ace-lab 0.7.0 → 0.9.0

data/lib/ace/lab/cli/commands/service.rb

@@ -7,6 +7,7 @@ require_relative "support"
 require_relative "../../organisms/protected_service_request"
 require_relative "../../organisms/ordinary_merge_request"
 require_relative "../../organisms/ordinary_merge_receiver"
+require_relative "../../organisms/ordinary_authority_composition"
 require_relative "../../molecules/ordinary_listener"
 require_relative "../../molecules/ordinary_receiver_config"
 
@@ -176,7 +177,7 @@ module Ace
           # The ordinary receiver serve entrypoint (spec 8x3.t.xz9.4
           # execution clauses; 8x3.t.xz9.5 integration handoff): binds the
           # configured unix socket, mutually authenticates every connection
-          # through SO_PEERCRED, admits through the canonical Assign
+          # through OS peer credentials, admits through the canonical Assign
           # coordinator, executes the authorized fixed operation — one REAL
           # Forgejo merge under the scoped host-installed service identity —
           # and settles the exact terminal receipt proven by real forge
@@ -188,7 +189,7 @@ module Ace
             include Ace::Support::Cli::Base
             include Output
 
-            desc "Serve the ordinary fixed merge receiver on its configured socket"
+            desc "Serve ordinary Assign, HITL and fixed merge under the installed journal owner"
             option :mode, type: :string, required: true,
               desc: "ordinary-merge selects the ordinary fixed merge receiver"
             option :project, type: :string, required: true, desc: "Project stable ID"
@@ -217,36 +218,19 @@ module Ace
                   request_id: "unknown", input_digest: nil
                 ))
               end
-              policy_document = Molecules::GrantResolver.trusted_document(
-                receiver_config.policy_path
-              )
-              # The ONE canonical Assign journal: the coordinator binds the
-              # evidence ref of the canonical repository the receiver is
-              # installed for (config repo_path — the producer project's
-              # canonical checkout, the same authoritative journal the
-              # producer coordinator uses). Never an integration-checkout
-              # duplicate; the service identity's reviewed permissions are
-              # journal ref read/append, evidence checkout and no-effect
-              # attestation writes inside that repository.
-              coordinator = Ace::Assign::Organisms::AttemptCoordinator.new(
-                repo_root: receiver_config.repo_path
-              )
-              receiver = Organisms::OrdinaryMergeReceiver.new(
-                config: receiver_config, coordinator: coordinator,
-                policy_document: policy_document
-              )
-              listener = Molecules::OrdinaryListener.new(
-                socket_path: receiver_config.socket_path,
-                peer_uid: receiver_config.principal_uid,
-                handler: receiver
-              )
-              receiver.recover_pending!
-              listener.serve
-            rescue Ace::Lab::InvalidConfigurationError, Ace::Assign::AttemptErrors::EvidenceUnavailable => e
+              unless receiver_config.receiver_uid == Process.uid
+                raise Ace::Lab::InvalidConfigurationError, "receiver must run as its configured UID"
+              end
+              server = Organisms::OrdinaryAuthorityComposition.new(receiver_config: receiver_config).build
+              signals = %w[INT TERM].to_h { |signal| [signal, Signal.trap(signal) { server.request_stop }] }
+              server.serve
+            rescue Ace::Lab::InvalidConfigurationError, Ace::Assign::Error, Ace::Runtime::Error, Ace::Hitl::Lifecycle::Error => e
               emit(Organisms::OrdinaryMergeRequest.refusal_envelope(
                 "ordinary_merge_unavailable", e.message,
                 request_id: "unknown", input_digest: nil
               ))
+            ensure
+              signals&.each { |signal, handler| Signal.trap(signal, handler) }
             end
           end
         end

data/lib/ace/lab/cli.rb

@@ -9,6 +9,9 @@ require_relative "cli/commands/services"
 require_relative "cli/commands/resolve"
 require_relative "cli/commands/route"
 require_relative "cli/commands/service"
+require_relative "cli/commands/assignment"
+require_relative "cli/commands/command_execute"
+require_relative "cli/commands/run"
 
