ace-lab 0.8.0 → 0.13.0

data/lib/ace/lab/molecules/ordinary_listener.rb

@@ -1,262 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require "socket"
-require_relative "../errors"
-require_relative "ordinary_socket"
-
-module Ace
-  module Lab
-    module Molecules
-      # The ordinary receiver's serve-side transport (spec 8x3.t.xz9.4 serve
-      # entrypoint). Binds the configured unix socket and answers the exact
-      # framed protocol the OrdinarySocket client speaks: one bounded JSON
-      # document each way behind the shared handshake line. Authentication is
-      # MUTUAL through OS peer credentials: every connection's peer UID must equal
-      # the configured producer principal UID, and the listener itself runs
-      # as the configured receiver UID — the identity the client verifies on
-      # its side. Every identity, framing, deadline or parse failure is
-      # fail-closed: the peer receives the closed refusal envelope (or the
-      # connection closes) and nothing is ever dispatched. This is not an
-      # HTTP transport and there is no cross-VM fallback.
-      class OrdinaryListener
-        HANDSHAKE = OrdinarySocket::HANDSHAKE
-        LIMIT = OrdinarySocket::LIMIT
-        DEADLINE_SECONDS = 30
-
-        def initialize(socket_path:, peer_uid:, handler:, socket_gid: nil, lock_path: nil, logger: nil)
-          unless socket_path.is_a?(String) && socket_path.start_with?("/") &&
-              peer_uid.is_a?(Integer) && peer_uid >= 0 && handler.respond_to?(:call)
-            raise ArgumentError, "ordinary listener needs an absolute socket path, a peer uid and a handler"
-          end
-          unless socket_gid.nil? || (socket_gid.is_a?(Integer) && socket_gid >= 0)
-            raise ArgumentError, "ordinary listener socket_gid must be a non-negative integer"
-          end
-          @socket_gid = socket_gid
-          @socket_path = socket_path
-          @peer_uid = peer_uid
-          @handler = handler
-          @lock_path = lock_path || "#{@socket_path}.lock"
-          @logger = logger
-          @stopping = false
-        end
-
-        # Serve until #stop. Excludes a second listener through one owned
-        # lock file, removes only its own stale endpoint, and always removes
-        # the endpoint it created.
-        def serve(on_ready: nil)
-          acquire_lock!
-          remove_stale_endpoint!
-          @listener = UNIXServer.new(@socket_path)
-          @endpoint_identity = File.stat(@socket_path)
-          File.chown(nil, @socket_gid, @socket_path) if @socket_gid
-          File.chmod(@socket_gid ? 0o660 : 0o600, @socket_path)
-          on_ready.call if on_ready
-          @handler.recover_pending! if @handler.respond_to?(:recover_pending!)
-          until @stopping
-            socket = @listener.accept
-            serve_connection(socket)
-          end
-        rescue IOError, Errno::EBADF
-          raise unless @stopping
-        ensure
-          @listener&.close
-          remove_owned_endpoint!
-          @lock&.flock(File::LOCK_UN)
-          @lock&.close
-        end
-
-        # The existing listener participates in the Assign owner's lifetime.
-        def run(on_ready:)
-          serve(on_ready: on_ready)
-        end
-
-        def stop
-          @stopping = true
-          @listener&.close
-        rescue IOError
-          nil
-        end
-
-        # One bounded connection: verify the peer identity, read one framed
-        # request, answer one framed envelope, close. Fail-closed on every
-        # violation; a dispatch never happens from an unverified frame.
-        def serve_connection(socket)
-          deadline = Time.now.utc + DEADLINE_SECONDS
-          begin
-            verify_peer!(socket)
-            submission = read_request!(socket, deadline)
-            response = @handler.call(submission)
-            write_response_safely(socket, response, deadline)
-            if response.is_a?(Hash) && response["status"] == "ok" && @handler.respond_to?(:execute)
-              begin
-                # Admission is durable even if the acknowledgment was lost; the
-                # execution lifetime belongs to the canonical record, not
-                # the short connection. A lost lifecycle stays pending or
-                # uncertain and reconciles by the original reference.
