ace-lab 0.8.0 → 0.13.0

data/lib/ace/lab/molecules/protected_cleanup_owner_admission.rb

@@ -1,163 +0,0 @@
-# frozen_string_literal: true
-
-require "ace/assign/authority/service_evidence"
-require_relative "protected_cleanup_owner_client"
-require "ace/assign/authority/endcap"
-require "ace/assign/authority/launch_lifecycle"
-
-module Ace
-  module Lab
-    module Molecules
-      # Only the fixed listener supplies the installed journal snapshot and its
-      # independently observed self binding. A frame selects neither owner.
-      class ProtectedCleanupOwnerAdmission
-        FIELDS = %w[schema kind request_id input_digest claim_binding request_event_digest
-          dispatch_event_digest input operation_owner_binding_digest].freeze
-        INSPECT_FIELDS = (FIELDS + %w[challenge_ref]).freeze
-
-        def initialize(deployment:, authority_id:, mapping_id:, service_id:, kernel:, preview_policy: nil)
-          @deployment, @authority_id, @kernel = deployment, authority_id, kernel
-          @mapping_id, @service_id = mapping_id, service_id
-          @preview_policy = preview_policy
-        end
-
-        def identity_reader!(peer)
-          authority = @deployment.authority(@authority_id)
-          if peer.slice("uid", "gid", "groups") == authority.slice("uid", "gid", "groups")
-            @kernel.live!(peer)
-            return true
-          end
-          receiver!(peer)
-        end
-
-        def connection_group!(gid)
-          authority = @deployment.authority(@authority_id)
-          map = @deployment.mapping(@mapping_id)
-          project = @deployment.project(map.fetch("project_id"))
-          receiver = project.fetch("service_receivers").fetch(@service_id)
-          credentials = project.fetch("peer_credentials").fetch(receiver.fetch("executor_uid").to_s)
-          unless gid.is_a?(Integer) && gid.positive? && [authority, credentials].all? { |principal| principal.fetch("gid") == gid || principal.fetch("groups").include?(gid) }
-            raise SecurityError, "cleanup connection group differs from installed principals"
-          end
-          true
-        end
-
-        def receiver!(peer)
-          map = @deployment.mapping(@mapping_id)
-          project = @deployment.project(map.fetch("project_id"))
-          receiver = project.fetch("service_receivers").fetch(@service_id)
-          credentials = project.fetch("peer_credentials").fetch(receiver.fetch("executor_uid").to_s)
-          unless map.fetch("authority_id") == @authority_id && peer.fetch("uid").is_a?(Integer) && peer.fetch("uid").positive? &&
-              peer.fetch("uid") == receiver.fetch("executor_uid") && peer.fetch("gid") == credentials.fetch("gid") &&
-              peer.fetch("groups") == credentials.fetch("groups")
-            raise SecurityError, "cleanup installed receiver differs"
-          end
-          @kernel.live!(peer)
-          true
-        rescue KeyError, TypeError
-          raise SecurityError, "cleanup installed receiver unavailable"
-        end
-
-        def preview!(frame:, peer:, operation_owner_binding:, journal:)
-          receiver!(peer)
-          Atoms::ProtectedWorkspacePruneInput.object!(frame, %w[schema kind intent maintenance_context])
-          raise SecurityError, "cleanup preview kind differs" unless frame.values_at("schema", "kind") == [ProtectedCleanupOwnerClient::SCHEMA, "preview"]
-          intent = Atoms::ProtectedWorkspacePrunePreview.intent!(frame.fetch("intent"))
-          supplied = Atoms::ProtectedWorkspacePrunePreview.context!(frame.fetch("maintenance_context"))
-          maintenance = supplied.fetch("maintenance")
-          map = @deployment.mapping(@mapping_id)
-          unless intent.fetch("maintenance") == maintenance && maintenance.fetch("mapping_id") == @mapping_id &&
-              maintenance.fetch("project_id") == map.fetch("project_id") && map.fetch("authority_id") == @authority_id
