ace-lab 0.7.0 → 0.8.0

data/lib/ace/lab/molecules/ordinary_worktree_read.rb

@@ -0,0 +1,216 @@
+# frozen_string_literal: true
+
+require "ace/assign/molecules/installed_journal_read"
+
+module Ace
+  module Lab
+    module Molecules
+      # Observe a mutable ordinary worker checkout. The root-installed project
+      # selection supplies both boundaries; caller input never selects a Git
+      # repository. This is historical observation, not a checkout freeze.
+      class OrdinaryWorktreeRead
+        def initialize(root:, common_dir:, deadline:)
+          @root, @common, @deadline = root, common_dir, deadline
+          [root, common_dir].each { |path| absolute!(path) }
+        end
+
+        def observe(cwd)
+          absolute!(cwd)
+          remaining
+          unless within?(cwd, @root)
+            unavailable!("worker working directory is outside installed worktrees")
+          end
+          before = selection(cwd)
+          head = git(before, "rev-parse", "--verify", "HEAD^{commit}").strip
+          unavailable!("worker HEAD is unavailable") unless head.match?(/\A[0-9a-f]{40}\z/)
+          after = selection(cwd)
+          unless before == after && git(after, "rev-parse", "--verify", "HEAD^{commit}").strip == head
+            unavailable!("worker checkout changed during observation")
+          end
+          {"cwd" => cwd, "worktree" => before.fetch("worktree"), "git_dir" => before.fetch("git_dir"),
+            "common_dir" => @common, "head" => head}
+        rescue SystemCallError, IOError, Timeout::Error, Ace::Herdr::Molecules::BoundedProcess::PostLaunchError
+          unavailable!("worker checkout cannot be observed")
+        end
+
+        def ref_head(cwd, ref)
+          unless ref.is_a?(String) && ref.match?(%r{\Arefs/[a-zA-Z0-9_./-]+\z}) && !ref.include?("..")
+            unavailable!("selected Git ref is invalid")
+          end
+          with_selected_read(cwd) do |selected|
+            head = git(selected, "rev-parse", "--verify", "#{ref}^{commit}").strip
+            unavailable!("selected ref is not a commit") unless head.match?(/\A[0-9a-f]{40}\z/)
+            head
+          end
+        end
+
+        def commit?(cwd, head)
+          exact_head!(head)
+          with_selected_read(cwd) do |selected|
+            git(selected, "rev-parse", "--verify", "--quiet", "#{head}^{commit}", allowed_status: [0, 1], result: true).status.success?
+          end
+        end
+
+        def ancestor?(cwd, ancestor, descendant)
+          exact_head!(ancestor); exact_head!(descendant)
+          with_selected_read(cwd) do |selected|
+            git(selected, "merge-base", "--is-ancestor", ancestor, descendant, allowed_status: [0, 1], result: true).status.success?
+          end
+        end
+
+        private
+
+        def exact_head!(head)
+          unavailable!("selected Git head is invalid") unless head.is_a?(String) && head.match?(/\A[0-9a-f]{40}\z/)
+        end
+
+        def with_selected_read(cwd)
+          absolute!(cwd)
+          unavailable!("selected repository leaves installed worktrees") unless within?(cwd, @root)
+          before = selection(cwd)
+          value = yield before
+          unavailable!("selected repository changed during read") unless before == selection(cwd)
+          value
+        rescue SystemCallError, IOError, Timeout::Error, Ace::Herdr::Molecules::BoundedProcess::PostLaunchError => error
+          unavailable!("selected repository cannot be observed (#{error.class})")
+        end
+
+        def selection(cwd)
+          directory!(cwd)
+          directory!(@common)
+          worktree = cwd
+          loop do
+            break if File.exist?(File.join(worktree, ".git")) || File.symlink?(File.join(worktree, ".git"))
+            unavailable!("worker checkout is unavailable") if worktree == @root
+            worktree = File.dirname(worktree)
+          end
+          marker = File.join(worktree, ".git")
+          metadata = {}
+          git_dir = if File.lstat(marker).directory?
