ace-lab 0.7.0 → 0.9.0

data/lib/ace/lab/molecules/ordinary_receiver_config.rb

@@ -3,6 +3,7 @@
 require "yaml"
 require_relative "../errors"
 require_relative "service_policy"
+require_relative "grant_resolver"
 
 module Ace
   module Lab
@@ -16,26 +17,32 @@ module Ace
       class OrdinaryReceiverConfig
         KEYS = %w[project receiver_id socket_path receiver_uid principal principal_uid
           repo_path policy_path execution_identity].freeze
+        OPTIONAL_KEYS = %w[socket_gid forge_config_path].freeze
         IDENTITY_KEYS = %w[checkout_id worktree_id branch].freeze
         ID = ServicePolicy::ID
 
         def self.load(path)
           raise Ace::Lab::InvalidConfigurationError, "receiver config path is required" unless path.is_a?(String) && !path.empty?
-          document = YAML.safe_load_file(path, permitted_classes: [Date], aliases: false)
+          bytes = GrantResolver.read_verified(path)
+          raise Ace::Lab::InvalidConfigurationError, "receiver configuration is missing" unless bytes
+          document = YAML.safe_load(bytes, permitted_classes: [Date], aliases: false)
           new(document, source: path)
         rescue Errno::ENOENT, Errno::EACCES, Psych::Exception
           raise Ace::Lab::InvalidConfigurationError, "receiver configuration is unreadable: #{path}"
         end
 
         attr_reader :project, :receiver_id, :socket_path, :receiver_uid, :principal,
-          :principal_uid, :repo_path, :policy_path, :execution_identity, :source
+          :principal_uid, :repo_path, :policy_path, :execution_identity, :source, :socket_gid, :forge_config_path
 
         def initialize(document, source: nil)
-          unless document.is_a?(Hash) && (document.keys - KEYS).empty? &&
+          unless document.is_a?(Hash) && (document.keys - KEYS - OPTIONAL_KEYS).empty? &&
               (KEYS - document.keys).empty?
             raise Ace::Lab::InvalidConfigurationError,
-              "receiver configuration must contain exactly: #{KEYS.join(', ')}"
+              "receiver configuration requires #{KEYS.join(', ')}; optional: #{OPTIONAL_KEYS.join(', ')}"
           end
+          @socket_gid = uid!(document.fetch("socket_gid"), "socket_gid") if document.key?("socket_gid")
+          @forge_config_path = absolute!(document.fetch("forge_config_path"), "forge_config_path") if
+            document.key?("forge_config_path")
           @source = source
           @project = string!(document.fetch("project"), "project")
           @receiver_id = string!(document.fetch("receiver_id"), "receiver_id")
@@ -44,6 +51,7 @@ module Ace
           @repo_path = absolute!(document.fetch("repo_path"), "repo_path")
           @policy_path = absolute!(document.fetch("policy_path"), "policy_path")
           @receiver_uid = uid!(document.fetch("receiver_uid"), "receiver_uid")
+          raise Ace::Lab::InvalidConfigurationError, "ordinary receiver must have a non-root owner" if @receiver_uid.zero?
           @principal_uid = uid!(document.fetch("principal_uid"), "principal_uid")
           identity = document.fetch("execution_identity")
           unless identity.is_a?(Hash) && (identity.keys - IDENTITY_KEYS).empty? &&

data/lib/ace/lab/molecules/ordinary_socket.rb

@@ -9,7 +9,7 @@ module Ace
       # Admission transport between the ordinary fixed merge producer and the
       # installed ordinary receiver: one bounded JSON document each way over
       # a configured unix stream socket with a fixed deadline. Authentication
-      # is mutual through SO_PEERCRED — the producer verifies the receiver's
+      # is mutual through OS peer credentials — the producer verifies the receiver's
       # configured UID and transmits the verified local caller identity, so
       # no caller-selected credential, token or endpoint exists. This is not
       # an HTTP transport; a lost or unauthenticated response is a
@@ -33,19 +33,19 @@ module Ace
         def submit(document)
           payload = JSON.generate(document)
           raise OrdinaryUnavailable, "request document exceeds the wire bound" if payload.bytesize > LIMIT
-          socket = Socket.new(:UNIX, :STREAM, 0)
+          socket = nil
           begin
-            socket.connect(Addrinfo.unix(@socket_path))
+            socket = UNIXSocket.new(@socket_path)
             verify_peer!(socket)
             write_all!(socket, "#{HANDSHAKE} #{payload.bytesize}\n#{payload}")
             response = read_response!(socket)
           rescue OrdinaryUnavailable
             raise
-          rescue SystemCallError, IOError => e
+          rescue SystemCallError, IOError, SocketError, NotImplementedError => e
             raise OrdinaryUnavailable, "receiver transport failed: #{e.class}"
           ensure
             begin
-              socket.close
+              socket&.close
             rescue IOError
               nil
             end
@@ -58,10 +58,7 @@ module Ace
         private
 