-                @handler.execute(response.dig("data", "request_id"))
-              rescue StandardError => error
-                log_failure("effect", error)
-              end
-            end
-          rescue OrdinaryRefused => e
-            write_response_safely(socket, e.envelope, deadline)
-          rescue OrdinaryListenerError, IOError, SystemCallError => error
-            # Fail closed without a fabricated envelope; the client classifies
-            # a lost/unreadable response as ordinary_merge_unavailable.
-            log_failure("connection", error)
-          rescue StandardError => error
-            log_failure("request", error)
-            write_response_safely(socket, refusal_envelope("ordinary_merge_unavailable",
-              "receiver failed to handle the request"), deadline)
-          ensure
-            begin
-              socket.close
-            rescue IOError
-              nil
-            end
-          end
-        end
-
-        class OrdinaryListenerError < ::StandardError; end
-
-        # A verified-connection refusal that still carries a closed envelope.
-        class OrdinaryRefused < OrdinaryListenerError
-          attr_reader :envelope
-
-          def initialize(envelope)
-            @envelope = envelope
-            super(envelope.dig("error", "message").to_s)
-          end
-        end
-
-        private
-
-        def write_response_safely(socket, response, deadline)
-          write_response!(socket, response, deadline)
-        rescue OrdinaryListenerError, IOError, SystemCallError => error
-          log_failure("response", error)
-        end
-
-        def log_failure(phase, error)
-          # Arbitrary exception messages may contain provider credentials or
-          # request bodies. Journal references remain the source of effect state.
-          @logger&.call("ordinary receiver #{phase} failed (#{error.class.name})")
-        end
-
-        # Mutual half of OS peer authentication: the connecting process must run as the
-        # configured producer principal UID. Anything else is refused before
-        # one byte of request is read.
-        def verify_peer!(socket)
-          peer_uid, = socket.getpeereid
-          return if peer_uid == @peer_uid
-          raise OrdinaryRefused, refusal_envelope("ordinary_merge_unauthenticated",
-            "connecting principal is not the configured ordinary overseer")
-        rescue SystemCallError, IOError, SocketError, NotImplementedError
-          raise OrdinaryListenerError, "peer credentials are unavailable"
-        end
-
-        def read_request!(socket, deadline)
-          header = read_line!(socket, deadline)
-          match = /\A#{Regexp.escape(HANDSHAKE)} (\d{1,5})\n\z/o.match(header)
-          raise OrdinaryListenerError, "request header is invalid" unless match
-          length = Integer(match[1])
-          raise OrdinaryListenerError, "request exceeds the wire bound" if length > LIMIT
-          payload = read_exact!(socket, length, deadline)
-          JSON.parse(payload, allow_duplicate_key: false, create_additions: false, max_nesting: 16)
-        rescue JSON::ParserError
-          raise OrdinaryRefused, refusal_envelope("ordinary_merge_invalid_request",
-            "request document is not valid JSON")
-        end
-
-        def write_response!(socket, response, deadline)
-          payload = JSON.generate(response)
-          raise OrdinaryListenerError, "response exceeds the wire bound" if payload.bytesize > LIMIT
-          frame = "#{HANDSHAKE} #{payload.bytesize}\n#{payload}"
-          written = 0
-          while written < frame.bytesize
-            raise OrdinaryListenerError, "response write deadline expired" if Time.now.utc >= deadline
-            begin
-              written += socket.write_nonblock(frame.byteslice(written..))