+            directory!(marker)
+            unavailable!("worker belongs to another project") unless marker == @common
+            marker
+          else
+            bytes = regular!(marker, metadata, 4096)
+            match = bytes.match(/\Agitdir: ([^\n\0]+)\n?\z/)
+            unavailable!("worker Git pointer is invalid") unless match
+            selected = File.expand_path(match[1], worktree)
+            unless File.dirname(selected) == File.join(@common, "worktrees")
+              unavailable!("worker Git pointer leaves installed project")
+            end
+            directory!(selected)
+            common = regular!(File.join(selected, "commondir"), metadata, 4096).strip
+            unavailable!("worker common directory differs") unless File.expand_path(common, selected) == @common
+            back = regular!(File.join(selected, "gitdir"), metadata, 4096).strip
+            unavailable!("worker Git backpointer differs") unless back == marker
+            selected
+          end
+          @entries = 0
+          %w[objects refs].each { |name| storage!(File.join(@common, name)) }
+          %w[commondir shallow reftable info/grafts objects/info/alternates objects/info/http-alternates].each do |name|
+            path = File.join(@common, name)
+            unavailable!("worker object storage is redirected") if File.exist?(path) || File.symlink?(path)
+          end
+          regular!(File.join(git_dir, "HEAD"), metadata, 4096)
+          packed = File.join(@common, "packed-refs")
+          storage!(packed) if File.exist?(packed) || File.symlink?(packed)
+          local_refs = File.join(git_dir, "refs")
+          storage!(local_refs) if git_dir != @common && (File.exist?(local_refs) || File.symlink?(local_refs))
+          config!(File.join(@common, "config"), metadata)
+          local = File.join(git_dir, "config.worktree")
+          config!(local, metadata) if File.exist?(local) || File.symlink?(local)
+          {"worktree" => worktree, "git_dir" => git_dir, "metadata" => metadata,
+            "directories" => [cwd, worktree, git_dir, @common].to_h { |path| [path, identity(File.lstat(path))] }}
+        end
+
+        def config!(path, metadata)
+          bytes = regular!(path, metadata, 65_536)
+          output = run(["config", "--no-includes", "--null", "--list", "--file", "/dev/stdin"], stdin: bytes)
+          output.split("\0").each do |entry|
+            key, value = entry.split("\n", 2)
+            if key.start_with?("include.", "includeif.", "extensions.") || key == "core.worktree" ||
+                key == "core.repositoryformatversion" && value != "0"
+              unavailable!("worker Git configuration redirects project storage")
+            end
+          end
+        end
+
+        def git(selected, *argv, allowed_status: [0], result: false)
+          captured = run_result(["--git-dir=#{selected.fetch('git_dir')}", "--work-tree=#{selected.fetch('worktree')}",
+            "-c", "safe.directory=#{selected.fetch('worktree')}", "-c", "core.hooksPath=/dev/null",
+            "-c", "core.fsmonitor=false", "-c", "protocol.allow=never", *argv],
+            environment: {"GIT_COMMON_DIR" => @common, "GIT_OBJECT_DIRECTORY" => File.join(@common, "objects")}, allowed_status: allowed_status)
+          result ? captured : captured.stdout
+        end
+
+        def run(argv, stdin: "", environment: {})
+          run_result(argv, stdin: stdin, environment: environment).stdout
+        end
+
+        def run_result(argv, stdin: "", environment: {}, allowed_status: [0])
+          result = Ace::Herdr::Molecules::BoundedProcess.call(["/usr/bin/git", "--no-pager", *argv],
+            environment: Ace::Assign::Molecules::InstalledJournalRead::ENVIRONMENT.merge(environment), chdir: "/",
+            stdin_data: stdin, timeout_s: remaining, output_limit: 65_536, cleanup_group: true)
+          unavailable!("worker Git read failed or exceeded its bound") unless allowed_status.include?(result.status.exitstatus) && !result.oversized
+          result
+        end
+
+        def regular!(path, metadata, limit)
+          directory!(File.dirname(path))
+          File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
+            before = file.stat
+            unavailable!("worker metadata must be a bounded regular file") unless before.file? && before.size <= limit
+            bytes = file.read(limit + 1)
+            unless bytes.bytesize <= limit && stamp(before) == stamp(file.stat) && stamp(before) == stamp(File.lstat(path))
+              unavailable!("worker metadata changed during read")
+            end
+            metadata[path] = [stamp(before), bytes]
+            bytes
+          end
+        end
+
+        def directory!(path)
+          current = path
+          loop do
+            remaining
+            stat = File.lstat(current)
+            unavailable!("worker directory is redirected") unless stat.directory? && !stat.symlink?