 module Ace
   module Lab
@@ -20,6 +23,8 @@ module Ace
 
       # Application commands with descriptions (for help output)
       REGISTERED_COMMANDS = [
+        ["run", "Run one explicitly authorized project command"],
+        ["run-status", "Inspect an original command execution without running it"],
         ["projects", "List lab projects visible to the verified caller"],
         ["agents", "List lab agents in a project by stable ID"],
         ["services", "List lab services in a project by stable ID"],
@@ -27,7 +32,10 @@ module Ace
         ["route", "Select a configured capable service in a project"],
         ["service request", "Request one authorized service operation"],
         ["service status", "Read a service request outcome"],
-        ["service listen", "Serve the ordinary fixed merge receiver on its configured socket"]
+        ["service listen", "Serve the ordinary fixed merge receiver on its configured socket"],
+        ["assignment prepare", "Retain reviewed task input for ordinary Assign registration"],
+        ["assignment drive", "Drive one original execution through the installed ordinary owner"],
+        ["assignment request", "Send one retained operation to the installed ordinary Assign owner"]
       ].freeze
 
       HELP_EXAMPLES = [
@@ -42,6 +50,7 @@ module Ace
       # @param args [Array<String>] Command-line arguments
       # @return [Integer] Exit code (0 for success, non-zero for failure)
       def self.start(args)
+        return CLI::Commands::Run.invoke(args.drop(1)) if args.first == "run" && !(args.take(args.index("--") || args.size).include?("--help") || args.take(args.index("--") || args.size).include?("-h"))
         Ace::Support::Cli::Runner.new(self).call(args: args)
       end
 
@@ -54,6 +63,12 @@ module Ace
       register "service request", CLI::Commands::Service::Request.new
       register "service status", CLI::Commands::Service::Status.new
       register "service listen", CLI::Commands::Service::Listen.new
+      register "run", CLI::Commands::Run.new
+      register "run-status", CLI::Commands::RunStatus.new
+      register "command execute", CLI::Commands::CommandExecute.new
+      register "assignment prepare", CLI::Commands::Assignment::Prepare.new
+      register "assignment drive", CLI::Commands::Assignment::Drive.new
+      register "assignment request", CLI::Commands::Assignment::Request.new
 