-            raise SecurityError, "cleanup preview installed scope differs"
-          end
-          raise SecurityError, "cleanup preview policy composition unavailable" unless @preview_policy
-          launch = Ace::Assign::Authority::LaunchLifecycle.new(deployment: @deployment, kernel: @kernel)
-          owner = Ace::Assign::Authority::Endcap.new(deployment: @deployment, launch: launch, kernel: @kernel, service_policy: @preview_policy)
-          params = maintenance.except("project_id").merge("service_id" => @service_id,
-            "worker_process_binding" => supplied.fetch("caller_process_binding"))
-          selected = owner.workspace_prune_preview_context_at!(journal: journal, params: params, map: map, peer: peer, role: :executor)
-          raise SecurityError, "cleanup preview canonical selection changed" unless selected == supplied
-          Atoms::ProtectedWorkspacePruneInput.freeze_value({"intent" => intent, "maintenance_context" => selected,
-            "operation_owner_binding" => operation_owner_binding})
-        rescue KeyError, TypeError, ArgumentError
-          raise SecurityError, "cleanup preview canonical selection unavailable"
-        end
-
-        def admit!(frame:, peer:, operation_owner_binding:, journal:)
-          admit_original!(frame: frame, peer: peer, operation_owner_binding: operation_owner_binding, journal: journal, purpose: :execute)
-        end
-
-        def inspect!(frame:, peer:, operation_owner_binding:, journal:)
-          context = admit_original!(frame: frame, peer: peer, operation_owner_binding: operation_owner_binding, journal: journal, purpose: :inspect)
-          reference = frame.fetch("challenge_ref")
-          Atoms::ProtectedWorkspacePruneInput.object!(reference, %w[challenge_event_digest])
-          Atoms::ProtectedWorkspacePruneInput.digest!(reference.fetch("challenge_event_digest"))
-          challenge = Ace::Assign::Authority::ServiceEvidence.new(journal: journal).challenge!(context.fetch("record"), pending: {commit: context.fetch("commit")})
-          unless challenge.fetch("digest") == reference.fetch("challenge_event_digest")
-            raise SecurityError, "cleanup inspection challenge differs"
-          end
-          Atoms::ProtectedWorkspacePruneInput.freeze_value(context.merge("challenge" => challenge))
-        end
-
-        private
-
-        def admit_original!(frame:, peer:, operation_owner_binding:, journal:, purpose:)
-          receiver!(peer)
-          Atoms::ProtectedWorkspacePruneInput.object!(frame, purpose == :execute ? FIELDS : INSPECT_FIELDS)
-          unless frame.values_at("schema", "kind") == [ProtectedCleanupOwnerClient::SCHEMA, purpose.to_s]
-            raise SecurityError, "cleanup invocation kind differs"
-          end
-          Atoms::ProtectedWorkspacePruneInput.token!(frame.fetch("request_id"))
-          (FIELDS - %w[schema kind request_id input]).each do |key|
-            Atoms::ProtectedWorkspacePruneInput.digest!(frame.fetch(key))
-          end
-          input = Atoms::ProtectedWorkspacePruneInput.parse(JSON.generate(frame.fetch("input")))
-          unless Atoms::ServiceInput.digest(input) == frame.fetch("input_digest") &&
-              (purpose == :inspect || digest(operation_owner_binding) == frame.fetch("operation_owner_binding_digest"))
-            raise SecurityError, "cleanup original input or owner differs"
-          end
-          maintenance = input.fetch("maintenance")
-          map = @deployment.mapping(maintenance.fetch("mapping_id"))
-          unless maintenance.fetch("mapping_id") == @mapping_id && map.fetch("authority_id") == @authority_id && map.fetch("project_id") == maintenance.fetch("project_id")
-            raise SecurityError, "cleanup installed scope differs"
-          end
-          unless journal.evidence_mode == :protected
-            raise SecurityError, "cleanup requires the installed protected service evidence owner"
-          end
