELDS = %w[schema kind request_id input_digest claim_binding request_event_digest
+          dispatch_event_digest input operation_owner_binding_digest].freeze
+        INSPECT_FIELDS = (FIELDS + %w[challenge_ref]).freeze
+
+        def initialize(deployment:, authority_id:, mapping_id:, service_id:, kernel:, preview_policy: nil)
+          @deployment, @authority_id, @kernel = deployment, authority_id, kernel
+          @mapping_id, @service_id = mapping_id, service_id
+          @preview_policy = preview_policy
+        end
+
+        def identity_reader!(peer)
+          authority = @deployment.authority(@authority_id)
+          if peer.slice("uid", "gid", "groups") == authority.slice("uid", "gid", "groups")
+            @kernel.live!(peer)
+            return true
+          end
+          receiver!(peer)
+        end
+
+        def connection_group!(gid)
+          authority = @deployment.authority(@authority_id)
+          map = @deployment.mapping(@mapping_id)
+          project = @deployment.project(map.fetch("project_id"))
+          receiver = project.fetch("service_receivers").fetch(@service_id)
+          credentials = project.fetch("peer_credentials").fetch(receiver.fetch("executor_uid").to_s)
+          unless gid.is_a?(Integer) && gid.positive? && [authority, credentials].all? { |principal| principal.fetch("gid") == gid || principal.fetch("groups").include?(gid) }
+            raise SecurityError, "cleanup connection group differs from installed principals"
+          end
+          true
+        end
+
+        def receiver!(peer)
+          map = @deployment.mapping(@mapping_id)
+          project = @deployment.project(map.fetch("project_id"))
+          receiver = project.fetch("service_receivers").fetch(@service_id)
+          credentials = project.fetch("peer_credentials").fetch(receiver.fetch("executor_uid").to_s)
+          unless map.fetch("authority_id") == @authority_id && peer.fetch("uid").is_a?(Integer) && peer.fetch("uid").positive? &&
+              peer.fetch("uid") == receiver.fetch("executor_uid") && peer.fetch("gid") == credentials.fetch("gid") &&
+              peer.fetch("groups") == credentials.fetch("groups")
+            raise SecurityError, "cleanup installed receiver differs"
+          end
+          @kernel.live!(peer)
+          true
+        rescue KeyError, TypeError
+          raise SecurityError, "cleanup installed receiver unavailable"
+        end
+
+        def preview!(frame:, peer:, operation_owner_binding:, journal:)
+          receiver!(peer)
+          Atoms::ProtectedWorkspacePruneInput.object!(frame, %w[schema kind intent maintenance_context])
+          raise SecurityError, "cleanup preview kind differs" unless frame.values_at("schema", "kind") == [ProtectedCleanupOwnerClient::SCHEMA, "preview"]
+          intent = Atoms::ProtectedWorkspacePrunePreview.intent!(frame.fetch("intent"))
+          supplied = Atoms::ProtectedWorkspacePrunePreview.context!(frame.fetch("maintenance_context"))
+          maintenance = supplied.fetch("maintenance")
+          map = @deployment.mapping(@mapping_id)
+          unless intent.fetch("maintenance") == maintenance && maintenance.fetch("mapping_id") == @mapping_id &&
+              maintenance.fetch("project_id") == map.fetch("project_id") && map.fetch("authority_id") == @authority_id
+            raise SecurityError, "cleanup preview installed scope differs"
+          end
+          raise SecurityError, "cleanup preview policy composition unavailable" unless @preview_policy
+          launch = Ace::Assign::Authority::LaunchLifecycle.new(deployment: @deployment, kernel: @kernel)
+          owner = Ace::Assign::Authority::Endcap.new(deployment: @deployment, launch: launch, kernel: @kernel, service_policy: @preview_policy)
+          params = maintenance.except("project_id").merge("service_id" => @service_id,
+            "worker_process_binding" => supplied.fetch("caller_process_binding"))
+          selected = owner.workspace_prune_preview_context_at!(journal: journal, params: params, map: map, peer: peer, role: :executor)
+          raise SecurityError, "cleanup preview canonical selection changed" unless selected == supplied
+          Atoms::ProtectedWorkspacePruneInput.freeze_value({"intent" => intent, "maintenance_context" => selected,
+            "operation_owner_binding" => operation_owner_binding})
+        rescue KeyError, TypeError, ArgumentError
+          raise SecurityError, "cleanup preview canonical selection unavailable"
+        end
+
+        def admit!(frame:, peer:, operation_owner_binding:, journal:)
+          admit_original!(frame: frame, peer: peer, operation_owner_binding: operation_owner_binding, journal: journal, purpose: :execute)
+        end
+
+        def inspect!(frame:, peer:, operation_owner_binding:, journal:)
+          context = admit_original!(frame: frame, peer: peer, operation_owner_binding: operation_owner_binding, journal: journal, purpose: :inspect)
+          reference = frame.fetch("challenge_ref")
+          Atoms::ProtectedWorkspacePruneInput.object!(reference, %w[challenge_event_digest])