       # Register version command
       version_cmd = Ace::Support::Cli::VersionCommand.build(

data/lib/ace/lab/molecules/command_owner_admission.rb

@@ -0,0 +1,183 @@
+# frozen_string_literal: true
+
+require "find"
+require "ace/assign/authority/command_execution"
+require "ace/herdr/molecules/bounded_observation"
+require "ace/runtime/molecules/process_identity"
+require_relative "command_policy"
+
+module Ace
+  module Lab
+    module Molecules
+      # Adds the project-command principals to the same installed listener.
+      # Root launch facts do not impersonate a participant/native agent.
+      class CommandOwnerAdmission
+        def initialize(base:, project:, policy_loader: nil)
+          @base, @project = base, project
+          @policy_loader = policy_loader || -> { CommandPolicy.load(project: @project) }
+          @peer = Ace::Assign::Authority::OrdinaryPeer.new
+        end
+        def service = @base.service
+        def verify_listener! = @base.verify_listener!
+        def peer(socket, deadline:) = @base.peer(socket, deadline: deadline)
+        def authorize!(request:, peer:, deadline:)
+          return @base.authorize!(request: request, peer: peer, deadline: deadline) unless Ace::Assign::Authority::CommandExecution::OPERATIONS.include?(request["operation"])
+          raise Ace::Assign::AttemptErrors::UnauthorizedIdentity unless request["project_id"] == @project
+          if %w[command_claim command_bind command_complete].include?(request["operation"])
+            command_launcher!(peer: peer, deadline: deadline)
+          elsif request["operation"] == "command_status"
+            @peer.live!(peer, deadline: deadline) # Handler checks original requester before exposing data.
+          else
+            command_reader!(peer: peer, deadline: deadline)
+          end
+          :worker
+        end
+
+        def command_reader!(peer:, deadline:, definition: nil)
+          @peer.live!(peer, deadline: deadline)
+          return true if peer["uid"] == 0 && command_launcher!(peer: peer, deadline: deadline)
+          if definition
+            # Inspection never grants a second effect. Original requester UID
+            # retains reconciliation after policy revocation or process restart.
+            unless definition.dig("requester", "uid") == peer.fetch("uid")
+              raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "command reference belongs to another requester"
+            end
+            return true
+          end
+          # Authorize visibility through the same closed selection machinery;
+          # absence of any configured grant is a refusal, not native inference.
+          document = policy
+          document.reader!(peer.fetch("uid"))
+        end
+
+        def command_request!(selection:, peer:, deadline:)
+          @peer.live!(peer, deadline: deadline)
+          selected = policy.select(selection: selection, peer: peer)
+          if selected.fetch("requester_kind") == "agent"
+            selected["native_binding"] = @base.identity!(peer: peer, pane: selection.fetch("pane"), deadline: deadline).runtime_binding
+          end
+          verify_context!(selected, deadline)
+          selected
+        end
+
+        # Historical execution can outlive its requester. Current root policy
+        # and immutable source/executable must still grant this exact TEST
+        # command; requester liveness does not invent a new execution.
+        def command_test_evidence!(definition:, deadline:)
+          unless definition["purpose"] == "test" && definition.dig("source", "head") && definition.dig("source", "tree") &&
+              policy.select(selection: definition.fetch("selection"), peer: definition.fetch("requester")) == definition.except("native_binding")
+            raise Ace::Assign::AttemptErrors::ReceiptRejected, "executed test command policy was revoked or changed"
+          end
+          verify_context!(definition, deadline)
+        rescue SecurityError, Ace::Lab::InvalidConfigurationError
+          raise Ace::Assign::AttemptErrors::ReceiptRejected, "executed test command policy or source is unavailable"
+        end
+
+        def command_launcher!(peer:, deadline:)
+          @peer.live!(peer, deadline: deadline)
+          expected = JSON.parse(GrantResolver.read_verified(policy.launcher.fetch("identity_path")) || "null")
+          unless expected.is_a?(Hash) && expected.keys.sort == %w[identity schema] &&
+              expected["schema"] == "labd-command-launcher/v1" && expected["identity"].is_a?(Hash) &&
+              expected["identity"]["uid"] == 0 && peer["uid"] == 0
+            raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "installed command launcher differs"
+          end
+          target = expected.fetch("identity")
+          @peer.live!(target, deadline: deadline)
+          cursor = peer
+          64.times do
+            return target if cursor.slice("pid", "uid", "host", "started_at") == target.slice("pid", "uid", "host", "started_at")
+            break unless RUBY_PLATFORM.include?("linux") && cursor["uid"] == 0
+            stat = File.read("/proc/#{cursor.fetch('pid')}/stat")
+            parent = Integer(stat[(stat.rindex(")") + 2)..].split.fetch(1), 10)
+            break if parent <= 1
+            @peer.live!(cursor, deadline: deadline)
+            identity = Ace::Runtime::Molecules::ProcessIdentity.new(executor:
+              Ace::Herdr::Molecules::BoundedObservation.new(deadline: deadline)).capture(parent)
+            break unless identity
+            cursor = identity
+          end