-          commit = journal.ref_value
-          journal.verify_canonical_prefix!(commit: commit)
-          record = journal.service_request(frame.fetch("request_id"), commit: commit)
-          unless record && record.fetch("service_id") == @service_id && record.slice("project_id", "mapping_id", "assignment_id", "attempt_id") == maintenance &&
-              record.values_at("operation", "dispatch_phase") == ["prune-preserved-workspace", "dispatch_started"] &&
-              (purpose == :execute ? record["state"] == "uncertain" : %w[uncertain failed].include?(record["state"])) &&
-              record.slice("request_id", "input_digest", "claim_binding") == frame.slice("request_id", "input_digest", "claim_binding") &&
-              record.fetch("target") == Atoms::ServiceInput.target(input) &&
-              digest(record.fetch("operation_owner_binding")) == frame.fetch("operation_owner_binding_digest") &&
-              (purpose == :inspect || digest(record.fetch("executor_process_binding")) == digest(peer))
-            raise SecurityError, "cleanup canonical original dispatch differs"
-          end
-          Ace::Assign::Authority::ServiceEvidence.new(journal: journal).context(record, pending: {commit: commit})
-          receiver = @deployment.project(map.fetch("project_id")).fetch("service_receivers").fetch(record.fetch("service_id"))
-          credentials = @deployment.project(map.fetch("project_id")).fetch("peer_credentials").fetch(receiver.fetch("executor_uid").to_s)
-          unless peer.fetch("uid") == record.fetch("executor_uid") && peer.fetch("uid") == receiver.fetch("executor_uid") &&
-              peer.fetch("gid") == credentials.fetch("gid") && peer.fetch("groups") == credentials.fetch("groups")
-            raise SecurityError, "cleanup original executor differs"
-          end
-          @kernel.live!(peer)
-          proof = Ace::Assign::Authority::ServiceEvidence.new(journal: journal).cleanup_dispatch_context!(
-            record, commit: commit, selectors: frame.slice("request_event_digest", "dispatch_event_digest"))
-          if purpose == :execute && proof.fetch("dispatch_record") != record
-            raise SecurityError, "cleanup original executable record differs"
-          end
-          Atoms::ProtectedWorkspacePruneInput.freeze_value(JSON.parse(JSON.generate({"commit" => commit,
-            "record" => record, "input" => input, "operation_owner_binding" => operation_owner_binding,
-            "request_event_digest" => frame.fetch("request_event_digest"), "dispatch_event_digest" => frame.fetch("dispatch_event_digest")})))
-        rescue KeyError, TypeError, ArgumentError
-          raise SecurityError, "cleanup canonical admission is unavailable"
-        end
-
-        def digest(value) = Ace::Assign::Atoms::EvidenceDigest.digest(value)
-      end
-    end
-  end
-end

data/lib/ace/lab/molecules/protected_cleanup_owner_client.rb

@@ -1,165 +0,0 @@
-# frozen_string_literal: true
-
-require "ace/runtime/molecules/protected_socket"
-require "ace/assign/authority/transfer_codec"
-require "ace/assign/atoms/evidence_digest"
-require_relative "../atoms/protected_workspace_prune_input"
-require_relative "../atoms/service_input"
-require_relative "../atoms/protected_workspace_prune_preview"
-
-module Ace
-  module Lab
-    module Molecules
-      # Fixed installed endpoint. A fresh execute connection must independently
-      # match the original canonical binding; identity EOF is never permission.
-      class ProtectedCleanupOwnerClient
-        PATH = "/run/lab/protected-workspace-cleanup.sock"
-        SCHEMA = "lab.protected-workspace-cleanup-control/v1"
-        LIMIT = 16_384
-
-        def initialize(observer:, scratch_root:, wire: Ace::Runtime::Molecules::ProtectedSocket)
-          @observer, @wire = observer, wire
-          @codec = Ace::Assign::Authority::TransferCodec.new(root: scratch_root)
-        end
-
-        def identity!