+          Atoms::ProtectedWorkspacePruneInput.digest!(reference.fetch("challenge_event_digest"))
+          challenge = Ace::Assign::Authority::ServiceEvidence.new(journal: journal).challenge!(context.fetch("record"), pending: {commit: context.fetch("commit")})
+          unless challenge.fetch("digest") == reference.fetch("challenge_event_digest")
+            raise SecurityError, "cleanup inspection challenge differs"
+          end
+          Atoms::ProtectedWorkspacePruneInput.freeze_value(context.merge("challenge" => challenge))
+        end
+
+        private
+
+        def admit_original!(frame:, peer:, operation_owner_binding:, journal:, purpose:)
+          receiver!(peer)
+          Atoms::ProtectedWorkspacePruneInput.object!(frame, purpose == :execute ? FIELDS : INSPECT_FIELDS)
+          unless frame.values_at("schema", "kind") == [ProtectedCleanupOwnerClient::SCHEMA, purpose.to_s]
+            raise SecurityError, "cleanup invocation kind differs"
+          end
+          Atoms::ProtectedWorkspacePruneInput.token!(frame.fetch("request_id"))
+          (FIELDS - %w[schema kind request_id input]).each do |key|
+            Atoms::ProtectedWorkspacePruneInput.digest!(frame.fetch(key))
+          end
+          input = Atoms::ProtectedWorkspacePruneInput.parse(JSON.generate(frame.fetch("input")))
+          unless Atoms::ServiceInput.digest(input) == frame.fetch("input_digest") &&
+              (purpose == :inspect || digest(operation_owner_binding) == frame.fetch("operation_owner_binding_digest"))
+            raise SecurityError, "cleanup original input or owner differs"
+          end
+          maintenance = input.fetch("maintenance")
+          map = @deployment.mapping(maintenance.fetch("mapping_id"))
+          unless maintenance.fetch("mapping_id") == @mapping_id && map.fetch("authority_id") == @authority_id && map.fetch("project_id") == maintenance.fetch("project_id")
+            raise SecurityError, "cleanup installed scope differs"
+          end
+          unless journal.evidence_mode == :protected
+            raise SecurityError, "cleanup requires the installed protected service evidence owner"
+          end
+          commit = journal.ref_value
+          journal.verify_canonical_prefix!(commit: commit)
+          record = journal.service_request(frame.fetch("request_id"), commit: commit)
+          unless record && record.fetch("service_id") == @service_id && record.slice("project_id", "mapping_id", "assignment_id", "attempt_id") == maintenance &&
+              record.values_at("operation", "dispatch_phase") == ["prune-preserved-workspace", "dispatch_started"] &&
+              (purpose == :execute ? record["state"] == "uncertain" : %w[uncertain failed].include?(record["state"])) &&
+              record.slice("request_id", "input_digest", "claim_binding") == frame.slice("request_id", "input_digest", "claim_binding") &&
+              record.fetch("target") == Atoms::ServiceInput.target(input) &&
+              digest(record.fetch("operation_owner_binding")) == frame.fetch("operation_owner_binding_digest") &&
+              (purpose == :inspect || digest(record.fetch("executor_process_binding")) == digest(peer))
+            raise SecurityError, "cleanup canonical original dispatch differs"
+          end
+          Ace::Assign::Authority::ServiceEvidence.new(journal: journal).context(record, pending: {commit: commit})
+          receiver = @deployment.project(map.fetch("project_id")).fetch("service_receivers").fetch(record.fetch("service_id"))
+          credentials = @deployment.project(map.fetch("project_id")).fetch("peer_credentials").fetch(receiver.fetch("executor_uid").to_s)
+          unless peer.fetch("uid") == record.fetch("executor_uid") && peer.fetch("uid") == receiver.fetch("executor_uid") &&
+              peer.fetch("gid") == credentials.fetch("gid") && peer.fetch("groups") == credentials.fetch("groups")
+            raise SecurityError, "cleanup original executor differs"
+          end
+          @kernel.live!(peer)
+          proof = Ace::Assign::Authority::ServiceEvidence.new(journal: journal).cleanup_dispatch_context!(
+            record, commit: commit, selectors: frame.slice("request_event_digest", "dispatch_event_digest"))
+          if purpose == :execute && proof.fetch("dispatch_record") != record
+            raise SecurityError, "cleanup original executable record differs"
+          end
+          Atoms::ProtectedWorkspacePruneInput.freeze_value(JSON.parse(JSON.generate({"commit" => commit,
+            "record" => record, "input" => input, "operation_owner_binding" => operation_owner_binding,
+            "request_event_digest" => frame.fetch("request_event_digest"), "dispatch_event_digest" => frame.fetch("dispatch_event_digest")})))
+        rescue KeyError, TypeError, ArgumentError
+          raise SecurityError, "cleanup canonical admission is unavailable"
+        end
+
+        def digest(value) = Ace::Assign::Atoms::EvidenceDigest.digest(value)
+      end
+    end
+  end
+end