ace-lab 0.8.0 → 0.13.0

data/lib/ace/lab/cli/commands/service.rb

@@ -1,240 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require "ace/support/cli"
-require "ace/assign"
-require_relative "support"
-require_relative "../../organisms/protected_service_request"
-require_relative "../../organisms/ordinary_merge_request"
-require_relative "../../organisms/ordinary_merge_receiver"
-require_relative "../../organisms/ordinary_authority_composition"
-require_relative "../../molecules/ordinary_listener"
-require_relative "../../molecules/ordinary_receiver_config"
-
-module Ace
-  module Lab
-    module CLI
-      module Commands
-        module Service
-          module Output
-            def service
-              @service ||= Organisms::ServiceRequestService.new
-            end
-
-            def protected_service
-              @protected_service ||= Organisms::ProtectedServiceRequest.new
-            end
-
-            def protected_refusal(error)
-              code = (error.is_a?(ArgumentError) || error.is_a?(SecurityError)) ? "protected_service_refused" : "protected_service_unavailable"
-              message = error.is_a?(JSON::ParserError) ? "protected installed selection unavailable" : error.message.to_s.scrub[0, 512]
-              emit({"status" => "error", "error" => {"code" => code, "message" => message}})
-            end
-
-            def emit(envelope)
-              puts JSON.generate(envelope)
-              return if envelope["status"] == "ok"
-              error = envelope.fetch("error")
-              code = error.fetch("code")
-              message = error.fetch("message")
-              raise Ace::Support::Cli::Error, "#{code}: #{message}"
-            end
-          end
-
-          class Request < Ace::Support::Cli::Command
-            include Ace::Support::Cli::Base
-            include Runtime
-            include Output
-
-            desc "Request one authorized, configured service operation"
-            option :project, type: :string, required: true, desc: "Project stable ID"
-            option :assignment, type: :string, required: true, desc: "Assignment ID"
-            option :attempt, type: :string, required: true, desc: "Managed attempt ID"
-            option :operation, type: :string, required: true, desc: "Named operation"
-            option :input, type: :string, required: true, desc: "Structured JSON input file"
-            option :authorization, type: :string, required: true, desc: "Exact authorization reference"
-            option :request_id, type: :string, required: true, desc: "Idempotency key"
-            option :dry_run, type: :boolean, desc: "Validate without claiming or executing"
-            option :mode, type: :string, desc: "ordinary-merge selects the ordinary fixed merge producer"
-            option :queue_entry, type: :string, desc: "Original queue entry (ordinary merge)"
-
-            option :mapping, type: :string, desc: "Original protected mapping ID"
-            option :scope, type: :string, desc: "Original hierarchical prepared scope"
-            option :service, type: :string, desc: "Installed receiver ID"
-            option :candidate_head, type: :string, desc: "Exact approved candidate head"
-            option :candidate_generation, type: :integer, desc: "Original candidate generation"
-            option :expected_generation, type: :integer, desc: "Original authority generation"
-
-            def call(project:, assignment:, attempt:, operation:, input:, authorization:, request_id:, **options)
-              reject_identity_flags!(options)
-              mode = options[:mode]
-              if mode && mode != Organisms::OrdinaryMergeRequest::MODE
-                return emit(Organisms::OrdinaryMergeRequest.refusal_envelope("ordinary_merge_invalid_request",
-                  "unknown service mode", request_id: request_id, input_digest: nil))
-              end
-              if mode
-                begin
-                  return emit(ordinary_request(project: project, assignment: assignment, attempt: attempt,
-                    queue_entry: options[:queue_entry], operation: operation, input: input,
-                    authorization: authorization, request_id: request_id, **options))
-                rescue Ace::Assign::AttemptErrors::EvidenceUnavailable, Ace::Lab::InvalidConfigurationError => e
-                  # Infra failures (unreadable canonical evidence, malformed
-                  # installed configuration, unavailable topology) are the
-                  # caller-side blocker, never a raw crash and never a durable
-                  # reference (review r1 finding B).