+            break if current == "/"
+            current = File.dirname(current)
+          end
+        end
+
+        def storage!(path)
+          remaining
+          @entries += 1
+          unavailable!("worker storage inventory exceeds its bound") if @entries > Ace::Assign::Molecules::InstalledJournalRead::ENTRY_LIMIT
+          stat = File.lstat(path)
+          unavailable!("worker storage is redirected") unless !stat.symlink? && (stat.file? || stat.directory?)
+          Dir.each_child(path) { |name| storage!(File.join(path, name)) } if stat.directory?
+        end
+
+        def absolute!(path)
+          unless path.is_a?(String) && path.bytesize.between?(1, 4096) && !path.include?("\0") &&
+              path.start_with?("/") && File.expand_path(path) == path
+            unavailable!("worker path is invalid")
+          end
+        end
+
+        def within?(path, parent) = path == parent || path.start_with?(parent + "/")
+        def identity(stat) = [stat.dev, stat.ino]
+        def stamp(stat) = [stat.dev, stat.ino, stat.size, stat.mtime, stat.ctime]
+
+        def remaining
+          unless @deadline.is_a?(Numeric) && @deadline.finite? && (left = @deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)).positive?
+            unavailable!("worker observation deadline elapsed")
+          end
+          left
+        end
+
+        def unavailable!(reason)
+          raise Ace::Assign::AttemptErrors::EvidenceUnavailable, reason
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/molecules/service_executor.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require "json"
-require "open3"
+require "ace/herdr/molecules/bounded_process"
 require "socket"
 require "timeout"
 require "time"
@@ -40,7 +40,8 @@ module Ace
           return nil unless valid_response?(response, request)
           {"outcome" => response.fetch("outcome"), "evidence" => response.fetch("evidence"),
            "executor_uid" => current.fetch("executor_uid")}
-        rescue JSON::ParserError, Timeout::Error, SystemCallError, IOError
+        rescue JSON::ParserError, Timeout::Error, SystemCallError, IOError,
+          Ace::Herdr::Molecules::BoundedProcess::PostLaunchError
           # Transport failures after the claim (broken pipe, connection
           # reset, socket loss) leave the effect unknown: uncertainty, not a
           # classified crash, is the honest outcome.
@@ -49,49 +50,18 @@ module Ace
 
         private
 
-        # Handler output is bounded DURING execution: a noisy handler is
-        # killed and reaped once its response exceeds the receipt limit
-        # instead of being buffered without bound in this process.
+        # The existing process owner bounds both streams and the whole run,
+        # and cleans the owned process group on timeout and normal exit.
         def invoke_local(operation, request, input)
           unless Process.uid == operation.fetch("executor_uid") && Process.euid == operation.fetch("executor_uid")
             raise SecurityError, "current OS identity is not the configured executor"
           end
-          out = nil
-          status = nil
-          Open3.popen3(*operation.fetch("argv")) do |stdin, stdout, stderr, waiter|
-            pid = waiter.pid
-            begin
-              Timeout.timeout(30) do
-                stdin.write(JSON.generate({"request" => request, "input" => input}))
-                stdin.close
-                errors = Thread.new { bounded_read(stderr, 8192) }
-                out = bounded_read(stdout, 16 * 1024 + 1)
-                errors.join
-                Process.kill("KILL", pid) if out && out.bytesize > 16 * 1024
-                status = waiter.value
-              end
-            rescue Timeout::Error
-              Process.kill("KILL", pid) rescue nil
-              waiter.value
-              raise
-            end
-          end
-          out if out && out.bytesize <= 16 * 1024 && status&.success?