+          raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "command helper is outside installed launcher ancestry"
+        rescue JSON::ParserError, SystemCallError, IndexError, ArgumentError
+          raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "installed command launcher is unavailable"
+        end
+
+        def command_claim!(definition:, caller:, launcher:, deadline:)
+          command_launcher!(peer: launcher, deadline: deadline)
+          unless caller == definition.fetch("requester") && command_request!(selection: definition.fetch("selection"), peer: caller, deadline: deadline) == definition
+            raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "command requester or policy changed"
+          end
+          true
+        end
+
+        def command_child!(definition:, child:, launcher:, deadline:)
+          command_launcher!(peer: launcher, deadline: deadline)
+          unless command_request!(selection: definition.fetch("selection"), peer: definition.fetch("requester"), deadline: deadline) == definition
+            raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "command admission changed before exec"
+          end
+          # The authenticated root daemon witnesses cwd/identity after dropping
+          # the gated child. Owner independently captures its kernel generation.
+          keys = %w[pid uid gid groups started_at host cwd process_group no_new_privs capabilities]
+          actual = Ace::Runtime::Molecules::ProcessIdentity.new(executor:
+            Ace::Herdr::Molecules::BoundedObservation.new(deadline: deadline)).capture(child["pid"])
+          executor = definition.fetch("executor")
+          unless child.is_a?(Hash) && child.keys.sort == keys.sort && actual &&
+              actual == child.slice("pid", "uid", "started_at", "host") &&
+              child["no_new_privs"] == 1 && child["capabilities"].is_a?(Hash) &&
+              child["capabilities"].keys.sort == %w[CapAmb CapEff CapInh CapPrm] &&
+              child["capabilities"].values.all? { |value| value.is_a?(String) && value.match?(/\A0{16}\z/) } &&
+              child.values_at("uid", "gid", "groups", "cwd", "process_group") ==
+                [executor.fetch("uid"), executor.fetch("gid"), executor.fetch("groups"), executor.fetch("cwd"), child.fetch("pid")]
+            raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "gated command child differs"
+          end
+          {"kernel_identity" => actual, "root_witness" => child, "witnessed_by" => launcher}
+        end
+
+        private
+
+        def policy = @policy_loader.call
+
+        def verify_context!(definition, deadline)
+          executor = definition.fetch("executor")
+          cwd = executor.fetch("cwd")
+          wire = Ace::Runtime::Molecules::ProtectedSocket
+          wire.root_path!(cwd, directory: true)
+          executor.fetch("path").each { |entry| GrantResolver.trusted_directory!(entry) }
+          home = executor.fetch("home")
+          GrantResolver.trusted_directory!(home) if File.exist?(home) || File.symlink?(home)
+          count = 0
+          Find.find(cwd) do |path|
+            raise InvalidConfigurationError, "command source exceeds verification bound" if (count += 1) > 20_000 || Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+            stat = File.lstat(path)
+            unless stat.uid.zero? && (stat.mode & 0o022).zero? && !stat.symlink? && (stat.file? || stat.directory?)
+              raise InvalidConfigurationError, "command source must be an immutable installed view"
+            end
+          end
+          executable = File.expand_path(definition.fetch("argv").first, cwd)
+          raise InvalidConfigurationError, "command executable exceeds verification bound" if File.size(executable) > 64 * 1024 * 1024
+          bytes = GrantResolver.read_verified(executable)
+          unless bytes && File.executable?(executable) && Digest::SHA256.hexdigest(bytes) == definition.fetch("executable_sha256")
+            raise InvalidConfigurationError, "command executable differs"
+          end
+          source = definition.fetch("source")
+          if source.fetch("head")
+            result = Ace::Herdr::Molecules::BoundedProcess.call(["/usr/bin/git", "-c", "safe.directory=#{cwd}",
+              "-c", "core.hooksPath=/dev/null", "-c", "core.fsmonitor=false", "rev-parse", "HEAD", "HEAD^{tree}"],
+              environment: Ace::Assign::Molecules::InstalledJournalRead::ENVIRONMENT, chdir: cwd,
+              stdin_data: "", timeout_s: deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC), output_limit: 1024, cleanup_group: true)
+            unless result.status.success? && result.stdout.lines.map(&:strip) == source.values_at("head", "tree")
+              raise InvalidConfigurationError, "command accepted source differs"
+            end
+            clean = Ace::Herdr::Molecules::BoundedProcess.call(["/usr/bin/git", "-c", "safe.directory=#{cwd}",
+              "-c", "core.hooksPath=/dev/null", "-c", "core.fsmonitor=false", "status", "--porcelain=v1", "-z", "--untracked-files=all"],
+              environment: Ace::Assign::Molecules::InstalledJournalRead::ENVIRONMENT, chdir: cwd,
+              stdin_data: "", timeout_s: deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC), output_limit: 65_536, cleanup_group: true)
+            unless clean.status.success? && clean.stdout.empty? && !clean.oversized
+              raise InvalidConfigurationError, "command accepted source is dirty"
+            end
+          end
+          true
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/molecules/command_policy.rb

