ace-lab 0.4.0 → 0.5.1

data/lib/ace/lab/molecules/protected_service_policy.rb

@@ -2,7 +2,15 @@
 
 require "json"
 require "etc"
-require "ace/assign"
+require "ace/assign/atoms/evidence_digest"
+require_relative "../authorization_path"
+require_relative "../atoms/service_input"
+require "ace/git/atoms/service_pr_input"
+require_relative "grant_resolver"
+require_relative "caller_authorizer"
+require_relative "service_policy"
+require_relative "../atoms/protected_workspace_prune_input"
+require_relative "../atoms/protected_publication_input"
 
 module Ace
   module Lab
@@ -11,18 +19,28 @@ module Ace
       # Only composition supplies collaborators; no wire-selected policy,
       # executable, input path or caller identity is accepted here.
       class ProtectedServicePolicy
-        def initialize(proposal_resolver:, document_loader: nil)
+        def initialize(proposal_resolver:, document_loader: nil, cleanup_owner: nil)
           @proposal_resolver = proposal_resolver
+          @cleanup_owner = cleanup_owner
           @document_loader = document_loader || -> { GrantResolver.trusted_document(Ace::Lab.authorization_path) }
         end
 
-        def input_binding(bytes, expected_digest:, expected_target:)
+        def input_binding(bytes, expected_digest:, expected_target:, operation:)
           unless bytes.is_a?(String) && bytes.bytesize.between?(1, Atoms::ServiceInput::MAX_BYTES)
             raise ArgumentError, "structured service input exceeds its fixed limit"
           end
-          input = JSON.parse(bytes)
+          input = if operation == "prune-preserved-workspace"
+            Atoms::ProtectedWorkspacePruneInput.parse(bytes)
+          elsif operation == "publish"
+            Atoms::ProtectedPublicationInput.decode!(bytes)
+          else
+            JSON.parse(bytes)
+          end
           raise ArgumentError, "structured service input must be an object" unless input.is_a?(Hash)
           Atoms::ServiceInput.validate!(input)
+          if Ace::Git::Atoms::ServicePrInput::OPERATIONS.include?(operation)
+            Ace::Git::Atoms::ServicePrInput.validate(input, operation: operation)
+          end
           digest = Atoms::ServiceInput.digest(input)
           target = Atoms::ServiceInput.target(input)
           unless digest == expected_digest && target == expected_target
@@ -34,12 +52,26 @@ module Ace
         end
 
         def prepare!(binding, input_bytes:)
-          input = input_binding(input_bytes, expected_digest: binding.fetch("input_digest"), expected_target: binding.fetch("target"))
+          input = input_binding(input_bytes, expected_digest: binding.fetch("input_digest"),
+            expected_target: binding.fetch("target"), operation: binding.fetch("operation"))
+          if binding["operation"] == "publish" && input.fetch(:input).dig("publication", "head") != binding.fetch("candidate_head")
+            raise SecurityError, "publication input head differs from admitted candidate"
+          end
           authorized = authorize!(binding)
           canonical = snapshot(binding).merge("executor_uid" => authorized.fetch(:operation).fetch("executor_uid"), "transport" => "unix")
           deep_freeze(authorized.merge(binding: canonical, input: input.fetch(:input)))
         end
 
+        # Selected by installed composition, independently of receiver fields.
+        # Ordinary services never acquire this domain-specific root capability.
+        def dispatch_owner_binding!(binding)
+          return nil unless binding.fetch("operation") == "prune-preserved-workspace"
+          unless @cleanup_owner
+            raise SecurityError, "fixed cleanup owner composition is unavailable"
+          end
+          @cleanup_owner.identity!
+        end
+
         # Called again inside each claim/begin CAS retry using the immutable
         # binding and ephemeral parsed input, never a caller filesystem path.
         def authorize!(binding)
@@ -67,6 +99,18 @@ module Ace
             operation_digest: Ace::Assign::Atoms::EvidenceDigest.digest(operation))
         end
 