-          deadline = @wire.deadline(5)
-          connect(deadline) do |socket, binding|
-            @wire.write(socket, {"schema" => SCHEMA, "kind" => "identity"}, deadline: deadline, limit: LIMIT)
-            socket.shutdown(Socket::SHUT_WR)
-            guarded = Ace::Runtime::Molecules::ProtectedSocket::Ingress.new(socket)
-            reply = @wire.read(guarded, deadline: deadline, limit: LIMIT)
-            eof!(guarded, deadline)
-            unless reply.is_a?(Hash) && reply.keys.sort == %w[kind operation_owner_binding schema] &&
-                reply["schema"] == SCHEMA && reply["kind"] == "identity" &&
-                digest(reply["operation_owner_binding"]) == digest(binding)
-              raise SecurityError, "cleanup identity reply differs from observed original owner"
-            end
-            binding
-          end
-        end
-
-        def preview!(intent:, maintenance_context:, deadline: @wire.deadline(5))
-          intent = Atoms::ProtectedWorkspacePrunePreview.intent!(JSON.parse(JSON.generate(intent)))
-          context = Atoms::ProtectedWorkspacePrunePreview.context!(JSON.parse(JSON.generate(maintenance_context)))
-          raise SecurityError, "preview maintenance differs" unless intent.fetch("maintenance") == context.fetch("maintenance")
-          connect(deadline) do |socket, _original|
-            @wire.write(socket, {"schema" => SCHEMA, "kind" => "preview", "intent" => intent,
-              "maintenance_context" => context}, deadline: deadline, limit: 65_536)
-            socket.shutdown(Socket::SHUT_WR)
-            guarded = Ace::Runtime::Molecules::ProtectedSocket::Ingress.new(socket)
-            result = @wire.read(guarded, deadline: deadline, limit: LIMIT)
-            eof!(guarded, deadline)
-            Atoms::ProtectedWorkspacePrunePreview.result!(result, intent: intent, context: context)
-          end
-        end
-
-        def execute!(request:, operation_owner_binding:)
-          request = JSON.parse(JSON.generate(request), create_additions: false, max_nesting: 16)
-          fields = %w[request_id input_digest claim_binding request_event_digest dispatch_event_digest input]
-          Atoms::ProtectedWorkspacePruneInput.object!(request, fields)
-          Atoms::ProtectedWorkspacePruneInput.token!(request.fetch("request_id"))
-          (fields - %w[request_id input]).each { |key| Atoms::ProtectedWorkspacePruneInput.digest!(request.fetch(key)) }
-          bytes = JSON.generate(request.fetch("input"))
-          input = Atoms::ProtectedWorkspacePruneInput.parse(bytes)
-          unless Atoms::ServiceInput.digest(input) == request.fetch("input_digest")
-            raise SecurityError, "cleanup execute input differs"
-          end
-          Atoms::ProtectedWorkspacePruneInput.freeze_value(request)
-          deadline = @wire.deadline(300)
-          admission_deadline = [deadline, @wire.deadline(5)].min
-          connect(admission_deadline) do |socket, observed|
-            unless digest(observed) == digest(operation_owner_binding)
-              raise SecurityError, "cleanup execute owner differs from original dispatch"
-            end
-            frame = request.merge("schema" => SCHEMA, "kind" => "execute",
-              "operation_owner_binding_digest" => digest(observed))
-            @wire.write(socket, frame, deadline: admission_deadline, limit: 65_536)
-            socket.shutdown(Socket::SHUT_WR)
-            guarded = Ace::Runtime::Molecules::ProtectedSocket::Ingress.new(socket)
-            reply = @wire.read(guarded, deadline: deadline, limit: LIMIT)
-            unless reply.is_a?(Hash) && reply.keys.sort == %w[input_digest kind receipt_ref request_id schema] &&
-                reply.values_at("schema", "kind", "request_id", "input_digest") ==
-                  [SCHEMA, "result", request.fetch("request_id"), request.fetch("input_digest")]
-              raise SecurityError, "cleanup result identity differs"
-            end
-            ref = reply.fetch("receipt_ref")
-            Atoms::ProtectedWorkspacePruneInput.reference!(ref)
-            descriptor = {"version" => 1, "bytes" => ref.fetch("bytes"), "sha256" => ref.fetch("sha256"),
-              "parts" => [ref.slice("bytes", "sha256")]}
-            @codec.receive(guarded, descriptor: descriptor, purpose: :artifacts, deadline: deadline) do |received|
-              Atoms::ProtectedWorkspacePruneInput.freeze_value(ref)
-              {receipt_ref: ref, bytes: received.bytes.freeze}.freeze
-            end
-          end
-        end
-
-        def inspect!(request:, operation_owner_binding:)
-          request = JSON.parse(JSON.generate(request), create_additions: false, max_nesting: 16)
