ace-lab 0.8.0 → 0.13.0

data/lib/ace/lab/molecules/service_policy.rb

@@ -1,289 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "../errors"
-require_relative "../atoms/service_input"
-require "ace/assign/errors"
-require "pathname"
-require "time"
-
-module Ace
-  module Lab
-    module Molecules
-      # Deployment-owned operation and authorization facts. The caller may
-      # name a reference but cannot define its scope or executor binding.
-      class ServicePolicy
-        NAME = /\A[a-z][a-z0-9-]{0,63}\z/
-        ID = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/
-
-        def initialize(document, proposal_resolver = nil)
-          @document = document
-          @operations = document.fetch("operations", {})
-          @authorizations = document.fetch("authorizations", {})
-          @proposal_resolver = proposal_resolver
-          unless @operations.is_a?(Hash) && @authorizations.is_a?(Hash)
-            raise Ace::Lab::InvalidConfigurationError, "trusted service policy must contain mappings"
-          end
-        end
-
-        # The trusted installation document as loaded. Decisions are mutable;
-        # all other configuration remains bound for the receiver lifetime.
-        attr_reader :document
-
-        def self.configuration_digest(document)
-          Atoms::ServiceInput.digest(document.except("authorizations"))
-        end
-
-        def operation!(name, project:, service_id:)
-          raise ArgumentError, "invalid operation name" unless name.to_s.match?(NAME)
-          operation = @operations[name]
-          raise SecurityError, "operation is not configured" unless operation.is_a?(Hash)
-          unless operation["project"] == project && operation["service_id"] == service_id
-            raise SecurityError, "operation does not authorize the selected service in this project"
-          end
-          transport = operation.fetch("transport", "local")
-          unless %w[local unix].include?(transport)
-            raise Ace::Lab::InvalidConfigurationError, "configured service transport is invalid"
-          end
-          if transport == "local"
-            argv = operation["argv"]
-            unless argv.is_a?(Array) && !argv.empty? && argv.all? { |v| v.is_a?(String) && !v.empty? } &&
-                argv.first.start_with?("/") && File.file?(argv.first) && File.executable?(argv.first)
-              raise Ace::Lab::InvalidConfigurationError, "configured operation needs a fixed executable argv"
-            end
-          elsif !operation["socket_path"].is_a?(String) || !operation["socket_path"].start_with?("/")
-            raise Ace::Lab::InvalidConfigurationError, "unix service needs an absolute socket path"
-          end
-          uid = operation["executor_uid"]
-          raise Ace::Lab::InvalidConfigurationError, "configured executor UID is invalid" unless uid.is_a?(Integer) && uid >= 0
-          if transport == "local"
-            # Every path component is validated (symlinks resolved, writable
-            # ancestors rejected) and the validated resolved file replaces
-            # the configured argv entry, so execution cannot be redirected
-            # between validation and dispatch.
-            resolved = trusted_executable!(operation["argv"].first, uid)
-            operation = operation.merge("argv" => [resolved] + operation["argv"][1..])
-          end
-          expires_at = parse_time(operation["lease_expires_at"])
-          raise SecurityError, "executor lease has expired" if expires_at <= Time.now.utc
-          if operation["host_maintenance"] == true
-            # Maintenance executes a fixed updater outside the replaced
-            # deployment; a socket-only operation has no executable to place
-            # and cannot prove the maintenance boundary.