@@ -0,0 +1,158 @@
+# frozen_string_literal: true
+
+require "json"
+require "yaml"
+require "digest"
+require "ace/assign/atoms/evidence_digest"
+require_relative "grant_resolver"
+
+module Ace
+  module Lab
+    module Molecules
+      # One deployment-owned policy, independent of repository preferences.
+      # The selected grant covers the WHOLE service combination and exact argv.
+      class CommandPolicy
+        PATH = "/etc/lab/ace-lab/project-commands.yml"
+        ID = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,63}\z/
+        ENV_KEY = /\A[A-Z][A-Z0-9_]{0,63}\z/
+        RESERVED = %w[HOME USER LOGNAME SHELL PATH RUBYOPT RUBYLIB BUNDLE_GEMFILE GEM_HOME GEM_PATH BASH_ENV ENV PYTHONPATH PYTHONHOME PERL5LIB LD_PRELOAD LD_LIBRARY_PATH].freeze
+        attr_reader :project, :launcher
+
+        def self.load(project:)
+          bytes = GrantResolver.read_verified(PATH)
+          raise InvalidConfigurationError, "project commands are not installed" unless bytes && bytes.bytesize <= 65_536
+          new(YAML.safe_load(bytes, aliases: false), project: project)
+        rescue Psych::Exception
+          raise InvalidConfigurationError, "invalid project command policy"
+        end
+
+        def initialize(document, project:)
+          strict!(document, %w[version projects])
+          invalid! unless document["version"] == 1 && document["projects"].is_a?(Hash) &&
+            document["projects"].keys.all? { |id| id.is_a?(String) && ID.match?(id) } && project.is_a?(String) && ID.match?(project)
+          @project = project
+          @document = JSON.parse(JSON.generate(document))
+          @entry = @document.fetch("projects").fetch(project) { invalid! }
+          strict!(@entry, %w[launcher default_executor default_services executors services commands grants])
+          @launcher = @entry.fetch("launcher")
+          strict!(@launcher, %w[socket_path identity_path])
+          invalid! unless @launcher.values.all? { |value| absolute?(value) }
+          %w[executors services commands].each do |key|
+            value = @entry.fetch(key)
+            invalid! unless value.is_a?(Hash) && value.size <= 64 && value.keys.all? { |id| id.is_a?(String) && ID.match?(id) }
+          end
+          @entry.fetch("executors").each_value do |value|
+            strict!(value, %w[uid gid groups home cwd path environment])
+            invalid! unless %w[uid gid].all? { |key| uid?(value[key]) } &&
+              value["groups"].is_a?(Array) && value["groups"].all? { |gid| uid?(gid) } &&
+              value["groups"].uniq == value["groups"] &&
+              %w[home cwd].all? { |key| absolute?(value[key]) } &&
+              value["path"].is_a?(Array) && !value["path"].empty? && value["path"].all? { |item| absolute?(item) }
+            environment!(value.fetch("environment"))
+          end
+          @entry.fetch("services").each_value do |value|
+            strict!(value, %w[environment secret_references])
+            environment!(value.fetch("environment"))
+            references = value.fetch("secret_references")
+            invalid! unless references.is_a?(Hash) && references.all? { |key, path| env_key?(key) && absolute?(path) }
+          end
+          @entry.fetch("commands").each_value do |value|
+            strict!(value, %w[argv executable_sha256 source purpose])
+            invalid! unless %w[command test].include?(value["purpose"])
+            argv!(value.fetch("argv"))
+            invalid! unless sha?(value.fetch("executable_sha256"))
+            source = value.fetch("source")
+            strict!(source, %w[head tree])
+            invalid! unless source.values.all? { |sha| sha.nil? || (sha.is_a?(String) && sha.match?(/\A[0-9a-f]{40}\z/)) } &&
+              source.values.all?(&:nil?) == source.values.any?(&:nil?)
+            invalid! if value["purpose"] == "test" && source.values.any?(&:nil?)
+          end
+          invalid! unless @entry.fetch("executors").key?(@entry["default_executor"])
+          services!(@entry.fetch("default_services"))
+          invalid! unless @entry["grants"].is_a?(Array) && @entry["grants"].size <= 256
+          @entry["grants"].each do |grant|
+            strict!(grant, %w[kind uid command executor services])
+            invalid! unless %w[operator agent].include?(grant["kind"]) && uid?(grant["uid"]) &&
+              @entry.fetch("commands").key?(grant["command"]) && @entry.fetch("executors").key?(grant["executor"])