-        end
-
-        def bounded_read(io, limit)
-          io.read(limit).to_s
-        rescue IOError, Errno::EBADF
-          ""
-        ensure
-          begin
-            io.close
-          rescue IOError, Errno::EBADF
-            nil
-          end
+          result = Ace::Herdr::Molecules::BoundedProcess.call(operation.fetch("argv"),
+            stdin_data: JSON.generate({"request" => request, "input" => input}),
+            timeout_s: 30, output_limit: 16 * 1024, stderr_limit: 8192, cleanup_group: true)
+          result.stdout if result.status.success? && !result.oversized
         end
 
-
         def invoke_unix(operation, request, input)
           path = operation.fetch("socket_path")
           stat = File.lstat(path)

data/lib/ace/lab/molecules/service_policy.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../errors"
+require_relative "../atoms/service_input"
 require "ace/assign/errors"
 require "pathname"
 require "time"
@@ -24,10 +25,14 @@ module Ace
           end
         end
 
-        # The trusted installation document as loaded; the ordinary producer
-        # binds its configuration digest to these exact bytes.
+        # The trusted installation document as loaded. Decisions are mutable;
+        # all other configuration remains bound for the receiver lifetime.
         attr_reader :document
 
+        def self.configuration_digest(document)
+          Atoms::ServiceInput.digest(document.except("authorizations"))
+        end
+
         def operation!(name, project:, service_id:)
           raise ArgumentError, "invalid operation name" unless name.to_s.match?(NAME)
           operation = @operations[name]
@@ -115,7 +120,7 @@ module Ace
         # admission flag is rollback: new admission is unavailable while
         # canonical records and read-only status stay preserved.
         ORDINARY_SECTION_KEYS = %w[projects].freeze
-        ORDINARY_PROJECT_KEYS = %w[receiver_id socket_path receiver_uid principal admission].freeze
+        ORDINARY_PROJECT_KEYS = %w[receiver_id socket_path receiver_uid principal admission journal_repository journal_ref].freeze
         ORDINARY_AUTHORIZATION_KEYS = %w[operation project_id assignment_id attempt_id queue_entry
           input_digest forge pr_url head_repository head_ref candidate_head base_repository
           base_ref expected_base_head expires_at].freeze
@@ -160,7 +165,7 @@ module Ace
             end
             unless entry["receiver_id"].is_a?(String) && entry["receiver_id"].match?(ID) &&
                 entry["socket_path"].is_a?(String) && entry["socket_path"].start_with?("/") &&
-                entry["receiver_uid"].is_a?(Integer) && entry["receiver_uid"] >= 0 &&
+                entry["receiver_uid"].is_a?(Integer) && entry["receiver_uid"].positive? &&
                 entry["principal"].is_a?(String) && !entry["principal"].empty?
               raise Ace::Lab::InvalidConfigurationError, "ordinary receiver mapping is incomplete"
             end
@@ -168,6 +173,12 @@ module Ace
             unless %w[enabled disabled].include?(admission)
               raise Ace::Lab::InvalidConfigurationError, "ordinary admission flag is invalid"
             end
+            repository, ref = entry.values_at("journal_repository", "journal_ref")
+            unless repository.is_a?(String) && repository.start_with?("/") && !repository.include?("\0") &&
+                File.expand_path(repository) == repository &&
+                ref.is_a?(String) && ref.match?(%r{\Arefs/[a-zA-Z0-9_-]+(?:/[a-zA-Z0-9_-]+)+\z})
+              raise Ace::Lab::InvalidConfigurationError, "ordinary journal selection is invalid"
+            end
           end
           true
         end

data/lib/ace/lab/organisms/authority_composition.rb

@@ -65,7 +65,7 @@ module Ace
             service_policy: policy, deployment_history: history)
           router = Ace::Assign::Authority::Router.new(launch: launch, handlers: [endcap])
           Ace::Assign::Authority::Server.new(authority_id: @authority_id, deployment: @deployment, kernel: @kernel,
-            lifecycle: router, composition: "services", hitl_service: publication_hitl(endcap, journals))
+            lifecycle: router, composition: "services", services: [publication_hitl(endcap, journals)])
         end
 
         private

data/lib/ace/lab/organisms/ordinary_assignment_client.rb

@@ -0,0 +1,149 @@
+# frozen_string_literal: true
+
+require "securerandom"
+require "ace/assign/authority/ordinary_client"
+require "ace/assign/authority/ordinary_lifecycle"
+require "ace/assign/organisms/prepared_work_builder"
+require_relative "../molecules/ordinary_owner_config"
+
+module Ace
+  module Lab
+    module Organisms
+      # File inputs retain the exact mutation and bytes across response loss.