         def verify_peer!(socket)
-          credentials = socket.getsockopt(:SOCKET, :PEERCRED)
-          # struct ucred is {pid, uid, gid} on Linux; the producer binds the
-          # receiver to its installed UID and nothing else.
-          _peer_pid, peer_uid, = credentials.unpack("L3")
+          peer_uid, = socket.getpeereid
           return if peer_uid == @receiver_uid
           raise OrdinaryUnavailable, "receiver endpoint identity is not the installed receiver"
         end

data/lib/ace/lab/molecules/ordinary_worktree_read.rb

@@ -0,0 +1,216 @@
+# frozen_string_literal: true
+
+require "ace/assign/molecules/installed_journal_read"
+
+module Ace
+  module Lab
+    module Molecules
+      # Observe a mutable ordinary worker checkout. The root-installed project
+      # selection supplies both boundaries; caller input never selects a Git
+      # repository. This is historical observation, not a checkout freeze.
+      class OrdinaryWorktreeRead
+        def initialize(root:, common_dir:, deadline:)
+          @root, @common, @deadline = root, common_dir, deadline
+          [root, common_dir].each { |path| absolute!(path) }
+        end
+
+        def observe(cwd)
+          absolute!(cwd)
+          remaining
+          unless within?(cwd, @root)
+            unavailable!("worker working directory is outside installed worktrees")
+          end
+          before = selection(cwd)
+          head = git(before, "rev-parse", "--verify", "HEAD^{commit}").strip
+          unavailable!("worker HEAD is unavailable") unless head.match?(/\A[0-9a-f]{40}\z/)
+          after = selection(cwd)
+          unless before == after && git(after, "rev-parse", "--verify", "HEAD^{commit}").strip == head
+            unavailable!("worker checkout changed during observation")
+          end
+          {"cwd" => cwd, "worktree" => before.fetch("worktree"), "git_dir" => before.fetch("git_dir"),
+            "common_dir" => @common, "head" => head}
+        rescue SystemCallError, IOError, Timeout::Error, Ace::Herdr::Molecules::BoundedProcess::PostLaunchError
+          unavailable!("worker checkout cannot be observed")
+        end
+
+        def ref_head(cwd, ref)
+          unless ref.is_a?(String) && ref.match?(%r{\Arefs/[a-zA-Z0-9_./-]+\z}) && !ref.include?("..")
+            unavailable!("selected Git ref is invalid")
+          end
+          with_selected_read(cwd) do |selected|
+            head = git(selected, "rev-parse", "--verify", "#{ref}^{commit}").strip
+            unavailable!("selected ref is not a commit") unless head.match?(/\A[0-9a-f]{40}\z/)
+            head
+          end
+        end
+
+        def commit?(cwd, head)
+          exact_head!(head)
+          with_selected_read(cwd) do |selected|
+            git(selected, "rev-parse", "--verify", "--quiet", "#{head}^{commit}", allowed_status: [0, 1], result: true).status.success?
+          end
+        end
+
+        def ancestor?(cwd, ancestor, descendant)
+          exact_head!(ancestor); exact_head!(descendant)
+          with_selected_read(cwd) do |selected|
+            git(selected, "merge-base", "--is-ancestor", ancestor, descendant, allowed_status: [0, 1], result: true).status.success?
+          end
+        end
+
+        private
+
+        def exact_head!(head)
+          unavailable!("selected Git head is invalid") unless head.is_a?(String) && head.match?(/\A[0-9a-f]{40}\z/)
+        end
+
+        def with_selected_read(cwd)
+          absolute!(cwd)
+          unavailable!("selected repository leaves installed worktrees") unless within?(cwd, @root)
+          before = selection(cwd)
+          value = yield before
+          unavailable!("selected repository changed during read") unless before == selection(cwd)
+          value
+        rescue SystemCallError, IOError, Timeout::Error, Ace::Herdr::Molecules::BoundedProcess::PostLaunchError => error
+          unavailable!("selected repository cannot be observed (#{error.class})")
+        end
+
+        def selection(cwd)
+          directory!(cwd)
+          directory!(@common)
+          worktree = cwd
+          loop do
+            break if File.exist?(File.join(worktree, ".git")) || File.symlink?(File.join(worktree, ".git"))
+            unavailable!("worker checkout is unavailable") if worktree == @root
+            worktree = File.dirname(worktree)
+          end
+          marker = File.join(worktree, ".git")
+          metadata = {}
+          git_dir = if File.lstat(marker).directory?
+            directory!(marker)
+            unavailable!("worker belongs to another project") unless marker == @common
+            marker
+          else
+            bytes = regular!(marker, metadata, 4096)
+            match = bytes.match(/\Agitdir: ([^\n\0]+)\n?\z/)
+            unavailable!("worker Git pointer is invalid") unless match
+            selected = File.expand_path(match[1], worktree)
+            unless File.dirname(selected) == File.join(@common, "worktrees")
+              unavailable!("worker Git pointer leaves installed project")
+            end
+            directory!(selected)
+            common = regular!(File.join(selected, "commondir"), metadata, 4096).strip
+            unavailable!("worker common directory differs") unless File.expand_path(common, selected) == @common
+            back = regular!(File.join(selected, "gitdir"), metadata, 4096).strip
+            unavailable!("worker Git backpointer differs") unless back == marker
+            selected
+          end
+          @entries = 0
+          %w[objects refs].each { |name| storage!(File.join(@common, name)) }
+          %w[commondir shallow reftable info/grafts objects/info/alternates objects/info/http-alternates].each do |name|
+            path = File.join(@common, name)
+            unavailable!("worker object storage is redirected") if File.exist?(path) || File.symlink?(path)
+          end
+          regular!(File.join(git_dir, "HEAD"), metadata, 4096)