+        # Read-only selection of the installed named cleanup receiver; no
+        # proposal authorization or effect capability is minted by preview.
+        def workspace_prune_receiver!(project:, uid:, service_id:, executor_uid:)
+          document = visible_document!(project: project, uid: uid)
+          policy = ServicePolicy.new(document, ->(*) { raise SecurityError, "preview cannot resolve proposal grants" })
+          operation = policy.operation!("prune-preserved-workspace", project: project, service_id: service_id)
+          unless operation.fetch("executor_uid") == executor_uid && executor_uid.is_a?(Integer) && executor_uid.positive? && executor_uid != uid
+            raise SecurityError, "preview receiver differs from the installed cleanup operation"
+          end
+          true
+        end
+
         def visible!(project:, uid:)
           visible_document!(project: project, uid: uid)
           true

data/lib/ace/lab/molecules/service_policy.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../errors"
+require "ace/assign/errors"
 require "pathname"
 require "time"
 
@@ -99,6 +101,30 @@ module Ace
           decision
         end
 
+        # Inspection never renews effect permission or selects effect argv.
+        def inspection!(name, project:, service_id:, executor_uid:)
+          raise ArgumentError, "invalid inspection operation" unless name.is_a?(String) && name.match?(NAME)
+          operation = @operations[name]
+          unless operation.is_a?(Hash) && operation["project"] == project && operation["service_id"] == service_id &&
+              operation["executor_uid"].is_a?(Integer) && operation["executor_uid"] == executor_uid &&
+              operation.fetch("transport", "local") == "local"
+            raise SecurityError, "inspection does not match the selected original executor"
+          end
+          # This source-composed inspector uses the fixed original root SDK;
+          # configured handler argv cannot select or replace that owner.
+          if name == "prune-preserved-workspace"
+            return {"executor_uid" => executor_uid, "operation" => name}
+          end
+          argv = operation["no_effect_argv"]
+          unless argv.is_a?(Array) && argv.length.between?(1, 16) &&
+              argv.all? { |value| value.is_a?(String) && value.bytesize.between?(1, 1024) && !value.include?("\0") } &&
+              argv.first.start_with?("/")
+            raise Ace::Lab::InvalidConfigurationError, "operation has no fixed no-effect inspector"
+          end
+          executable = trusted_executable!(argv.first, executor_uid)
+          {"executor_uid" => executor_uid, "argv" => [executable] + argv.drop(1)}
+        end
+
         private
 
         # Validate the executable and every directory component on its

data/lib/ace/lab/organisms/authority_composition.rb

@@ -5,6 +5,10 @@ require "ace/assign/authority/router"
 require "ace/assign/authority/launch_lifecycle"
 require "ace/assign/authority/endcap"
 require_relative "../molecules/protected_service_policy"
+require "ace/hitl/providers/lab"
+require "ace/hitl/providers/lab/protected_assignment_binding"
+require "ace/hitl/lifecycle/service_publication_binding"
+require "ace/hitl/lifecycle/service"
 
 module Ace
   module Lab
@@ -13,7 +17,7 @@ module Ace
       # and placement; source selects all handlers, policy and evidence readers.
       class AuthorityComposition
         REQUIRED_ENDCAP = %w[submit_candidate export_candidate assign_review accept_review request_service
-          begin_dispatch complete_service complete_no_effect submit_result finish recover bind_inbox reconcile_inbox
+          begin_dispatch publication_challenge publication_continue claim_service_settlement complete_service complete_no_effect submit_result finish recover bind_inbox
           service_status evidence_fetch].freeze
 