-                  return emit(Organisms::OrdinaryMergeRequest.refusal_envelope(
-                    "ordinary_merge_unavailable", e.message, request_id: request_id, input_digest: nil
-                  ))
-                end
-              end
-              selected = protected_service.selected?(options)
-              if selected
-                return emit(protected_service.request(project: project, assignment: assignment, attempt: attempt,
-                  operation: operation, input_path: input, authorization: authorization, request_id: request_id, **options))
-              end
-              emit(service.request(project: project, assignment: assignment, attempt: attempt,
-                operation: operation, input_path: input, authorization: authorization,
-                request_id: request_id, dry_run: options[:dry_run]))
-            rescue ArgumentError, Ace::Assign::Error, Ace::Git::Error, Ace::Runtime::RuntimeUnavailableError, JSON::ParserError, SecurityError, KeyError, SystemCallError => error
-              raise if selected == false || mode
-              protected_refusal(error)
-            end
-
-            private
-
-            def ordinary_producer
-              @ordinary_producer ||= Organisms::OrdinaryMergeRequest.new
-            end
-
-            # The ordinary refusal envelope is emitted exactly as received;
-            # it is classified for the non-zero exit like every refusal.
-            def ordinary_request(**arguments)
-              ordinary_producer.request(**arguments)
-            end
-          end
-
-          class Status < Ace::Support::Cli::Command
-            include Ace::Support::Cli::Base
-            include Runtime
-            include Output
-
-            desc "Read the authoritative outcome of a service request"
-            option :request, type: :string, required: true, desc: "Request ID"
-            option :format, type: :string, desc: "Output format (json only)"
-            option :mode, type: :string, desc: "ordinary-merge selects the read-only ordinary status"
-            option :reference, type: :string, desc: "Opaque ordinary merge reference"
-            option :queue_entry, type: :string, desc: "Original queue entry (ordinary merge)"
-
-            option :project, type: :string, desc: "Original project ID"
-            option :assignment, type: :string, desc: "Original assignment ID"
-            option :attempt, type: :string, desc: "Original attempt ID"
-            option :mapping, type: :string, desc: "Original protected mapping ID"
-            option :scope, type: :string, desc: "Original hierarchical prepared scope"
-            option :candidate_head, type: :string, desc: "Exact approved candidate head"
-            option :candidate_generation, type: :integer, desc: "Original candidate generation"
-            option :input_digest, type: :string, desc: "Original normalized input SHA-256"
-            option :target, type: :string, desc: "Original target resource ID"
-            option :artifact_digest, type: :string, desc: "Original artifact SHA-256 (omit for null)"
-
-            def call(request:, **options)
-              reject_identity_flags!(options)
-              mode = options[:mode]
-              if mode && mode != Organisms::OrdinaryMergeRequest::MODE
-                return emit(Organisms::OrdinaryMergeRequest.refusal_envelope("ordinary_merge_invalid_request",
-                  "unknown service mode", request_id: request, input_digest: nil,
-                  schema: Ace::Assign::Atoms::FixedMergeSchemas::STATUS_ERROR_SCHEMA_ID))
-              end
-              if mode
-                ensure_json_format!(options)
-                begin
-                  return emit(ordinary_producer.status(project: options[:project], assignment: options[:assignment],
-                    attempt: options[:attempt], queue_entry: options[:queue_entry], reference: options[:reference],
-                    request: request, input_digest: options[:input_digest], **options))
-                rescue Ace::Assign::AttemptErrors::EvidenceUnavailable, Ace::Lab::InvalidConfigurationError => e
-                  return emit(Organisms::OrdinaryMergeRequest.refusal_envelope(
-                    "ordinary_merge_unavailable", e.message, request_id: request, input_digest: nil,
-                    schema: Ace::Assign::Atoms::FixedMergeSchemas::STATUS_ERROR_SCHEMA_ID
-                  ))
-                end
-              end
-              selected = protected_service.selected?(options)
-              if selected
-                return emit(protected_service.status(request_id: request, **options))
-              end
-              emit(service.status(request_id: request))
-            rescue ArgumentError, Ace::Assign::Error, Ace::Git::Error, Ace::Runtime::RuntimeUnavailableError, JSON::ParserError, SecurityError, KeyError, SystemCallError => error
-              raise if selected == false || mode
-              protected_refusal(error)
-            end
-
-            private
-
-            def ordinary_producer
-              @ordinary_producer ||= Organisms::OrdinaryMergeRequest.new
-            end
-          end
-
-          # The ordinary receiver serve entrypoint (spec 8x3.t.xz9.4
-          # execution clauses; 8x3.t.xz9.5 integration handoff): binds the
-          # configured unix socket, mutually authenticates every connection
-          # through OS peer credentials, admits through the canonical Assign
-          # coordinator, executes the authorized fixed operation — one REAL
-          # Forgejo merge under the scoped host-installed service identity —
-          # and settles the exact terminal receipt proven by real forge
-          # readback. Configuration is one explicit deployment-owned file
-          # plus the host-installed authorization and forge-merge documents;
-          # the host owns their placement and credentials. Blocks until
-          # stopped.