-            unless transport == "local"
-              raise Ace::Lab::InvalidConfigurationError,
-                "host maintenance requires a local executable transport"
-            end
-            deployment_root = operation["deployment_root"].to_s
-            sink_path = operation["evidence_sink"].to_s
-            unless deployment_root.start_with?("/") && sink_path.start_with?("/")
-              raise Ace::Lab::InvalidConfigurationError,
-                "host maintenance needs absolute deployment and evidence sink paths"
-            end
-            deployment = resolved_path(deployment_root)
-            sink = resolved_path(sink_path)
-            executable = operation.dig("argv", 0).to_s
-            unless deployment.start_with?("/") && sink.start_with?("/") && executable.start_with?("/") &&
-                !inside?(executable, deployment) && !inside?(sink, deployment)
-              raise Ace::Lab::InvalidConfigurationError,
-                "host maintenance needs executable and evidence sink outside the replaced deployment"
-            end
-          end
-          operation
-        end
-
-        def authorize!(reference, binding)
-          raise ArgumentError, "invalid authorization reference" unless reference.to_s.match?(ID)
-          if reference.start_with?("proposal-")
-            raise SecurityError, "canonical proposal authority is unavailable" unless @proposal_resolver
-            begin
-              return @proposal_resolver.call(reference, binding)
-            rescue Ace::Assign::Error
-              raise SecurityError, "canonical proposal does not authorize this exact effect"
-            end
-          end
-          decision = @authorizations[reference]
-          raise SecurityError, "authorization reference is unresolved" unless decision.is_a?(Hash)
-          required = %w[operation project_id assignment_id attempt_id input_digest target candidate_head caller_uid]
-          unless required.all? { |key| decision[key] == binding[key] }
-            raise SecurityError, "authorization does not match the exact service request"
-          end
-          raise SecurityError, "authorization has expired" if parse_time(decision["expires_at"]) <= Time.now.utc
-          decision
-        end
-
-        # ---- ordinary fixed merge admission policy (spec 8x3.t.xz9.4) ------
-        #
-        # The installed ordinary section is the separately configured
-        # ordinary receiver mapping and admission policy. It supplies
-        # identity and placement only: the caller selects no endpoint,
-        # credential or receiver. An absent project section or a disabled
-        # admission flag is rollback: new admission is unavailable while
-        # canonical records and read-only status stay preserved.
-        ORDINARY_SECTION_KEYS = %w[projects].freeze
-        ORDINARY_PROJECT_KEYS = %w[receiver_id socket_path receiver_uid principal admission journal_repository journal_ref].freeze
-        ORDINARY_AUTHORIZATION_KEYS = %w[operation project_id assignment_id attempt_id queue_entry
-          input_digest forge pr_url head_repository head_ref candidate_head base_repository
-          base_ref expected_base_head expires_at].freeze
-        # expires_at bounds the decision itself; it is never exact-matched
-        # against the request binding, which carries no expiry.
-        ORDINARY_BINDING_KEYS = ORDINARY_AUTHORIZATION_KEYS - %w[expires_at].freeze
-
-        def ordinary_receiver!(project)
-          section = @document["ordinary"]
-          return nil unless section.is_a?(Hash)
-          validate_ordinary_section!(section)
-          entry = section.fetch("projects")[project.to_s]
-          return nil unless entry.is_a?(Hash)
-          entry
-        end
-
-        # The ordinary admission decision: exact-match on every closed
-        # binding key, like authorize!, but over the ordinary request
-        # identity (forge/PR/repository/ref) instead of execution selectors.
-        def authorize_ordinary!(reference, binding)
-          raise ArgumentError, "invalid authorization reference" unless reference.to_s.match?(ID)
-          decision = @authorizations[reference]
-          raise SecurityError, "authorization reference is unresolved" unless decision.is_a?(Hash)
-          unless ORDINARY_AUTHORIZATION_KEYS.all? { |key| decision.key?(key) }
-            raise SecurityError, "authorization reference is not an ordinary merge decision"
-          end
-          unless ORDINARY_BINDING_KEYS.all? { |key| decision[key] == binding[key] }
-            raise SecurityError, "authorization does not match the exact ordinary merge request"
-          end
-          raise SecurityError, "authorization has expired" if parse_time(decision["expires_at"]) <= Time.now.utc
-          decision
-        end
-
-        def validate_ordinary_section!(section)
-          unless (section.keys - ORDINARY_SECTION_KEYS).empty? && section["projects"].is_a?(Hash)
-            raise Ace::Lab::InvalidConfigurationError, "ordinary section must map projects"
-          end
-          section.fetch("projects").each do |project, entry|
-            unless project.is_a?(String) && project.match?(ID) && entry.is_a?(Hash) &&
-                (entry.keys - ORDINARY_PROJECT_KEYS).empty?