-          fields = %w[request_id input_digest claim_binding request_event_digest dispatch_event_digest input challenge_ref]
-          Atoms::ProtectedWorkspacePruneInput.object!(request, fields)
-          Atoms::ProtectedWorkspacePruneInput.token!(request.fetch("request_id"))
-          (fields - %w[request_id input challenge_ref]).each { |key| Atoms::ProtectedWorkspacePruneInput.digest!(request.fetch(key)) }
-          Atoms::ProtectedWorkspacePruneInput.object!(request.fetch("challenge_ref"), %w[challenge_event_digest])
-          Atoms::ProtectedWorkspacePruneInput.digest!(request.dig("challenge_ref", "challenge_event_digest"))
-          input = Atoms::ProtectedWorkspacePruneInput.parse(JSON.generate(request.fetch("input")))
-          raise SecurityError, "cleanup inspection input differs" unless Atoms::ServiceInput.digest(input) == request.fetch("input_digest")
-          frame = request.merge("schema" => SCHEMA, "kind" => "inspect", "operation_owner_binding_digest" => digest(operation_owner_binding))
-          Atoms::ProtectedWorkspacePruneInput.freeze_value(frame)
-          deadline = @wire.deadline(300)
-          admission_deadline = [deadline, @wire.deadline(5)].min
-          connect(admission_deadline) do |socket, _observed|
-            @wire.write(socket, frame, deadline: admission_deadline, limit: 65_536)
-            socket.shutdown(Socket::SHUT_WR)
-            guarded = Ace::Runtime::Molecules::ProtectedSocket::Ingress.new(socket)
-            reply = @wire.read(guarded, deadline: deadline, limit: LIMIT)
-            success = reply.is_a?(Hash) && reply["kind"] == "completed-result"
-            ref_key = success ? "receipt_ref" : "inspection_ref"
-            unless reply.is_a?(Hash) && reply.keys.sort == (["input_digest", ref_key, "kind", "request_id", "schema"].sort) &&
-                reply.values_at("schema", "kind", "request_id", "input_digest") ==
-                  [SCHEMA, success ? "completed-result" : "inspection", request.fetch("request_id"), request.fetch("input_digest")]
-              raise SecurityError, "cleanup inspection result differs"
-            end
-            ref = reply.fetch(ref_key)
-            Atoms::ProtectedWorkspacePruneInput.reference!(ref)
-            descriptor = {"version" => 1, "bytes" => ref.fetch("bytes"), "sha256" => ref.fetch("sha256"), "parts" => [ref.slice("bytes", "sha256")]}
-            @codec.receive(guarded, descriptor: descriptor, purpose: :artifacts, deadline: deadline) do |received|
-              Atoms::ProtectedWorkspacePruneInput.freeze_value(ref)
-              {kind: success ? "succeeded" : "failed-no-effect", receipt_ref: ref, bytes: received.bytes.freeze}.freeze
-            end
-          end
-        end
-
-        private
-
-        def digest(value) = Ace::Assign::Atoms::EvidenceDigest.digest(value)
-
-        def connect(deadline)
-          @wire.root_path!(File.dirname(PATH), directory: true)
-          before = @wire.socket_identity(PATH, mode: 0o660)
-          raise SecurityError, "cleanup endpoint owner differs" unless before.last == 0
-          @wire.connect(PATH, deadline: deadline) do |socket|
-            observed = @observer.observe!(socket: socket, deadline: deadline)
-            raise SecurityError, "cleanup endpoint was replaced" unless @wire.socket_identity(PATH, mode: 0o660) == before
-            yield socket, observed
-          end
-        rescue IOError, SystemCallError
-          raise Ace::Runtime::RuntimeUnavailableError, "cleanup original transport unavailable"
-        end
-
-        def eof!(socket, deadline)
-          loop do
-            remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
-            unless remaining.positive? && IO.select([socket], nil, nil, remaining)
-              raise Ace::Runtime::RuntimeUnavailableError, "cleanup reply EOF deadline expired"
-            end
-            byte = socket.read_nonblock(1, exception: false)
-            next if byte == :wait_readable
-            raise SecurityError, "cleanup reply has trailing bytes" unless byte.nil?
-            return
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/molecules/protected_cleanup_owner_identity.rb

@@ -1,239 +0,0 @@
-# frozen_string_literal: true
-
-require "fiddle"
-require "socket"
-require "ace/runtime/molecules/process_identity"
-require "ace/runtime/molecules/systemd_scope_manager"
-require "ace/runtime/molecules/protected_artifact_set"
-
-module Ace
-  module Lab
-    module Molecules
-      # Only trusted accepted-release composition constructs this observer.
-      # Root policy is fixed here; ordinary ProtectedLinux stays all-zero.