         def initialize(authority_id:, deployment: Ace::Assign::Authority::Deployment.load,
@@ -54,11 +58,28 @@ module Ace
           policy = Molecules::ProtectedServicePolicy.new(proposal_resolver: ->(project, reference, binding) {
             journals.fetch(project).proposal_authorize!(reference, binding)
           })
-          launch = Ace::Assign::Authority::LaunchLifecycle.new(deployment: @deployment, kernel: @kernel, journals: journals)
-          endcap = Ace::Assign::Authority::Endcap.new(deployment: @deployment, launch: launch, kernel: @kernel, service_policy: policy)
+          history = Ace::Assign::Authority::DeploymentHistory.load
+          launch = Ace::Assign::Authority::LaunchLifecycle.new(deployment: @deployment, deployment_history: history,
+            kernel: @kernel, journals: journals)
+          endcap = Ace::Assign::Authority::Endcap.new(deployment: @deployment, launch: launch, kernel: @kernel,
+            service_policy: policy, deployment_history: history)
           router = Ace::Assign::Authority::Router.new(launch: launch, handlers: [endcap])
           Ace::Assign::Authority::Server.new(authority_id: @authority_id, deployment: @deployment, kernel: @kernel,
-            lifecycle: router, composition: "services")
+            lifecycle: router, composition: "services", hitl_service: publication_hitl(endcap, journals))
+        end
+
+        private
+
+        def publication_hitl(endcap, journals)
+          provider = Ace::Hitl::Providers::Lab
+          policy = provider.grants_policy(grants_path: provider::DEFAULT_GRANTS_PATH)
+          unless policy.service_uid == @deployment.authority(@authority_id).fetch("uid")
+            raise InvalidConfigurationError, "protected HITL service principal differs from installed authority"
+          end
+          ordinary = provider::ProtectedAssignmentBinding.new(authority: endcap, kernel: @kernel, journals: journals)
+          binding = Ace::Hitl::Lifecycle::ServicePublicationBinding.new(ordinary: ordinary, authority: endcap, kernel: @kernel)
+          Ace::Hitl::Lifecycle::Service.new(root: provider::DEFAULT_STORE_ROOT,
+            socket_path: provider::DEFAULT_SOCKET_PATH, binding: binding, policy: policy)
         end
       end
     end