+      # Only Assign's installed owner registers, advances and accepts execution.
+      class OrdinaryAssignmentClient
+        A = Ace::Assign::Authority
+        REQUEST_KEYS = %w[version project_id operation mutation_id params parts].freeze
+
+        def initialize(project:, config: nil, client_factory: nil)
+          @project = project
+          @config = config || Molecules::OrdinaryOwnerConfig.load(project: project)
+          unless @config.is_a?(Molecules::OrdinaryOwnerConfig) && @config.project == project
+            raise ArgumentError, "ordinary assignment project selection differs"
+          end
+          @client_factory = client_factory || ->(**options) { A::OrdinaryClient.new(**options) }
+        end
+
+        # Preparation produces input only, so it is also available on the host.
+        # Reusing an existing output directory never rebuilds or resubmits work.
+        def self.prepare(project:, task:, pane:, output:, dependency_reports: [])
+          unless project.is_a?(String) && Molecules::OrdinaryOwnerConfig::ID.match?(project) &&
+              pane.is_a?(String) && Molecules::OrdinaryOwnerConfig::PANE.match?(pane)
+            raise ArgumentError, "preparation requires project and native pane selectors"
+          end
+          directory = create_output(output)
+          prepared = Ace::Assign::Organisms::PreparedWorkBuilder.new(export_root: directory)
+            .call(task_ref: task, project_id: project, dependency_reports: dependency_reports)
+          definition = JSON.parse(prepared.fetch("definition_bytes"))
+          reference = definition.fetch("prepared_work")
+          request = {"version" => 1, "project_id" => project, "operation" => "register_assignment",
+            "mutation_id" => SecureRandom.hex(16), "params" => {
+              "assignment_id" => prepared.fetch("assignment_id"), "pane" => pane, "expected_generation" => 0,
+              "definition_digest" => Digest::SHA256.hexdigest(prepared.fetch("definition_bytes")),
+              "prepared_head" => prepared.fetch("head"), "prepared_tree" => prepared.fetch("tree"),
+              "manifest_sha256" => reference.fetch("manifest_sha256")},
+            "parts" => [{"file" => "prepared.bundle", "bytes" => prepared.fetch("bytes"), "sha256" => prepared.fetch("sha256")}]}
+          write_file(directory, "definition.json", prepared.fetch("definition_bytes"))
+          write_file(directory, "prepared.bundle", prepared.fetch("bundle"))
+          write_file(directory, "request.json", JSON.generate(request) + "\n")
+          {"project_id" => project, "assignment_id" => prepared.fetch("assignment_id"),
+            "scope" => prepared.fetch("scope"), "request" => File.join(directory, "request.json"), "prepared" => true}
+        end
+
+        def request(input:, output: nil)
+          request = JSON.parse(self.class.read_file(input, 16_384), allow_duplicate_key: false, create_additions: false, max_nesting: 24)
+          unless request.is_a?(Hash) && request.keys.sort == REQUEST_KEYS.sort && request["version"].is_a?(Integer) && request["version"] == 1 &&
+              request["project_id"] == @project && A::OrdinaryLifecycle::OPERATIONS.include?(request["operation"]) &&
+              request["params"].is_a?(Hash) && !request["params"].key?("transfer") && request["parts"].is_a?(Array)
+            raise ArgumentError, "retained ordinary request selection is invalid"