+            services!(grant.fetch("services"))
+          end
+          @fingerprint = Ace::Assign::Atoms::EvidenceDigest.digest(@entry)
+          freeze_value(@document)
+        end
+
+        def reader!(uid)
+          deny! unless @entry.fetch("grants").any? { |grant| grant.fetch("uid") == uid }
+          true
+        end
+
+        def select(selection:, peer:)
+          strict!(selection, %w[argv executor services pane])
+          argv!(selection.fetch("argv"))
+          executor_id = selection["executor"] || @entry.fetch("default_executor")
+          executor = @entry.fetch("executors")[executor_id]
+          deny! unless executor
+          requested = selection["services"].nil? ? @entry.fetch("default_services") : selection["services"]
+          services!(requested)
+          selected = requested.uniq.sort
+          matches = @entry.fetch("commands").select { |_name, value| value.fetch("argv") == selection["argv"] }
+          deny! unless matches.size == 1
+          command_id, command = matches.first
+          kind = selection["pane"].nil? ? "operator" : "agent"
+          deny! unless @entry.fetch("grants").any? { |grant|
+            grant.values_at("kind", "uid", "command", "executor") == [kind, peer.fetch("uid"), command_id, executor_id] &&
+              grant.fetch("services").sort == selected }
+          environment = executor.fetch("environment").dup
+          references = {}
+          selected.each do |id|
+            service = @entry.fetch("services").fetch(id)
+            additions = service.fetch("environment")
+            secrets = service.fetch("secret_references")
+            deny! unless (environment.keys & (additions.keys + secrets.keys)).empty? &&
+              (references.keys & (additions.keys + secrets.keys)).empty? && (additions.keys & secrets.keys).empty?
+            environment.merge!(additions)
+            references.merge!(secrets)
+          end
+          definition = {"policy_sha256" => @fingerprint, "project_id" => @project, "command_id" => command_id,
+            "argv" => command.fetch("argv"), "executable_sha256" => command.fetch("executable_sha256"),
+            "source" => command.fetch("source"), "purpose" => command.fetch("purpose"), "executor_id" => executor_id,
+            "executor" => executor.merge("environment" => environment, "groups" => executor.fetch("groups").sort), "services" => selected,
+            "secret_references" => references, "requester" => peer, "requester_kind" => kind,
+            "selection" => selection}
+          invalid! if JSON.generate(definition).bytesize > 8192
+          definition
+        end
+
+        private
+
+        def strict!(value, keys)
+          invalid! unless value.is_a?(Hash) && value.keys.sort == keys.sort
+        end
+        def argv!(value)
+          invalid! unless value.is_a?(Array) && value.size.between?(1, 128) &&
+            value.all? { |item| item.is_a?(String) && item.bytesize <= 4096 && !item.include?("\0") } &&
+            !value.first.empty? && value.sum(&:bytesize) <= 8192
+        end
+        def services!(value)
+          invalid! unless value.is_a?(Array) && value.size <= 64 && value.all? { |id| @entry.fetch("services").key?(id) }
+        end
+        def environment!(value)
+          invalid! unless value.is_a?(Hash) && value.size <= 64 && value.all? { |key, item|
+            env_key?(key) && item.is_a?(String) && item.bytesize <= 4096 && !item.include?("\0") }
+        end
+        def env_key?(key) = key.is_a?(String) && ENV_KEY.match?(key) && !RESERVED.include?(key) && !key.start_with?("GIT_CONFIG_", "BUNDLE_", "LD_", "DYLD_")
+        def absolute?(value) = value.is_a?(String) && value.start_with?("/") && !value.include?("\0") && File.expand_path(value) == value
+        def uid?(value) = value.is_a?(Integer) && value.between?(1, 2**31 - 1)
+        def sha?(value) = value.is_a?(String) && value.match?(/\A[0-9a-f]{64}\z/)
+        def invalid! = raise(InvalidConfigurationError, "invalid project command policy")
+        def deny! = raise(SecurityError, "project command selection is not authorized")
+        def freeze_value(value)
+          case value
+          when Hash then value.each { |key, child| key.freeze; freeze_value(child) }
+          when Array then value.each { |child| freeze_value(child) }
+          end
+          value.freeze
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/molecules/grant_resolver.rb