data/lib/ace/lab/organisms/protected_cleanup_owner.rb

@@ -0,0 +1,361 @@
+# frozen_string_literal: true
+
+require "ace/runtime/molecules/protected_socket"
+require "ace/runtime/molecules/protected_artifact_set"
+require "ace/assign/authority/transfer_codec"
+require_relative "../molecules/protected_cleanup_owner_admission"
+
+module Ace
+  module Lab
+    module Organisms
+      # The immutable direct root entry supplies all collaborators. Durable
+      # request/outcome authority stays in its original canonical journal and
+      # Installer's retained physical result, never this transport owner.
+      class ProtectedCleanupOwner
+        Wire = Ace::Runtime::Molecules::ProtectedSocket
+        Client = Molecules::ProtectedCleanupOwnerClient
+        MAX_RETAINED = 256
+        MAX_CONNECTIONS = 16
+
+        def initialize(observer:, admission:, snapshots:, journals:, kernel:, installer:, scratch_root:,
+          protection: Ace::Runtime::Molecules::ProtectedArtifactSet::Protection.new)
+          @observer, @admission, @snapshots, @journals = observer, admission, snapshots, journals
+          @kernel, @installer = kernel, installer
+          @protection = protection
+          @codec = Ace::Assign::Authority::TransferCodec.new(root: scratch_root)
+          @lock, @consumed = Mutex.new, {}
+          @connections, @changed = [], ConditionVariable.new
+          @stopping = false
+        end
+
+        # Only the trusted fixed entry supplies the installed connection group.
+        # Endpoint and lock paths remain source constants, never request inputs.
+        def serve(connect_gid:)
+          @admission.connection_group!(connect_gid)
+          @observer.observe_self!(deadline: Wire.deadline(5))
+          path = Client::PATH
+          parent = File.dirname(path)
+          Wire.root_path!(parent, directory: true)
+          parents = hold_parent!(parent)
+          parent_stat = File.lstat(parent)
+          unless parent_stat.directory? && parent_stat.uid == Process.uid && parent_stat.gid == connect_gid && (parent_stat.mode & 0o7777) == 0o2750
+            raise SecurityError, "cleanup listener parent differs"
+          end
+          parent_identity = [parent_stat.dev, parent_stat.ino]
+          lifetime = File.open("#{path}.lock", File::RDWR | File::CREAT | File::NOFOLLOW | File::NONBLOCK, 0o600)
+          lifetime.close_on_exec = true
+          stat = lifetime.stat
+          unless stat.file? && stat.uid == Process.uid && stat.nlink == 1 && (stat.mode & 0o7777) == 0o600
+            raise SecurityError, "cleanup lifetime lock differs"
+          end
+          @protection.verify!("#{path}.lock", lifetime, directory: false)
+          raise SecurityError, "cleanup lifetime lock path changed" unless file_identity(File.lstat("#{path}.lock")) == file_identity(lifetime.stat)
+          raise Ace::Runtime::RuntimeUnavailableError, "cleanup listener already active" unless lifetime.flock(File::LOCK_EX | File::LOCK_NB)
+          raise SecurityError, "cleanup lifetime lock path changed after flock" unless file_identity(File.lstat("#{path}.lock")) == file_identity(lifetime.stat)
+          verify_parents!(parents)
+          begin
+            stale = File.lstat(path)
+            unless stale.socket? && stale.uid == Process.uid && stale.gid == connect_gid && (stale.mode & 0o7777) == 0o660
+              raise SecurityError, "cleanup stale endpoint differs"
+            end
+            File.unlink(path)
+          rescue Errno::ENOENT
+            nil
+          end
+          @listener = UNIXServer.new(path)
+          @listener.close_on_exec = true
+          created = File.lstat(path)
+          unless created.socket? && created.uid == Process.uid && created.gid == connect_gid &&
+              [File.lstat(parent).dev, File.lstat(parent).ino] == parent_identity
+            raise SecurityError, "cleanup endpoint creation differs"
+          end
+          endpoint = [created.dev, created.ino, created.uid, created.gid]
+          File.chmod(0o660, path)
+          own = File.lstat(path)
+          unless own.socket? && (own.mode & 0o7777) == 0o660 && [own.dev, own.ino, own.uid, own.gid] == endpoint && [File.lstat(parent).dev, File.lstat(parent).ino] == parent_identity
+            raise SecurityError, "cleanup endpoint publication differs"
+          end
+          published = true
+          until @stopping
+            socket = @listener.accept
+            accepted_at = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            socket.close_on_exec = true
+            admitted = @lock.synchronize do
+              @connections.reject! { |thread| !thread.alive? }
+              if @connections.size >= MAX_CONNECTIONS
+                false
+              else
+                worker = Thread.new(socket, accepted_at) do |owned_socket, original_acceptance|
+                  begin
+                    verify_parents!(parents)
+                    current = File.lstat(path)