-            rescue IO::WaitWritable
-              socket.wait_writable(remaining!(deadline)) or
-                raise OrdinaryListenerError, "response write deadline expired"
-            end
-          end
-        rescue JSON::GeneratorError
-          raise OrdinaryListenerError, "response is not serializable"
-        end
-
-        def refusal_envelope(code, message)
-          {"status" => "error", "error" => {
-            "schema" => "ace.lab.service.ordinary-merge-refusal/v1",
-            "code" => code,
-            "message" => message.to_s.scrub.gsub(/\s+/, " ").strip[0, 512],
-            "request_id" => "unknown",
-            "input_digest" => nil
-          }}
-        end
-
-        def read_line!(socket, deadline)
-          line = +""
-          until line.end_with?("\n")
-            raise OrdinaryListenerError, "request header is unbounded" if line.bytesize > 128
-            line << read_exact!(socket, 1, deadline)
-          end
-          line
-        end
-
-        def read_exact!(socket, length, deadline)
-          buffer = +""
-          while buffer.bytesize < length
-            raise OrdinaryListenerError, "request read deadline expired" if Time.now.utc >= deadline
-            begin
-              chunk = socket.read_nonblock(length - buffer.bytesize)
-              raise OrdinaryListenerError, "peer closed the connection" if chunk.nil?
-              buffer << chunk
-            rescue IO::WaitReadable
-              socket.wait_readable(remaining!(deadline)) or
-                raise OrdinaryListenerError, "request read deadline expired"
-            end
-          end
-          buffer
-        end
-
-        def remaining!(deadline)
-          left = deadline - Time.now.utc
-          raise OrdinaryListenerError, "connection deadline expired" if left <= 0
-          left
-        end
-
-        def acquire_lock!
-          @lock = File.open(@lock_path, File::RDWR | File::CREAT | File::NOFOLLOW, 0o600)
-          stat = @lock.stat
-          unless stat.file? && stat.uid == Process.uid && stat.nlink == 1 && (stat.mode & 0o7777) == 0o600
-            raise Ace::Lab::InvalidConfigurationError, "receiver listener lock differs"
-          end
-          unless @lock.flock(File::LOCK_EX | File::LOCK_NB)
-            raise Ace::Lab::InvalidConfigurationError, "receiver listener already active"
-          end
-        end
-
-        def remove_stale_endpoint!
-          stat = File.lstat(@socket_path)
-          unless stat.socket? && stat.uid == Process.uid
-            raise Ace::Lab::InvalidConfigurationError, "receiver endpoint differs"
-          end
-          File.unlink(@socket_path)
-        rescue Errno::ENOENT
-          nil
-        end
-
-        def remove_owned_endpoint!
-          return unless @endpoint_identity
-          stat = File.stat(@socket_path)
-          File.unlink(@socket_path) if stat.socket? && stat.ino == @endpoint_identity.ino
-        rescue Errno::ENOENT
-          nil
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/molecules/ordinary_merge_read.rb

@@ -1,45 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "ordinary_worktree_read"
-
-module Ace
-  module Lab
-    module Molecules
-      # Local checks are bounded read-only observations. Only the forge provider
-      # executes merge; moving a local ref can never prove a delivered merge.
-      class OrdinaryMergeRead
-        STRATEGY = "ff"
-
-        def initialize(repo_path:, base_ref:, root: repo_path, common_dir: File.join(repo_path, ".git"),
-          deadline: Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30)
-          unless repo_path.is_a?(String) && repo_path.start_with?("/") &&
-              base_ref.is_a?(String) && base_ref.start_with?("refs/")
-            raise ArgumentError, "ordinary merge read needs an absolute repository and full base ref"
-          end
-          @repo_path, @base_ref = repo_path, base_ref
-          @reader = OrdinaryWorktreeRead.new(root: root, common_dir: common_dir, deadline: deadline)
-        end
-
-        def base_head
-          @reader.ref_head(@repo_path, @base_ref)
-        rescue Ace::Assign::Error => error
-          raise GitUnavailable, error.message
-        end
-
-        def candidate_commit?(head)
-          @reader.commit?(@repo_path, head)
-        rescue Ace::Assign::Error => error
-          raise GitUnavailable, error.message
-        end
-
-        def fast_forwardable?(head)
-          @reader.ancestor?(@repo_path, base_head, head)
-        rescue Ace::Assign::Error => error
-          raise GitUnavailable, error.message
-        end
-
-        class GitUnavailable < StandardError; end
-      end
-    end
-  end
-end

data/lib/ace/lab/molecules/ordinary_native_read.rb

@@ -1,106 +0,0 @@
-# frozen_string_literal: true
-
-require "securerandom"
-require "ace/runtime/molecules/protected_socket"
-require "ace/herdr/molecules/herdr_executor"
-require "ace/assign/authority/ordinary_peer"
-require_relative "ordinary_owner_config"
-
-module Ace
-  module Lab
-    module Molecules
-      # Read-only use of Herdr's existing native protocol. Root selection pins
-      # the endpoint inode and live server; no ambient CLI environment chooses
-      # the daemon, and no protected runtime guarantees are borrowed here.