-      class ProtectedCleanupOwnerIdentity
-        Runtime = Ace::Runtime::Molecules
-        Unavailable = Ace::Runtime::RuntimeUnavailableError
-        DISABLE = "--disable=gems,rubyopt,did_you_mean,error_highlight,syntax_suggest"
-        UNIT_FIELDS = {"Id" => "s", "LoadState" => "s", "ActiveState" => "s", "SubState" => "s",
-          "InvocationID" => "ay", "FragmentPath" => "s", "DropInPaths" => "as"}.freeze
-        EMPTY_COMMANDS = %w[ExecConditionEx ExecStartPreEx ExecStartPostEx ExecReloadEx ExecStopEx ExecStopPostEx].freeze
-        ENVIRONMENT = %w[PATH=/usr/bin:/bin LANG=C LC_ALL=C HOME=/root].freeze
-        MANAGER_ENVIRONMENT = %w[PATH LANG LANGUAGE LC_ALL LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY
-          LC_MESSAGES LC_PAPER LC_NAME LC_ADDRESS LC_TELEPHONE LC_MEASUREMENT LC_IDENTIFICATION].freeze
-        ENVIRONMENT_FIELDS = {"Environment" => "as", "EnvironmentFiles" => "a(sb)", "PassEnvironment" => "as",
-          "UnsetEnvironment" => "as", "PAMName" => "s"}.freeze
-        SERVICE_FIELDS = {**ENVIRONMENT_FIELDS, **EMPTY_COMMANDS.to_h { |key| [key, "a(sasasttttuii)"] }, "Slice" => "s", "Type" => "s", "MainPID" => "u", "ControlPID" => "u", "ExecStartEx" => "a(sasasttttuii)"}.freeze
-
-        class Kernel
-          def initialize(identity: Runtime::ProcessIdentity.new, pidfd_open: nil)
-            @identity = identity
-            @pidfd_open = pidfd_open || method(:open_pidfd)
-          end
-
-          def capture(pid)
-            raise Unavailable, "root owner requires Linux" unless RUBY_PLATFORM.include?("linux") && File.binread("/proc/sys/kernel/yama/ptrace_scope", 128).strip == "2"
-            unless pid.is_a?(Integer) && pid.positive?
-              raise Unavailable, "root owner PID is unavailable"
-            end
-            birth = @identity.send(:native_birth, pid)
-            raise Unavailable, "root owner birth is unavailable" unless birth
-            bytes = File.binread("/proc/#{pid}/status", 65_537)
-            raise Unavailable, "root owner status is oversized" if bytes.bytesize > 65_536
-            fields = bytes.lines.to_h { |line| line.strip.split(/:\s*/, 2) }
-            ids = %w[Uid Gid].map { |key| fields.fetch(key).split.map { |id| Integer(id, 10) } }
-            caps = %w[CapInh CapPrm CapEff CapBnd CapAmb].map { |key| Integer(fields.fetch(key), 16) }
-            groups = fields.fetch("Groups").split.map { |id| Integer(id, 10) }.sort
-            unless ids.all? { |value| value == [0, 0, 0, 0] } && groups == [0] &&
-                caps == [0, 2, 2, 2, 0] && fields.fetch("NoNewPrivs") == "1" &&
-                @identity.send(:native_birth, pid) == birth
-              raise Unavailable, "root owner kernel policy differs"
-            end
-            {"pid" => pid, "uid" => 0, "gid" => 0, "groups" => groups,
-              "started_at" => birth, "host" => Socket.gethostname,
-              "parent_pid" => Integer(fields.fetch("PPid"), 10)}
-          rescue IOError, SystemCallError, KeyError, ArgumentError
-            raise Unavailable, "root owner kernel policy is unavailable"
-          end
-
-          def pin(identity)
-            handle = @pidfd_open.call(identity.fetch("pid"))
-            unless handle.is_a?(IO) && !handle.closed?
-              raise Unavailable, "root owner pidfd is unavailable"
-            end
-            unless capture(identity.fetch("pid")) == identity
-              raise Unavailable, "root owner changed during pin acquisition"
-            end
-            handle
-          rescue Fiddle::DLError, SystemCallError, IOError
-            handle.close if handle.is_a?(IO) && !handle.closed?
-            raise Unavailable, "root owner pidfd capability is unavailable"
-          rescue Exception
-            handle.close if handle.is_a?(IO) && !handle.closed?
-            raise
-          end
-
-          def open_pidfd(pid)
-            function = Fiddle::Function.new(Fiddle::Handle::DEFAULT["pidfd_open"],
-              [Fiddle::TYPE_INT, Fiddle::TYPE_INT], Fiddle::TYPE_INT)
-            fd = function.call(pid, 0)
-            raise Unavailable, "root owner pidfd is unavailable" if fd.negative?