+                    unless current.socket? && (current.mode & 0o7777) == 0o660 && [current.dev, current.ino, current.uid, current.gid] == endpoint
+                      raise SecurityError, "cleanup endpoint changed"
+                    end
+                    handle(owned_socket, accepted_at: original_acceptance)
+                  rescue SecurityError, Ace::Runtime::RuntimeUnavailableError, Ace::Assign::Error, IOError, SystemCallError => error
+                    # Refusal/transport failure closes only this connection.
+                    # Its consumed state, including uncertainty, is preserved.
+                    code = error.is_a?(SecurityError) ? "unauthorized_or_changed_selection" : "unavailable"
+                    warn("cleanup connection refused: #{code}")
+                  ensure
+                    owned_socket.close unless owned_socket.closed?
+                    @lock.synchronize { @changed.broadcast }
+                  end
+                end
+                @connections << worker
+                true
+              end
+            end
+            socket.close unless admitted
+          end
+        rescue IOError, Errno::EBADF
+          raise unless @stopping
+        ensure
+          @listener.close if @listener && !@listener.closed?
+          @lock.synchronize do
+            # Wait for actual callbacks, never mistake a dead callback's
+            # unconfirmed outcome for activity or physical settlement.
+            while @connections.any?(&:alive?) || @consumed.values.any? { |entry| entry[:state] == :invoked }
+              @changed.wait(@lock, 0.1)
+            end
+          end
+          unconfirmed = @lock.synchronize { @consumed.values.any? { |entry| entry[:state] == :unconfirmed } }
+          if endpoint
+            begin
+              verify_parents!(parents)
+              current = File.lstat(path)
+              File.unlink(path) if current.socket? && (!published || (current.mode & 0o7777) == 0o660) && [current.dev, current.ino, current.uid, current.gid] == endpoint
+            rescue Errno::ENOENT
+              nil
+            end
+          end
+          lifetime&.close
+          parents&.each { |entry| entry.fetch(:handle).close }
+          if unconfirmed && $!.nil?
+            raise Ace::Runtime::RuntimeUnavailableError, "cleanup invocation outcome remains unconfirmed after callback termination"
+          end
+        end
+
+        def stop
+          @stopping = true
+          @listener.close if @listener && !@listener.closed?
+        end
+
+        # Listener construction and fixed socket ownership are separately
+        # provisioned; every accepted connection still authenticates its peer.
+        def handle(socket, accepted_at: Process.clock_gettime(Process::CLOCK_MONOTONIC))
+          admission_deadline = accepted_at + 5
+          peer = @kernel.peer(socket)
+          frame = Wire.read(Wire::Ingress.new(socket), deadline: admission_deadline, limit: 65_536)
+          eof!(socket, admission_deadline)
+          original = @observer.observe_self!(deadline: admission_deadline)
+          if frame == {"schema" => Client::SCHEMA, "kind" => "identity"}
+            @admission.identity_reader!(peer)
+            Wire.write(socket, {"schema" => Client::SCHEMA, "kind" => "identity", "operation_owner_binding" => original},
+              deadline: admission_deadline, limit: Client::LIMIT)
+            return
+          end
+          @admission.receiver!(peer)
+          receiver_peer = Atoms::ProtectedWorkspacePruneInput.freeze_value(JSON.parse(JSON.generate(peer)))
+          deadline = frame["kind"] == "preview" ? admission_deadline : accepted_at + 300
+          context = nil
+          @snapshots.call do |snapshot|
+            # Reuse exact immutable event bytes only during this held read.
+            # Peer admission remains fresh; neither the view nor its memo
+            # survives into Installer effects or the next connection.
+            Ace::Assign::Molecules::EvidenceJournal.with_event_read_operation do
+              snapshot.with(deadline: deadline) do |view|
+                context = if frame["kind"] == "preview"
+                  @admission.preview!(frame: frame, peer: peer, operation_owner_binding: original, journal: @journals.call(view))
+                elsif frame["kind"] == "inspect"
+                  @admission.inspect!(frame: frame, peer: peer, operation_owner_binding: original, journal: @journals.call(view))
+                else
+                  @admission.admit!(frame: frame, peer: peer, operation_owner_binding: original, journal: @journals.call(view))
+                end
+              end
+            end
+          end
+          if frame["kind"] == "preview"
+            unless @installer.respond_to?(:preview_cleanup!)
+              raise SecurityError, "same Installer preview producer unavailable"
+            end