-      class OrdinaryNativeRead
-        def initialize(config:, deadline:, peer: Ace::Assign::Authority::OrdinaryPeer.new)
-          raise ArgumentError, "native reader needs installed selection" unless config.is_a?(OrdinaryOwnerConfig)
-          @config, @deadline, @peer = config, deadline, peer
-          @native = config.native
-        end
-
-        def preflight!
-          result = request("ping", {})
-          unless result["type"] == "pong" && result.values_at("version", "protocol") == @native.values_at("version", "protocol")
-            unavailable!("native protocol differs from installed selection")
-          end
-          true
-        end
-
-        def pane_get(pane)
-          result = request("pane.get", {"pane_id" => pane})
-          unless result["type"] == "pane_info" && result["pane"].is_a?(Hash) && result["pane"]["pane_id"] == pane
-            unavailable!("native pane metadata differs from requested pane")
-          end
-          response(result)
-        end
-
-        def pane_process_info(pane)
-          @process_info = nil
-          result = request("pane.process_info", {"pane_id" => pane})
-          unless result["type"] == "pane_process_info" && result["process_info"].is_a?(Hash) && result["process_info"]["pane_id"] == pane
-            unavailable!("native process inventory differs from requested pane")
-          end
-          @process_info = result.fetch("process_info")
-          response(result)
-        end
-
-        # This per-PID native field comes from process_cwd, not the terminal's
-        # OSC/UI working directory. The caller separately verifies PID birth.
-        def process_cwd(pid)
-          processes = @process_info.is_a?(Hash) && @process_info["foreground_processes"]
-          unavailable!("native process inventory is unavailable") unless processes.is_a?(Array)
-          matches = processes.select { |entry| entry.is_a?(Hash) && entry["pid"] == pid }
-          path = matches.one? && matches.first["cwd"]
-          unless path.is_a?(String) && path.bytesize.between?(1, 4096) && !path.include?("\0") &&
-              path.start_with?("/") && File.expand_path(path) == path
-            unavailable!("exact native process working directory is unavailable")
-          end
-          path
-        end
-
-        private
-
-        def request(method, params)
-          verify_endpoint!
-          wire.connect(@native.fetch("socket_path"), deadline: @deadline) do |socket|
-            unless @peer.capture(socket, deadline: @deadline) == @native.fetch("server_identity")
-              unavailable!("native peer differs from installed server")
-            end
-            verify_endpoint!
-            id = SecureRandom.hex(12)
-            wire.write(socket, {"id" => id, "method" => method, "params" => params}, deadline: @deadline, limit: 16_384)
-            value = wire.read(wire::Ingress.new(socket), deadline: @deadline, limit: 65_536)
-            unless value.is_a?(Hash) && value.keys.sort == %w[id result] && value["id"] == id && value["result"].is_a?(Hash)
-              unavailable!("native read response is invalid")
-            end
-            verify_endpoint!
-            @peer.live!(@native.fetch("server_identity"), deadline: @deadline)
-            value.fetch("result")
-          end
-        rescue SystemCallError, IOError, KeyError, Ace::Assign::AttemptErrors::UnauthorizedIdentity
-          unavailable!("native read is unavailable")
-        end
-
-        def verify_endpoint!