-            IO.for_fd(fd, autoclose: true)
-          end
-          private :open_pidfd
-
-          def exited?(handle) = !IO.select([handle], nil, nil, 0).nil?
-
-          def peer(socket)
-            raise Unavailable, "root peer requires Linux" unless RUBY_PLATFORM.include?("linux")
-            socket.getsockopt(Socket::SOL_SOCKET, Socket::SO_PEERCRED).data.unpack("i!3")
-          end
-        end
-
-        def initialize(unit:, slice_unit:, entry:, interpreter:, closure:, load_paths:, manager:, kernel: Kernel.new, artifacts: nil)
-          unless unit.is_a?(String) && Runtime::SystemdScopeManager::UNIT.match?(unit) && unit.end_with?(".service") &&
-              slice_unit.is_a?(String) && Runtime::SystemdScopeManager::UNIT.match?(slice_unit) && slice_unit.end_with?(".slice") &&
-              !%w[system.slice user.slice machine.slice].include?(slice_unit) &&
-              closure.is_a?(Array) && closure.size.between?(1, 4094) &&
-              load_paths.is_a?(Array) && load_paths.size.between?(1, 64) && load_paths.uniq == load_paths &&
-              load_paths.all? { |path| path.is_a?(String) && path.start_with?("/") && !path.include?("\0") && !path.include?(":") && File.expand_path(path) == path }
-            raise ArgumentError, "cleanup identity requires a fixed accepted-release selection"
-          end
-          @unit = unit.dup.freeze
-          @slice_unit = slice_unit.dup.freeze
-          @references = [entry, interpreter, *closure].map { |ref| reference(ref) }.freeze
-          unless @references.map { |ref| ref.fetch("path") }.uniq.size == @references.size
-            raise ArgumentError, "cleanup closure has duplicate references"
-          end
-          unless load_paths.all? { |path| @references.any? { |ref| ref.fetch("path").start_with?(path + "/") } }
-            raise ArgumentError, "cleanup load path is outside the held closure"
-          end
-          @entry, @interpreter = @references.first(2)
-          @argv = [@interpreter.fetch("path"), DISABLE, "-I", load_paths.join(":"), @entry.fetch("path")].freeze
-          unless @argv.sum { |argument| argument.bytesize + 1 } <= 16_384
-            raise ArgumentError, "cleanup startup arguments exceed bound"
-          end
-          @manager, @kernel = manager, kernel
-          @verification = Mutex.new
-          @artifacts = artifacts || Runtime::ProtectedArtifactSet.new(file_limit: 32 * 1_048_576,
-            total_limit: 256 * 1_048_576, count_limit: 4096)
-        end
-
-        def observe!(socket:, deadline: Runtime::ProtectedSocket.deadline(5))
-          with_verification do
-            observe_held!(deadline: deadline, peer_join: ->(identity) {
-              @kernel.peer(socket) == [identity.fetch("pid"), 0, 0]
-            })
-          end
-        end
-
-        # Only the immutable installed listener calls this entrypoint. Its
-        # positive receiver peer is not the root process being measured.
-        def observe_self!(deadline: Runtime::ProtectedSocket.deadline(5))
-          pid = Process.pid
-          with_verification do
-            observe_held!(deadline: deadline, peer_join: ->(identity) {
-              identity.fetch("pid") == pid
-            })
-          end
-        end
-
-        def with_verification
-          unless @verification.try_lock
-            raise Unavailable, "cleanup identity verification is busy"
-          end
-          begin
-            yield
-          ensure
-            @verification.unlock
-          end
-        end
-        private :with_verification
-
-        def observe_held!(deadline:, peer_join:)
-          now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-          unless deadline.is_a?(Numeric) && deadline.finite? && deadline > now
-            raise Unavailable, "cleanup identity observation deadline expired"
-          end
-          deadline = [deadline, now + 5].min
-          before = snapshot(deadline)
-          identity = @kernel.capture(before.fetch("MainPID"))
-          handle = @kernel.pin(identity)
-          @artifacts.with do |artifacts|
-            @references.each { |ref| artifacts.read!(ref) }
-            unless @references.any? { |ref| ref.fetch("path") == before.fetch("FragmentPath") }
-              raise Unavailable, "installed cleanup unit is outside the held closure"
-            end
-            join = @manager.unit_for_pidfd(handle: handle, timeout: remaining(deadline))
-            unless join == {"unit" => @unit, "invocation_id" => before.fetch("InvocationID")} &&
-                peer_join.call(identity) && !@kernel.exited?(handle) &&
-                @kernel.capture(identity.fetch("pid")) == identity && snapshot(deadline) == before
-              raise Unavailable, "cleanup peer differs from the original installed invocation"
-            end
-            artifacts.verify_unchanged!