+            result = @installer.preview_cleanup!(context: context, receiver_peer: receiver_peer, deadline: deadline)
+            unless Ace::Assign::Atoms::EvidenceDigest.digest(@observer.observe_self!(deadline: deadline)) ==
+                Ace::Assign::Atoms::EvidenceDigest.digest(original)
+              raise SecurityError, "cleanup original owner changed during preview"
+            end
+            result = Ace::Lab::Atoms::ProtectedWorkspacePrunePreview.result!(result,
+              intent: frame.fetch("intent"), context: frame.fetch("maintenance_context"))
+            Wire.write(socket, result, deadline: deadline, limit: Client::LIMIT)
+            return
+          end
+          if frame["kind"] == "inspect"
+            inspection(socket, frame, context, original, deadline, receiver_peer: receiver_peer)
+            return
+          end
+          key = Ace::Assign::Atoms::EvidenceDigest.digest(frame)
+          retained = @lock.synchronize do
+            if (entry = @consumed[context.fetch("record").fetch("request_id")])
+              raise SecurityError, "cleanup original invocation input differs" unless entry.fetch(:key) == key
+              entry
+            else
+              raise Ace::Runtime::RuntimeUnavailableError, "cleanup lifetime capacity unavailable" if @consumed.size >= MAX_RETAINED
+              @consumed[context.fetch("record").fetch("request_id")] = {key: key, state: :invoking}
+            end
+          end
+          result = @lock.synchronize { retained[:result] }
+          unless result
+            authorized = @lock.synchronize do
+              next false unless retained[:state] == :invoking && !retained[:inhibited]
+              retained[:state] = :invoked
+              true
+            end
+            raise Ace::Runtime::RuntimeUnavailableError, "cleanup original result unavailable" unless authorized
+            begin
+              # No canonical/source lock is held over fixed privileged work.
+              unless @observer.observe_self!(deadline: [deadline, Wire.deadline(5)].min) == original
+                raise SecurityError, "cleanup original owner changed before invocation"
+              end
+              result = @installer.execute_cleanup!(context: context, receiver_peer: receiver_peer, deadline: deadline)
+              result = result!(result, frame)
+              @lock.synchronize { retained[:result] = result; retained[:state] = :completed }
+            ensure
+              @lock.synchronize do
+                if retained[:state] == :invoked
+                  retained[:state] = :unconfirmed
+                  retained[:inhibited] = true
+                end
+                @changed.broadcast
+              end
+            end
+          end
+          unless @observer.observe_self!(deadline: [deadline, Wire.deadline(5)].min) == original
+            raise SecurityError, "cleanup original owner changed before result"
+          end
+          ref = result.fetch(:receipt_ref)
+          Wire.write(socket, {"schema" => Client::SCHEMA, "kind" => "result", "request_id" => frame.fetch("request_id"),
+            "input_digest" => frame.fetch("input_digest"), "receipt_ref" => ref}, deadline: deadline, limit: Client::LIMIT)
+          descriptor = @codec.descriptor([result.fetch(:bytes)], purpose: :artifacts)
+          @codec.send(socket, parts: [result.fetch(:bytes)], descriptor: descriptor, purpose: :artifacts, deadline: deadline)
+        ensure
+          socket.close unless socket.closed?
+        end
+
+        private
+
+        def inspection(socket, frame, context, original, deadline, receiver_peer:)
+          original_owner = Ace::Assign::Atoms::EvidenceDigest.digest(context.fetch("record").fetch("operation_owner_binding")) ==
+            Ace::Assign::Atoms::EvidenceDigest.digest(original)
+          if original_owner
+            executable = frame.except("challenge_ref").merge("kind" => "execute")
+            key = Ace::Assign::Atoms::EvidenceDigest.digest(executable)
+            @lock.synchronize do
+              request = context.fetch("record").fetch("request_id")
+              retained = @consumed[request]
+              if retained
+                raise SecurityError, "cleanup original inspection input differs" unless retained.fetch(:key) == key
+              else
+                raise Ace::Runtime::RuntimeUnavailableError, "cleanup lifetime capacity unavailable" if @consumed.size >= MAX_RETAINED
+                retained = @consumed[request] = {key: key, state: :inhibited}
+              end
+              retained[:inhibited] = true
+              retained[:state] = :inhibited if retained[:state] == :invoking
+              while retained[:state] == :invoked
+                remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+                raise Ace::Runtime::RuntimeUnavailableError, "cleanup original effect remains unconfirmed" unless remaining.positive?
+                @changed.wait(@lock, remaining)