+          end
+          operation = request.fetch("operation")
+          read = %w[registration_status assignment_snapshot result_status result_snapshot].include?(operation)
+          mutation = request.fetch("mutation_id")
+          unless read ? mutation.nil? : mutation.is_a?(String) && Ace::Assign::Molecules::JournalMutation::ID.match?(mutation)
+            raise ArgumentError, "retained mutation ID must be explicit; read operations require null"
+          end
+          transfer = A::OrdinaryLifecycle::TRANSFER_OPERATIONS[operation]
+          download = transfer && transfer.fetch(:direction) == :download
+          upload = transfer && transfer.fetch(:direction) == :upload
+          unless (!!output == !!download) && (request["parts"].empty? || upload)
+            raise ArgumentError, "download requires a new --output directory; only uploads accept parts"
+          end
+          parts = upload && read_parts(request.fetch("parts"), input, transfer.fetch(:purpose))
+          # No local metadata is interpreted as successful execution. Download
+          # files are merely a projection of the authenticated canonical reply.
+          directory = download && self.class.create_output(output)
+          client = @client_factory.call(project_id: @project, service: @config.service,
+            verify_selection: @config.method(:verify_owner!), scratch_root: directory || nil)
+          reply = client.call(operation, request.fetch("params"), mutation_id: request.fetch("mutation_id"),
+            upload_parts: parts || nil, download: !!download, purpose: transfer && transfer.fetch(:purpose))
+          envelope = {"status" => "ok", "data" => reply.data, "transport" => {"replayed" => reply.replayed}}
+          if download
+            files = reply.parts.each_with_index.map do |bytes, index|
+              name = format("part-%02d.bytes", index)
+              self.class.write_file(directory, name, bytes)
+              {"file" => File.join(directory, name), "bytes" => bytes.bytesize, "sha256" => Digest::SHA256.hexdigest(bytes)}
+            end
+            envelope["files"] = files
+            self.class.write_file(directory, "response.json", JSON.generate(envelope) + "\n")
+          end
+          envelope
+        rescue JSON::ParserError
+          raise ArgumentError, "retained request is not valid bounded JSON"
+        end
+
+        def self.read_file(path, limit)
+          File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
+            before = file.stat
+            raise ArgumentError, "retained input is not a bounded regular file" unless before.file? && before.size.between?(0, limit)
+            bytes = (file.read(limit + 1) || "").b
+            after, selected = file.stat, File.lstat(path)
+            identity = ->(stat) { [stat.dev, stat.ino, stat.size, stat.mtime, stat.ctime] }
+            unless bytes.bytesize == before.size && identity.call(before) == identity.call(after) &&
+                identity.call(after) == identity.call(selected) && !selected.symlink?
+              raise ArgumentError, "retained input changed during read"
+            end
+            bytes.freeze
+          end
+        end
+
+        def self.create_output(path)
+          raise ArgumentError, "output must be a new directory path" unless path.is_a?(String) && !path.empty?