+          packed = File.join(@common, "packed-refs")
+          storage!(packed) if File.exist?(packed) || File.symlink?(packed)
+          local_refs = File.join(git_dir, "refs")
+          storage!(local_refs) if git_dir != @common && (File.exist?(local_refs) || File.symlink?(local_refs))
+          config!(File.join(@common, "config"), metadata)
+          local = File.join(git_dir, "config.worktree")
+          config!(local, metadata) if File.exist?(local) || File.symlink?(local)
+          {"worktree" => worktree, "git_dir" => git_dir, "metadata" => metadata,
+            "directories" => [cwd, worktree, git_dir, @common].to_h { |path| [path, identity(File.lstat(path))] }}
+        end
+
+        def config!(path, metadata)
+          bytes = regular!(path, metadata, 65_536)
+          output = run(["config", "--no-includes", "--null", "--list", "--file", "/dev/stdin"], stdin: bytes)
+          output.split("\0").each do |entry|
+            key, value = entry.split("\n", 2)
+            if key.start_with?("include.", "includeif.", "extensions.") || key == "core.worktree" ||
+                key == "core.repositoryformatversion" && value != "0"
+              unavailable!("worker Git configuration redirects project storage")
+            end
+          end
+        end
+
+        def git(selected, *argv, allowed_status: [0], result: false)
+          captured = run_result(["--git-dir=#{selected.fetch('git_dir')}", "--work-tree=#{selected.fetch('worktree')}",
+            "-c", "safe.directory=#{selected.fetch('worktree')}", "-c", "core.hooksPath=/dev/null",
+            "-c", "core.fsmonitor=false", "-c", "protocol.allow=never", *argv],
+            environment: {"GIT_COMMON_DIR" => @common, "GIT_OBJECT_DIRECTORY" => File.join(@common, "objects")}, allowed_status: allowed_status)
+          result ? captured : captured.stdout
+        end
+
+        def run(argv, stdin: "", environment: {})
+          run_result(argv, stdin: stdin, environment: environment).stdout
+        end
+
+        def run_result(argv, stdin: "", environment: {}, allowed_status: [0])
+          result = Ace::Herdr::Molecules::BoundedProcess.call(["/usr/bin/git", "--no-pager", *argv],
+            environment: Ace::Assign::Molecules::InstalledJournalRead::ENVIRONMENT.merge(environment), chdir: "/",
+            stdin_data: stdin, timeout_s: remaining, output_limit: 65_536, cleanup_group: true)
+          unavailable!("worker Git read failed or exceeded its bound") unless allowed_status.include?(result.status.exitstatus) && !result.oversized
+          result
+        end
+
+        def regular!(path, metadata, limit)
+          directory!(File.dirname(path))
+          File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
+            before = file.stat
+            unavailable!("worker metadata must be a bounded regular file") unless before.file? && before.size <= limit
+            bytes = file.read(limit + 1)
+            unless bytes.bytesize <= limit && stamp(before) == stamp(file.stat) && stamp(before) == stamp(File.lstat(path))
+              unavailable!("worker metadata changed during read")
+            end
+            metadata[path] = [stamp(before), bytes]
+            bytes
+          end
+        end
+
+        def directory!(path)
+          current = path
+          loop do
+            remaining
+            stat = File.lstat(current)
+            unavailable!("worker directory is redirected") unless stat.directory? && !stat.symlink?
+            break if current == "/"
+            current = File.dirname(current)
+          end
+        end
+
+        def storage!(path)
+          remaining
+          @entries += 1
+          unavailable!("worker storage inventory exceeds its bound") if @entries > Ace::Assign::Molecules::InstalledJournalRead::ENTRY_LIMIT
+          stat = File.lstat(path)
+          unavailable!("worker storage is redirected") unless !stat.symlink? && (stat.file? || stat.directory?)
+          Dir.each_child(path) { |name| storage!(File.join(path, name)) } if stat.directory?
+        end
+
+        def absolute!(path)
+          unless path.is_a?(String) && path.bytesize.between?(1, 4096) && !path.include?("\0") &&
+              path.start_with?("/") && File.expand_path(path) == path
+            unavailable!("worker path is invalid")
+          end
+        end
+
+        def within?(path, parent) = path == parent || path.start_with?(parent + "/")
+        def identity(stat) = [stat.dev, stat.ino]
+        def stamp(stat) = [stat.dev, stat.ino, stat.size, stat.mtime, stat.ctime]
+
+        def remaining
+          unless @deadline.is_a?(Numeric) && @deadline.finite? && (left = @deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)).positive?
+            unavailable!("worker observation deadline elapsed")
+          end
+          left
+        end
+
+        def unavailable!(reason)
+          raise Ace::Assign::AttemptErrors::EvidenceUnavailable, reason
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/molecules/service_executor.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require "json"
-require "open3"
+require "ace/herdr/molecules/bounded_process"
 require "socket"
 require "timeout"
 require "time"
@@ -40,7 +40,8 @@ module Ace
           return nil unless valid_response?(response, request)
           {"outcome" => response.fetch("outcome"), "evidence" => response.fetch("evidence"),
            "executor_uid" => current.fetch("executor_uid")}
-        rescue JSON::ParserError, Timeout::Error, SystemCallError, IOError
+        rescue JSON::ParserError, Timeout::Error, SystemCallError, IOError,
+          Ace::Herdr::Molecules::BoundedProcess::PostLaunchError
           # Transport failures after the claim (broken pipe, connection
           # reset, socket loss) leave the effect unknown: uncertainty, not a
           # classified crash, is the honest outcome.
@@ -49,49 +50,18 @@ module Ace
 