-          class Listen < Ace::Support::Cli::Command
-            include Ace::Support::Cli::Base
-            include Output
-
-            desc "Serve ordinary Assign, HITL and fixed merge under the installed journal owner"
-            option :mode, type: :string, required: true,
-              desc: "ordinary-merge selects the ordinary fixed merge receiver"
-            option :project, type: :string, required: true, desc: "Project stable ID"
-            option :config, type: :string, required: true,
-              desc: "Deployment-owned receiver configuration file (YAML)"
-
-            def call(mode:, project:, config:, **options)
-              unless options.empty?
-                return emit(Organisms::OrdinaryMergeRequest.refusal_envelope(
-                  "ordinary_merge_invalid_request",
-                  "unknown listen selector: #{options.keys.sort.join(", ")}",
-                  request_id: "unknown", input_digest: nil
-                ))
-              end
-              unless mode == Organisms::OrdinaryMergeRequest::MODE
-                return emit(Organisms::OrdinaryMergeRequest.refusal_envelope(
-                  "ordinary_merge_invalid_request", "unknown service mode",
-                  request_id: "unknown", input_digest: nil
-                ))
-              end
-              receiver_config = Molecules::OrdinaryReceiverConfig.load(config)
-              unless receiver_config.project == project
-                return emit(Organisms::OrdinaryMergeRequest.refusal_envelope(
-                  "ordinary_merge_selection_mismatch",
-                  "configured project does not match the requested project",
-                  request_id: "unknown", input_digest: nil
-                ))
-              end
-              unless receiver_config.receiver_uid == Process.uid
-                raise Ace::Lab::InvalidConfigurationError, "receiver must run as its configured UID"
-              end
-              server = Organisms::OrdinaryAuthorityComposition.new(receiver_config: receiver_config).build
-              signals = %w[INT TERM].to_h { |signal| [signal, Signal.trap(signal) { server.request_stop }] }
-              server.serve
-            rescue Ace::Lab::InvalidConfigurationError, Ace::Assign::Error, Ace::Runtime::Error, Ace::Hitl::Lifecycle::Error => e
-              emit(Organisms::OrdinaryMergeRequest.refusal_envelope(
-                "ordinary_merge_unavailable", e.message,
-                request_id: "unknown", input_digest: nil
-              ))
-            ensure
-              signals&.each { |signal, handler| Signal.trap(signal, handler) }
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/models/service_receipt.rb

@@ -1,18 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Lab
-    module Models
-      # Non-secret result submitted to the assignment evidence coordinator.
-      # The coordinator independently verifies every binding before acceptance.
-      module ServiceReceipt
-        BINDING_FIELDS = %w[request_id assignment_id attempt_id project_id operation
-          input_digest target candidate_head executor_uid transport].freeze
-
-        def self.build(binding, executor_result)
-          BINDING_FIELDS.to_h { |field| [field, binding.fetch(field)] }.merge(executor_result)
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/molecules/hitl_authorizer.rb

@@ -1,63 +0,0 @@
-# frozen_string_literal: true
-
-require "etc"
-
-module Ace
-  module Lab
-    module Molecules
-      # The lab-side HITL delivery authorization (spec 8wq.t.34i): which
-      # authenticated transport may submit correlated answers for a
-      # Captain, derived from the SAME trusted deployment document that
-      # carries the service principals — read through the grant
-      # resolver's verified traversal, never from the cascade. The peer
-      # uid is a KERNEL fact resolved by the HITL boundary; this policy
-      # never trusts a claimed name.