-            unless !@kernel.exited?(handle) && @kernel.capture(identity.fetch("pid")) == identity &&
-                @manager.unit_for_pidfd(handle: handle, timeout: remaining(deadline)) == join
-              raise Unavailable, "cleanup owner changed after held source verification"
-            end
-            deep_freeze({"unit" => @unit, "invocation_id" => join.fetch("invocation_id"),
-              "process_binding" => identity, "entry_sha256" => @entry.fetch("sha256")})
-          end
-        ensure
-          handle&.close
-        end
-        private :observe_held!
-
-        private
-
-        def snapshot(deadline)
-          unit = @manager.typed_properties(unit: @unit, interface: "Unit", signatures: UNIT_FIELDS, timeout: remaining(deadline))
-          service = @manager.typed_properties(unit: @unit, interface: "Service", signatures: SERVICE_FIELDS, timeout: remaining(deadline))
-          environment = @manager.manager_environment(timeout: remaining(deadline))
-          unless environment.is_a?(Array) && environment.all? { |entry| entry.is_a?(String) && MANAGER_ENVIRONMENT.include?(entry.split("=", 2).first) } &&
-              service.fetch("Environment").sort == ENVIRONMENT.sort &&
-              %w[EnvironmentFiles PassEnvironment UnsetEnvironment].all? { |key| service.fetch(key) == [] } && service.fetch("PAMName") == ""
-            raise Unavailable, "cleanup original startup environment differs"
-          end
-          start = service.fetch("ExecStartEx")
-          unless unit.values_at("Id", "LoadState", "ActiveState", "SubState", "DropInPaths") == [@unit, "loaded", "active", "running", []] &&
-              unit.fetch("InvocationID").match?(/\A[0-9a-f]{32}\z/) && unit.fetch("InvocationID") != "0" * 32 &&
-              service.fetch("Slice") == @slice_unit &&
-              EMPTY_COMMANDS.all? { |key| service[key] == [] } && service.fetch("Type") == "exec" && service.fetch("MainPID").is_a?(Integer) && service.fetch("MainPID").positive? &&
-              service.fetch("ControlPID") == 0 && start.is_a?(Array) && start.size == 1 &&
-              start[0][0] == @interpreter.fetch("path") && start[0][1] == @argv && start[0][2] == [] &&
-              start[0][3].positive? && start[0][7] == service.fetch("MainPID") && start[0][8..9] == [0, 0]
-            raise Unavailable, "cleanup unit execution-start configuration differs"
-          end
-          unit.merge(service).merge("EffectiveManagerEnvironment" => environment)
-        rescue KeyError, NoMethodError, TypeError
-          raise Unavailable, "cleanup unit execution facts are unavailable"
-        end
-
-        def remaining(deadline)
-          value = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
-          raise Unavailable, "cleanup identity observation deadline expired" unless value.positive?
-          [value, 5].min
-        end
-
-        def reference(ref)
-          unless ref.is_a?(Hash) && ref.keys.sort == %w[bytes path sha256] &&
-              ref["path"].is_a?(String) && ref["path"].start_with?("/") && !ref["path"].include?("\0") && File.expand_path(ref["path"]) == ref["path"] &&
-              ref["sha256"].is_a?(String) && ref["sha256"].match?(/\A[0-9a-f]{64}\z/) &&
-              ref["bytes"].is_a?(Integer) && ref["bytes"].between?(1, 32 * 1_048_576)
-            raise ArgumentError, "cleanup closure reference is malformed"
-          end
-          deep_freeze(ref)
-        end
-
-        def deep_freeze(value)
-          case value
-          when Hash then value.to_h { |key, item| [key.dup.freeze, deep_freeze(item)] }.freeze
-          when Array then value.map { |item| deep_freeze(item) }.freeze
-          when String then value.dup.freeze
-          else value.freeze
-          end
-        end
-      end
-    end
-  end
-end