+          directory = File.expand_path(path)
+          Dir.mkdir(directory, 0o700)
+          A::PrivateDirectory.verify!(directory)
+          directory
+        end
+
+        def self.write_file(directory, name, bytes)
+          File.open(File.join(directory, name), File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0o600) do |file|
+            file.write(bytes)
+            file.flush
+            file.fsync
+          end
+        end
+
+        private
+
+        def read_parts(entries, input, purpose)
+          total, count, per_part = A::TransferCodec::LIMITS.fetch(purpose)
+          unless entries.size.between?(1, count) && entries.all? { |entry|
+              entry.is_a?(Hash) && entry.keys.sort == %w[bytes file sha256] && entry["file"].is_a?(String) &&
+                entry["file"].bytesize.between?(1, 4096) && !entry["file"].include?("\0") &&
+                entry["bytes"].is_a?(Integer) && entry["bytes"].between?(0, per_part) &&
+                entry["sha256"].is_a?(String) && A::TransferCodec::SHA256.match?(entry["sha256"])
+            } && entries.sum { |entry| entry.fetch("bytes") } <= total
+            raise ArgumentError, "retained upload inventory is invalid"
+          end
+          entries.map do |entry|
+            bytes = self.class.read_file(File.expand_path(entry.fetch("file"), File.dirname(File.expand_path(input))), per_part)
+            unless bytes.bytesize == entry.fetch("bytes") && Digest::SHA256.hexdigest(bytes) == entry.fetch("sha256")
+              raise ArgumentError, "retained upload bytes changed; preserve the original mutation"
+            end
+            bytes
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/organisms/ordinary_authority_composition.rb

@@ -0,0 +1,123 @@
+# frozen_string_literal: true
+
+require "ace/assign/authority/ordinary_lifecycle"
+require "ace/assign/authority/ordinary_server"
+require "ace/assign/authority/router"
+require "ace/hitl/providers/lab"
+require "ace/hitl/lifecycle/service"
+require "ace/hitl/lifecycle/tls_authority"
+require "ace/hitl/lifecycle/tls_service"
+require_relative "../molecules/ordinary_owner_admission"
+require_relative "../molecules/ordinary_listener"
+require_relative "ordinary_merge_receiver"
+
+module Ace
+  module Lab
+    module Organisms
+      # Ordinary delivery has one installed journal writer and exclusion owner.
+      # Existing Assign, HITL and merge protocols share that process lifetime;
+      # no requester cache or daemon working directory chooses accepted state.
+      class OrdinaryAuthorityComposition
+        def initialize(receiver_config:, owner_config: nil)
+          unless receiver_config.is_a?(Molecules::OrdinaryReceiverConfig)
+            raise ArgumentError, "ordinary composition needs installed receiver selection"
+          end
+          @receiver = receiver_config
+          @config = owner_config || Molecules::OrdinaryOwnerConfig.load(project: @receiver.project)
+          unless @config.is_a?(Molecules::OrdinaryOwnerConfig)
+            raise ArgumentError, "ordinary composition needs installed assignment selection"
+          end
+        end
+
+        def build
+          @config.verify_listener!
+          policy_document = Molecules::GrantResolver.trusted_document(@receiver.policy_path)
+          verify_join!(policy_document)
+          admission = Molecules::OrdinaryOwnerAdmission.new(config: @config)
+          reader = nil
+          journal = Ace::Assign::Molecules::EvidenceJournal.new(repo_root: @config.journal.fetch("repository"),
+            ref: @config.journal.fetch("ref"), checkout_root: @config.journal.fetch("checkout_root"),
+            evidence_reader: ->(reference, record, state, pending) { reader.call(reference, record, state, pending) })
+          reader = Ace::Assign::Authority::ServiceEvidence.new(journal: journal)
+          exclusion = Ace::Assign::Molecules::LifecycleExclusion.new(root: @config.lifecycle_root)
+          coordinator = Ace::Assign::Organisms::AttemptCoordinator.new(cache_base: @config.assignment_root,
+            repo_root: @config.journal.fetch("repository"), journal: journal, lifecycle_exclusion: exclusion,
+            recorded_binding_observer: admission.method(:recorded_binding!))