-      class HitlAuthorizer
-        # @param principals [Hash] authorization.principals from the
-        #   trusted document (uid-string or username keys, per-project)
-        # @param transport_uids [Array<Integer>] uids authorized to act
-        #   as the configured transport
-        # @param service_uid [Integer, nil] the trusted HITL service uid
-        def initialize(principals: {}, transport_uids: [], service_uid: nil)
-          @principals = principals || {}
-          @transport_uids = Array(transport_uids)
-          @service_uid = service_uid
-        end
-
-        # Build from the trusted deployment document at a fixed path
-        # (same file the service policy resolves principals from).
-        # @return [HitlAuthorizer]
-        def self.from_trusted_document(path, loader = GrantResolver)
-          document = loader.trusted_document(path)
-          hitl = document["hitl"].is_a?(Hash) ? document["hitl"] : {}
-          principals = document.dig("authorization", "principals")
-          new(
-            principals: principals.is_a?(Hash) ? principals : {},
-            transport_uids: Array(hitl["transport_uids"]),
-            service_uid: hitl["service_uid"]
-          )
-        end
-
-        # @return [Integer, nil] the trusted HITL service identity
-        def service_uid
-          @service_uid.is_a?(Integer) ? @service_uid : nil
-        end
-
-        # The transport may submit a correlated answer from an authorized
-        # Captain when its KERNEL-VERIFIED uid is a configured transport
-        # AND the transport's principal is visible for the request's
-        # project. Unknown identity is an error-shaped refusal, never
-        # permission.
-        def delivery_authorized?(uid:, project_id:)
-          return false unless @transport_uids.include?(uid)
-
-          policy = @principals[uid.to_s]
-          return false unless policy.is_a?(Hash)
-
-          projects = Array(policy["projects"]).map(&:to_s)
-          projects.empty? || projects.include?(project_id.to_s)
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/molecules/ordinary_admission_resolver.rb

@@ -1,131 +0,0 @@
-# frozen_string_literal: true
-
-require "time"
-require_relative "service_policy"
-
-module Ace
-  module Lab
-    module Molecules
-      # The scoped ordinary-merge decision/admission resolver (spec 8x3.t.xz9.4,
-      # execution clauses). The deployment-owned YAML authorization file remains
-      # the sole source of truth; this resolver only makes the exact root
-      # authorizations natively executable inside the receiver: one per-request
-      # authorization selector resolves to a typed decision within the closed
-      # refusal-code family — or it refuses. Scoping rules:
-      #
-      # - only `operation: merge` decisions of the ordinary shape resolve;
-      #   anything else (missing reference, shape mismatch, non-merge
-      #   operation, any binding mismatch, expiry) is a typed
-      #   `ordinary_merge_authorization_invalid` decision;
-      # - exact binding match on every closed key; there are NO wildcards,
-      #   defaults, prefix grants or broad grants of any kind — a decision
-      #   authorizes exactly one bound request and nothing else;
-      # - expiry bounds the decision itself.
-      #
-      # Per-request refresh (spec 8x3.t.xz9.5 integration handoff): a
-      # long-lived receiver would otherwise decide every sequential candidate
-      # against its boot-time snapshot of the authorization document. When a
-      # trusted path is installed, every decision re-reads the document
-      # through the trusted loader and resolves against the FRESH grants —
-      # a root-revoked or expired decision fails closed at the next request
-      # without any receiver restart. The refresh is scoped: it reloads and
-      # re-validates the exact-request grant only; it never broadens
-      # authorization beyond the resolved reference.