+              end
+            end
+            # This is callback inhibition only. Child/writer/physical absence
+            # still requires the actual domain inspector's independent proof.
+            inhibition = {"operation_owner_binding_digest" => frame.fetch("operation_owner_binding_digest"),
+              "dispatch_event_digest" => frame.fetch("dispatch_event_digest"), "state" => "inhibited", "pending_effects" => 0}
+            context = Atoms::ProtectedWorkspacePruneInput.freeze_value(context.merge("input_inhibition" => inhibition))
+          end
+          unless @observer.observe_self!(deadline: [deadline, Wire.deadline(5)].min) == original
+            raise SecurityError, "cleanup readback owner changed before inspection"
+          end
+          inspected = @installer.inspect_cleanup!(context: context, receiver_peer: receiver_peer, deadline: deadline)
+          unless inspected.is_a?(Hash) && inspected.keys.sort == %i[bytes kind receipt_ref] &&
+              %w[succeeded failed-no-effect].include?(inspected[:kind])
+            raise SecurityError, "cleanup inspection result unavailable"
+          end
+          kind = inspected.fetch(:kind).dup.freeze
+          unless original_owner || kind == "succeeded"
+            raise Ace::Runtime::RuntimeUnavailableError, "original cleanup lifetime exclusion unavailable"
+          end
+          result = result!(inspected.except(:kind), frame)
+          unless @observer.observe_self!(deadline: [deadline, Wire.deadline(5)].min) == original
+            raise SecurityError, "cleanup readback owner changed before inspection result"
+          end
+          success = kind == "succeeded"
+          Wire.write(socket, {"schema" => Client::SCHEMA, "kind" => success ? "completed-result" : "inspection",
+            "request_id" => frame.fetch("request_id"), "input_digest" => frame.fetch("input_digest"),
+            (success ? "receipt_ref" : "inspection_ref") => result.fetch(:receipt_ref)}, deadline: deadline, limit: Client::LIMIT)
+          descriptor = @codec.descriptor([result.fetch(:bytes)], purpose: :artifacts)
+          @codec.send(socket, parts: [result.fetch(:bytes)], descriptor: descriptor, purpose: :artifacts, deadline: deadline)
+        end
+
+        def hold_parent!(parent)
+          entries = []
+          paths = []
+          cursor = parent
+          loop do
+            paths << cursor
+            break if cursor == "/"
+            cursor = File.dirname(cursor)
+          end
+          paths.reverse_each do |path|
+            handle = File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK)
+            handle.close_on_exec = true
+            entries << {path: path, handle: handle, identity: file_identity(handle.stat)}
+            @protection.verify!(path, handle, directory: true)
+            raise SecurityError, "cleanup parent changed while pinned" unless file_identity(File.lstat(path)) == entries.last.fetch(:identity)
+          end
+          complete = true
+          entries
+        ensure
+          entries&.each { |entry| entry.fetch(:handle).close } unless complete
+        end
+
+        def verify_parents!(entries)
+          entries.each do |entry|
+            unless file_identity(entry.fetch(:handle).stat) == entry.fetch(:identity) &&
+                file_identity(File.lstat(entry.fetch(:path))) == entry.fetch(:identity)
+              raise SecurityError, "cleanup protected ancestry changed"
+            end
+          end
+        end
+
+        def file_identity(stat) = [stat.dev, stat.ino, stat.uid, stat.gid, stat.mode]
+
+        def result!(result, frame)
+          unless result.is_a?(Hash) && result.keys.sort == %i[bytes receipt_ref] && result.fetch(:bytes).is_a?(String)
+            raise SecurityError, "cleanup fixed result unavailable"
+          end
+          ref = result.fetch(:receipt_ref)
+          Atoms::ProtectedWorkspacePruneInput.reference!(ref)
+          bytes = result.fetch(:bytes)
+          unless bytes.bytesize == ref.fetch("bytes") && Digest::SHA256.hexdigest(bytes) == ref.fetch("sha256")
+            raise SecurityError, "cleanup fixed result bytes differ"
+          end
+          result = {receipt_ref: JSON.parse(JSON.generate(ref)), bytes: bytes.dup}
+          Atoms::ProtectedWorkspacePruneInput.freeze_value(result)
+        end
+
+        def eof!(socket, deadline)
+          guarded = Wire::Ingress.new(socket)
+          loop do
+            remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            raise Ace::Runtime::RuntimeUnavailableError, "cleanup request deadline expired" unless remaining.positive? && IO.select([socket], nil, nil, remaining)
+            value = guarded.read_nonblock(1, exception: false)
+            next if value == :wait_readable
+            raise SecurityError, "cleanup request contains trailing bytes" unless value.nil?
+            return
+          end
+        end
+      end
+    end
+  end
+end