@@ -43,6 +43,21 @@ module Ace
               "invalid lab configuration: trusted authorization file could not be parsed"
           end
 
+          # Validate an installed directory through the same original-path
+          # traversal as files, including root-owned system symlink aliases.
+          def trusted_directory!(path)
+            candidate = verified_resolve(path)
+            raise Ace::Lab::InvalidConfigurationError, "trusted directory is unavailable" unless candidate
+            File.open(candidate, File::RDONLY | File::NOFOLLOW) do |handle|
+              unless handle.stat.directory? && secure_file_stat?(handle.stat)
+                raise Ace::Lab::InvalidConfigurationError, "trusted directory ownership or mode differs"
+              end
+            end
+            true
+          rescue SystemCallError
+            raise Ace::Lab::InvalidConfigurationError, "trusted directory is unavailable"
+          end
+
           # @param documents [Array<Hash>] {path:, document:, defaults:}
           #   from Ace::Lab.cascade_documents
           # @param topology [Hash] normalized topology (project IDs)

data/lib/ace/lab/molecules/ordinary_admission_resolver.rb

@@ -43,13 +43,16 @@ module Ace
         # @param path [String, nil] trusted policy path to re-read per decision
         # @param loader [Proc, nil] trusted reader (default: GrantResolver);
         #   the only override point, for non-privileged test documents
-        def initialize(policy_document, path: nil, loader: nil)
+        def initialize(policy_document, path: nil, loader: nil, proposal_resolver: nil, caller_uid: nil)
           unless policy_document.is_a?(Hash) && policy_document["authorizations"].is_a?(Hash)
             raise Ace::Lab::InvalidConfigurationError,
               "trusted policy document must contain an authorizations mapping"
           end
           @authorizations = policy_document.fetch("authorizations")
+          @configuration_digest = ServicePolicy.configuration_digest(policy_document)
           @path = path
+          @proposal_resolver = proposal_resolver
+          @caller_uid = caller_uid
           @loader = loader || ->(trusted_path) { GrantResolver.trusted_document(trusted_path) }
           freeze
         end
@@ -65,6 +68,18 @@ module Ace
           unless binding.is_a?(Hash) && binding.fetch("operation", nil) == OPERATION
             return refuse("only the ordinary merge operation is resolvable")
           end
+          if reference.start_with?("proposal-")
+            return refuse("canonical proposal authority is unavailable") unless @proposal_resolver && @caller_uid.is_a?(Integer)
+            begin
+              decision = @proposal_resolver.call(reference, binding.slice(
+                "operation", "project_id", "assignment_id", "attempt_id", "input_digest", "candidate_head").merge(
+                  "target" => {"resource" => binding.fetch("pr_url"), "artifact_digest" => nil},
+                  "caller_uid" => @caller_uid))
+              return Decision.new(authorized?: true, decision: decision, code: nil, message: nil)
+            rescue Ace::Assign::Error
+              return refuse("canonical proposal does not authorize this exact ordinary merge")
+            end
+          end
           decision = authorizations[reference]
           return refuse("authorization reference is unresolved") unless decision.is_a?(Hash)
           unless DECISION_KEYS.all? { |key| decision.key?(key) }
@@ -99,6 +114,10 @@ module Ace
               "invalid lab configuration: trusted authorization refresh at #{@path} " \
               "did not yield an authorizations mapping"
           end
+          unless ServicePolicy.configuration_digest(document) == @configuration_digest
+            raise Ace::Lab::InvalidConfigurationError,
+              "ordinary receiver configuration changed; restart with the installed configuration"
+          end
           document.fetch("authorizations")
         end