         private
 
-        # Handler output is bounded DURING execution: a noisy handler is
-        # killed and reaped once its response exceeds the receipt limit
-        # instead of being buffered without bound in this process.
+        # The existing process owner bounds both streams and the whole run,
+        # and cleans the owned process group on timeout and normal exit.
         def invoke_local(operation, request, input)
           unless Process.uid == operation.fetch("executor_uid") && Process.euid == operation.fetch("executor_uid")
             raise SecurityError, "current OS identity is not the configured executor"
           end
-          out = nil
-          status = nil
-          Open3.popen3(*operation.fetch("argv")) do |stdin, stdout, stderr, waiter|
-            pid = waiter.pid
-            begin
-              Timeout.timeout(30) do
-                stdin.write(JSON.generate({"request" => request, "input" => input}))
-                stdin.close
-                errors = Thread.new { bounded_read(stderr, 8192) }
-                out = bounded_read(stdout, 16 * 1024 + 1)
-                errors.join
-                Process.kill("KILL", pid) if out && out.bytesize > 16 * 1024
-                status = waiter.value
-              end
-            rescue Timeout::Error
-              Process.kill("KILL", pid) rescue nil
-              waiter.value
-              raise
-            end
-          end
-          out if out && out.bytesize <= 16 * 1024 && status&.success?
-        end
-
-        def bounded_read(io, limit)
-          io.read(limit).to_s
-        rescue IOError, Errno::EBADF
-          ""
-        ensure
-          begin
-            io.close
-          rescue IOError, Errno::EBADF
-            nil
-          end
+          result = Ace::Herdr::Molecules::BoundedProcess.call(operation.fetch("argv"),
+            stdin_data: JSON.generate({"request" => request, "input" => input}),
+            timeout_s: 30, output_limit: 16 * 1024, stderr_limit: 8192, cleanup_group: true)
+          result.stdout if result.status.success? && !result.oversized
         end
 