+          lifecycle = Ace::Assign::Authority::OrdinaryLifecycle.new(project: @config.project,
+            admission: admission, journal: journal, exclusion: exclusion, input_root: @config.assignment_root)
+          router = Ace::Assign::Authority::Router.new(handlers: [lifecycle])
+          merge = OrdinaryMergeReceiver.new(config: @receiver, coordinator: coordinator,
+            policy_document: policy_document, owner_guard: -> { @config.selected_principal!(@receiver.principal_uid) },
+            merge_factory: ->(document) {
+              Molecules::OrdinaryMergeRead.new(repo_path: @receiver.repo_path, base_ref: document.fetch("base_ref"),
+                root: @receiver.repo_path, common_dir: @config.worktrees.fetch("common_dir"))
+            })
+          listener = Molecules::OrdinaryListener.new(socket_path: @receiver.socket_path,
+            peer_uid: @receiver.principal_uid, socket_gid: @receiver.socket_gid, handler: merge,
+            logger: ->(message) { warn message })
+          Ace::Assign::Authority::OrdinaryServer.new(admission: admission, lifecycle: router,
+            services: hitl_services(coordinator) + [listener])
+        end
+
+        private
+
+        def verify_join!(document)
+          configured = Molecules::ServicePolicy.new(document).ordinary_receiver!(@config.project)
+          expected = {"receiver_id" => @receiver.receiver_id, "socket_path" => @receiver.socket_path,
+            "receiver_uid" => @config.service.fetch("uid"), "principal" => @receiver.principal,
+            "journal_repository" => @config.journal.fetch("repository"), "journal_ref" => @config.journal.fetch("ref")}
+          unless @receiver.project == @config.project && @receiver.receiver_uid == @config.service.fetch("uid") &&
+              configured && configured.slice(*expected.keys) == expected &&
+              @config.participants.key?(@receiver.principal_uid.to_s) &&
+              ![@config.service.fetch("socket_path"), @config.native.fetch("socket_path"), @config.hitl.fetch("socket_path")].include?(@receiver.socket_path)
+            raise InvalidConfigurationError, "ordinary receiver and assignment owner selections differ"
+          end
+        end
+
+        def hitl_services(coordinator)
+          selected = @config.hitl
+          policy = Ace::Hitl::Providers::Lab.grants_policy(grants_path: selected.fetch("grants_path"))
+          unless policy.service_uid == @config.service.fetch("uid")
+            raise InvalidConfigurationError, "ordinary HITL service principal differs from assignment owner"
+          end
+          guard = lambda do
+            @config.verify_owner!
+            unless policy.service_uid == @config.service.fetch("uid")
+              raise Ace::Hitl::Lifecycle::BindingError, "installed HITL service principal changed"
+            end
+          rescue Ace::Lab::InvalidConfigurationError, Ace::Assign::Error => error
+            raise Ace::Hitl::Lifecycle::BindingError, error.message
+          end
+          binding = Ace::Hitl::Providers::Lab::AssignmentBinding.new(coordinator: coordinator,
+            project: @config.project, owner_guard: guard)
+          # Unix requesters and the existing Hermes mTLS transport share the
+          # same owner and one in-memory OTP vault. No second daemon opens the
+          # journal and no synthetic Unix principal represents a certificate.
+          vault = Ace::Hitl::Lifecycle::OtpVault::MemoryVault.new
+          services = [Ace::Hitl::Lifecycle::Service.new(root: selected.fetch("root"),
+            socket_path: selected.fetch("socket_path"), group: selected.fetch("group"),
+            binding: binding, policy: policy, vault: vault)]
+          if selected.key?("tls_authority")
+            authority = Ace::Hitl::Lifecycle::TlsAuthority.load(selected.fetch("tls_authority"))
+            verify_tls_identity!(authority)
+            services << Ace::Hitl::Lifecycle::TlsService.new(root: selected.fetch("root"),
+              binding: binding, project: @config.project, credential: authority.credential,
+              ssl_context: authority.ssl_context!, listen: authority.listen, port: authority.port,
+              group: selected.fetch("group"), vault: vault, decision_policy: policy)
+          end
+          services
+        end
+
+        def verify_tls_identity!(authority)
+          unless authority.project_id == @config.project &&
+              Etc.getpwnam(authority.service_user).uid == @config.service.fetch("uid") &&
+              Etc.getgrnam(authority.service_group).gid == @config.service.fetch("gid")
+            raise InvalidConfigurationError, "ordinary HITL TLS project or service identity differs"
+          end
+        rescue ArgumentError
+          raise InvalidConfigurationError, "ordinary HITL TLS service account is unavailable"
+        end
+      end
+    end
+  end
+end