-          @config.verify_selection!
-          path = @native.fetch("socket_path")
-          wire.root_path!(File.dirname(path), directory: true)
-          unless wire.socket_identity(path) == @native.fetch("socket_identity") && (File.lstat(path).mode & 0o007).zero?
-            unavailable!("native endpoint generation or access differs")
-          end
-        end
-
-        def response(result)
-          Ace::Herdr::Molecules::ExecutionResult.new(stdout: JSON.generate({"result" => result}), stderr: "", success: true, exit_code: 0)
-        end
-
-        def wire = Ace::Runtime::Molecules::ProtectedSocket
-
-        def unavailable!(reason)
-          raise Ace::Runtime::RuntimeUnavailableError, reason
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/molecules/ordinary_owner_admission.rb

@@ -1,139 +0,0 @@
-# frozen_string_literal: true
-
-require "ace/assign/authority/ordinary_peer"
-require "ace/assign/molecules/execution_identity_resolver"
-require "ace/herdr"
-require_relative "ordinary_owner_config"
-require_relative "ordinary_native_read"
-require_relative "ordinary_worktree_read"
-
-module Ace
-  module Lab
-    module Molecules
-      # The source-selected ordinary peer policy. Native selectors are hints;
-      # only actual ancestry in the installed project's Herdr grants attribution.
-      class OrdinaryOwnerAdmission
-        def initialize(config:, peer: Ace::Assign::Authority::OrdinaryPeer.new, runtime: nil)
-          raise ArgumentError, "ordinary owner requires validated installed selection" unless config.is_a?(OrdinaryOwnerConfig)
-          @config, @peer = config, peer
-          @runtime = runtime
-        end
-
-        def service = @config.service
-        def verify_listener!
-          @config.verify_listener!
-          OrdinaryNativeRead.new(config: @config, deadline: default_deadline, peer: @peer).preflight!
-        end
-        def peer(socket, deadline:) = @peer.capture(socket, deadline: deadline)
-
-        def authorize!(request:, peer:, deadline: default_deadline)
-          @peer.live!(peer, deadline: deadline)
-          unless request.fetch("project_id") == @config.project
-            raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "ordinary request belongs to another project"
-          end
-          @config.participant!(peer)
-          pane = request.fetch("params", {})["pane"]
-          # Reads need project visibility only. Every mutating lifecycle route
-          # validates a pane; supervisor authority additionally requires actual
-          # caller ancestry in one of the root-installed native placements.
-          return :worker unless pane
-          identity!(peer: peer, pane: pane, deadline: deadline).role == "coordinator" ? :supervisor : :worker
-        end
-
-        def identity!(peer:, pane:, deadline: default_deadline)
-          observe_identity(peer: peer, pane: pane, deadline: deadline, with_cwd: false).first
-        end
-
-        # The caller's claimed head is only a comparison. The accepted start
-        # uses the observed worker's checkout and process, never daemon cwd.
-        def execution!(peer:, pane:, head:, deadline: default_deadline)
-          unless head.is_a?(String) && head.match?(/\A[0-9a-f]{40}\z/)
-            raise ArgumentError, "ordinary start HEAD is invalid"
-          end
-          identity, cwd = observe_identity(peer: peer, pane: pane, deadline: deadline, with_cwd: true)
-          checkout = OrdinaryWorktreeRead.new(root: @config.worktrees.fetch("root"),
-            common_dir: @config.worktrees.fetch("common_dir"), deadline: deadline).observe(cwd)
-          after, after_cwd = observe_identity(peer: peer, pane: pane, deadline: deadline, with_cwd: true)
-          unless after == identity && after_cwd == cwd && checkout.fetch("head") == head
-            raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "ordinary worker process, working directory or HEAD changed"
-          end
-          {identity: identity, checkout: checkout}
-        end
-
-        # Read the original canonical native owner for a trusted consumer.
-        # The binding must come from accepted history, never requester fields.