-
         def invoke_unix(operation, request, input)
           path = operation.fetch("socket_path")
           stat = File.lstat(path)

data/lib/ace/lab/molecules/service_policy.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../errors"
+require_relative "../atoms/service_input"
 require "ace/assign/errors"
 require "pathname"
 require "time"
@@ -24,10 +25,14 @@ module Ace
           end
         end
 
-        # The trusted installation document as loaded; the ordinary producer
-        # binds its configuration digest to these exact bytes.
+        # The trusted installation document as loaded. Decisions are mutable;
+        # all other configuration remains bound for the receiver lifetime.
         attr_reader :document
 
+        def self.configuration_digest(document)
+          Atoms::ServiceInput.digest(document.except("authorizations"))
+        end
+
         def operation!(name, project:, service_id:)
           raise ArgumentError, "invalid operation name" unless name.to_s.match?(NAME)
           operation = @operations[name]
@@ -115,7 +120,7 @@ module Ace
         # admission flag is rollback: new admission is unavailable while
         # canonical records and read-only status stay preserved.
         ORDINARY_SECTION_KEYS = %w[projects].freeze
-        ORDINARY_PROJECT_KEYS = %w[receiver_id socket_path receiver_uid principal admission].freeze
+        ORDINARY_PROJECT_KEYS = %w[receiver_id socket_path receiver_uid principal admission journal_repository journal_ref].freeze
         ORDINARY_AUTHORIZATION_KEYS = %w[operation project_id assignment_id attempt_id queue_entry
           input_digest forge pr_url head_repository head_ref candidate_head base_repository
           base_ref expected_base_head expires_at].freeze
@@ -160,7 +165,7 @@ module Ace
             end
             unless entry["receiver_id"].is_a?(String) && entry["receiver_id"].match?(ID) &&
                 entry["socket_path"].is_a?(String) && entry["socket_path"].start_with?("/") &&
-                entry["receiver_uid"].is_a?(Integer) && entry["receiver_uid"] >= 0 &&
+                entry["receiver_uid"].is_a?(Integer) && entry["receiver_uid"].positive? &&
                 entry["principal"].is_a?(String) && !entry["principal"].empty?
               raise Ace::Lab::InvalidConfigurationError, "ordinary receiver mapping is incomplete"
             end
@@ -168,6 +173,12 @@ module Ace
             unless %w[enabled disabled].include?(admission)
               raise Ace::Lab::InvalidConfigurationError, "ordinary admission flag is invalid"
             end
+            repository, ref = entry.values_at("journal_repository", "journal_ref")
+            unless repository.is_a?(String) && repository.start_with?("/") && !repository.include?("\0") &&
+                File.expand_path(repository) == repository &&
+                ref.is_a?(String) && ref.match?(%r{\Arefs/[a-zA-Z0-9_-]+(?:/[a-zA-Z0-9_-]+)+\z})
+              raise Ace::Lab::InvalidConfigurationError, "ordinary journal selection is invalid"
+            end
           end
           true
         end

data/lib/ace/lab/organisms/authority_composition.rb

@@ -65,7 +65,7 @@ module Ace
             service_policy: policy, deployment_history: history)
           router = Ace::Assign::Authority::Router.new(launch: launch, handlers: [endcap])
           Ace::Assign::Authority::Server.new(authority_id: @authority_id, deployment: @deployment, kernel: @kernel,
-            lifecycle: router, composition: "services", hitl_service: publication_hitl(endcap, journals))
+            lifecycle: router, composition: "services", services: [publication_hitl(endcap, journals)])
         end
 
         private