-      class OrdinaryAdmissionResolver
-        BINDING_KEYS = ServicePolicy::ORDINARY_BINDING_KEYS.freeze
-        DECISION_KEYS = ServicePolicy::ORDINARY_AUTHORIZATION_KEYS.freeze
-        OPERATION = "merge"
-
-        Decision = Struct.new(:authorized?, :decision, :code, :message, keyword_init: true)
-
-        # @param policy_document [Hash] boot-time trusted document (the
-        #   configuration digest is derived from it once, upstream)
-        # @param path [String, nil] trusted policy path to re-read per decision
-        # @param loader [Proc, nil] trusted reader (default: GrantResolver);
-        #   the only override point, for non-privileged test documents
-        def initialize(policy_document, path: nil, loader: nil, proposal_resolver: nil, caller_uid: nil)
-          unless policy_document.is_a?(Hash) && policy_document["authorizations"].is_a?(Hash)
-            raise Ace::Lab::InvalidConfigurationError,
-              "trusted policy document must contain an authorizations mapping"
-          end
-          @authorizations = policy_document.fetch("authorizations")
-          @configuration_digest = ServicePolicy.configuration_digest(policy_document)
-          @path = path
-          @proposal_resolver = proposal_resolver
-          @caller_uid = caller_uid
-          @loader = loader || ->(trusted_path) { GrantResolver.trusted_document(trusted_path) }
-          freeze
-        end
-
-        # Resolve one authorization selector against the exact ordinary merge
-        # request binding. Returns a typed Decision; `authorized?` is true only
-        # for an exact, unexpired, ordinary-merge-shaped match.
-        def decide(reference, binding)
-          authorizations = current_authorizations
-          unless reference.is_a?(String) && reference.match?(ServicePolicy::ID)
-            return refuse("invalid authorization reference")
-          end
-          unless binding.is_a?(Hash) && binding.fetch("operation", nil) == OPERATION
-            return refuse("only the ordinary merge operation is resolvable")
-          end
-          if reference.start_with?("proposal-")
-            return refuse("canonical proposal authority is unavailable") unless @proposal_resolver && @caller_uid.is_a?(Integer)
-            begin
-              decision = @proposal_resolver.call(reference, binding.slice(
-                "operation", "project_id", "assignment_id", "attempt_id", "input_digest", "candidate_head").merge(
-                  "target" => {"resource" => binding.fetch("pr_url"), "artifact_digest" => nil},
-                  "caller_uid" => @caller_uid))
-              return Decision.new(authorized?: true, decision: decision, code: nil, message: nil)
-            rescue Ace::Assign::Error
-              return refuse("canonical proposal does not authorize this exact ordinary merge")
-            end
-          end
-          decision = authorizations[reference]
-          return refuse("authorization reference is unresolved") unless decision.is_a?(Hash)
-          unless DECISION_KEYS.all? { |key| decision.key?(key) }
-            return refuse("authorization reference is not an ordinary merge decision")
-          end
-          unless decision.fetch("operation") == OPERATION
-            return refuse("authorization does not cover the ordinary merge operation")
-          end
-          mismatch = BINDING_KEYS.find { |key| decision.fetch(key) != binding.fetch(key, nil) }
-          return refuse("authorization does not match the exact ordinary merge request") if mismatch
-          begin
-            expired = Time.iso8601(decision.fetch("expires_at").to_s) <= Time.now.utc
-          rescue ArgumentError
-            return refuse("authorization decision has an invalid expiry")
-          end
-          return refuse("authorization has expired") if expired
-          Decision.new(authorized?: true, decision: decision, code: nil, message: nil)
-        end
-
-        private
-
-        # The authorizations mapping the CURRENT decision resolves against:
-        # the boot snapshot when no trusted path is installed, otherwise the
-        # freshly re-read document. A failed trusted re-read fails closed
-        # (InvalidConfigurationError — the unavailable family), never falls
-        # back to the stale snapshot.
-        def current_authorizations
-          return @authorizations unless @path
-          document = @loader.call(@path)
-          unless document.is_a?(Hash) && document["authorizations"].is_a?(Hash)
-            raise Ace::Lab::InvalidConfigurationError,
-              "invalid lab configuration: trusted authorization refresh at #{@path} " \
-              "did not yield an authorizations mapping"
-          end
-          unless ServicePolicy.configuration_digest(document) == @configuration_digest
-            raise Ace::Lab::InvalidConfigurationError,
-              "ordinary receiver configuration changed; restart with the installed configuration"
-          end
-          document.fetch("authorizations")
-        end
-
-        def refuse(message)
-          Decision.new(authorized?: false, decision: nil,
-            code: "ordinary_merge_authorization_invalid", message: message)
-        end
-      end
-    end
-  end
-end