-        # This observes ownership; it does not grant the target's privileges to
-        # the caller or manufacture a kernel-authenticated connection identity.
-        def recorded_binding!(binding:, caller_pid: nil, deadline: default_deadline)
-          observe_recorded_binding(binding, caller_pid, deadline).first
-        end
-
-        def recorded_execution!(binding:, head:, deadline: default_deadline)
-          before, cwd = observe_recorded_binding(binding, nil, deadline)
-          checkout = OrdinaryWorktreeRead.new(root: @config.worktrees.fetch("root"),
-            common_dir: @config.worktrees.fetch("common_dir"), deadline: deadline).observe(cwd)
-          after, after_cwd = observe_recorded_binding(binding, nil, deadline)
-          unless before == after && cwd == after_cwd && checkout.fetch("head") == head
-            raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "ordinary recorded worker or HEAD changed"
-          end
-          {runtime_binding: after, checkout: checkout}
-        end
-
-        private
-
-        def observe_recorded_binding(binding, caller_pid, deadline)
-          @config.verify_selection!
-          uid = binding.fetch("process_identity").fetch("uid")
-          participant = @config.selected_principal!(uid)
-          unless participant && binding["runtime"] == participant.fetch("runtime") && binding["session"] == participant.fetch("workspace")
-            raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "ordinary recorded participant is no longer selected"
-          end
-          native, runtime = native_runtime(deadline)
-          actual = runtime.process_binding(pane: binding.fetch("pane"), caller_pid: caller_pid || binding.fetch("process_identity").fetch("pid"))
-          unless actual == binding
-            raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "ordinary recorded native owner is unavailable or changed"
-          end
-          cwd = native.process_cwd(binding.fetch("process_identity").fetch("pid"))
-          @config.selected_principal!(uid)
-          [actual, cwd]
-        end
-
-        def native_runtime(deadline)
-          return [@runtime, @runtime] if @runtime
-          observation = Ace::Herdr::Molecules::BoundedObservation.new(deadline: deadline, binary: @config.runtime_binary)
-          native = OrdinaryNativeRead.new(config: @config, deadline: deadline, peer: @peer)
-          native.preflight!
-          [native, Ace::Herdr::Organisms::RuntimeAdapter.new(executor: native, env: {},
-            process_identity: Ace::Runtime::Molecules::ProcessIdentity.new(executor: observation))]
-        end
-
-        def observe_identity(peer:, pane:, deadline:, with_cwd:)
-          @peer.live!(peer, deadline: deadline)
-          participant = @config.participant!(peer)
-          unless pane.is_a?(String) && pane.bytesize.between?(1, 128) && !pane.include?("\0")
-            raise ArgumentError, "ordinary native pane selector is invalid"
-          end
-          native, runtime = native_runtime(deadline)
-          binding = runtime.process_binding(pane: pane, caller_pid: peer.fetch("pid"))
-          unless binding && binding["runtime"] == participant.fetch("runtime") &&
-              binding["session"] == participant.fetch("workspace") && binding["pane"] == pane &&
-              binding.dig("process_identity", "uid") == peer.fetch("uid")
-            raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "ordinary native owner is unavailable or differs"
-          end
-          @peer.live!(peer, deadline: deadline)
-          @config.participant!(peer)
-          # Ordinary native agents may share an OS account. Preserve that actor
-          # for HITL attribution; privilege follows observed native placement,
-          # not a claimed role or an invented per-agent account alias.
-          role = participant.fetch("supervisor_panes").include?(binding.fetch("pane")) ? "coordinator" : "worker"
-          identity = Ace::Assign::Molecules::ExecutionIdentityResolver::Identity.new(
-            actor: participant.fetch("actor"), role: role, runtime: participant.fetch("runtime"),
-            adapter: "ordinary", process_pid: binding.fetch("process_identity").fetch("pid"), runtime_binding: binding)
-          [identity, with_cwd ? native.process_cwd(identity.process_pid) : nil]
-        end
-
-        def default_deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30
-      end
-    end
-  end
-end