-              raise Ace::Lab::InvalidConfigurationError, "ordinary project section is invalid"
-            end
-            unless entry["receiver_id"].is_a?(String) && entry["receiver_id"].match?(ID) &&
-                entry["socket_path"].is_a?(String) && entry["socket_path"].start_with?("/") &&
-                entry["receiver_uid"].is_a?(Integer) && entry["receiver_uid"].positive? &&
-                entry["principal"].is_a?(String) && !entry["principal"].empty?
-              raise Ace::Lab::InvalidConfigurationError, "ordinary receiver mapping is incomplete"
-            end
-            admission = entry.fetch("admission", "enabled")
-            unless %w[enabled disabled].include?(admission)
-              raise Ace::Lab::InvalidConfigurationError, "ordinary admission flag is invalid"
-            end
-            repository, ref = entry.values_at("journal_repository", "journal_ref")
-            unless repository.is_a?(String) && repository.start_with?("/") && !repository.include?("\0") &&
-                File.expand_path(repository) == repository &&
-                ref.is_a?(String) && ref.match?(%r{\Arefs/[a-zA-Z0-9_-]+(?:/[a-zA-Z0-9_-]+)+\z})
-              raise Ace::Lab::InvalidConfigurationError, "ordinary journal selection is invalid"
-            end
-          end
-          true
-        end
-
-        # Inspection never renews effect permission or selects effect argv.
-        def inspection!(name, project:, service_id:, executor_uid:)
-          raise ArgumentError, "invalid inspection operation" unless name.is_a?(String) && name.match?(NAME)
-          operation = @operations[name]
-          unless operation.is_a?(Hash) && operation["project"] == project && operation["service_id"] == service_id &&
-              operation["executor_uid"].is_a?(Integer) && operation["executor_uid"] == executor_uid &&
-              operation.fetch("transport", "local") == "local"
-            raise SecurityError, "inspection does not match the selected original executor"
-          end
-          # This source-composed inspector uses the fixed original root SDK;
-          # configured handler argv cannot select or replace that owner.
-          if name == "prune-preserved-workspace"
-            return {"executor_uid" => executor_uid, "operation" => name}
-          end
-          argv = operation["no_effect_argv"]
-          unless argv.is_a?(Array) && argv.length.between?(1, 16) &&
-              argv.all? { |value| value.is_a?(String) && value.bytesize.between?(1, 1024) && !value.include?("\0") } &&
-              argv.first.start_with?("/")
-            raise Ace::Lab::InvalidConfigurationError, "operation has no fixed no-effect inspector"
-          end
-          executable = trusted_executable!(argv.first, executor_uid)
-          {"executor_uid" => executor_uid, "argv" => [executable] + argv.drop(1)}
-        end
-
-        private
-
-        # Validate the executable and every directory component on its
-        # resolved path: each must be owned by root or the executor and not
-        # group/other-writable, so no ancestor or symlink component can
-        # redirect the fixed argv. Returns the resolved file path.
-        def trusted_executable!(path, uid)
-          resolved = resolved_path(path.to_s)
-          unless resolved.start_with?("/") && File.file?(resolved) && File.executable?(resolved)
-            raise Ace::Lab::InvalidConfigurationError, "configured executable is unavailable"
-          end
-          Pathname.new(resolved).descend do |component|
-            stat = File.stat(component)
-            unless [0, uid].include?(stat.uid) && (stat.mode & 0o022).zero?
-              raise Ace::Lab::InvalidConfigurationError,
-                "configured executable path has a writable or foreign-owned component: #{component}"
-            end
-          end
-          resolved
-        rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
-          raise Ace::Lab::InvalidConfigurationError, "configured executable is unavailable"
-        end
-
-        def inside?(path, root)
-          expanded = File.expand_path(path)
-          base = File.expand_path(root)
-          expanded == base || expanded.start_with?(base + File::SEPARATOR)
-        end
-
-        # Resolve a configured path through symlinks so placement checks see
-        # the real location. Paths may not exist yet (an evidence sink is
-        # created on first use), so the deepest ancestor — counting symlink
-        # components themselves via lstat — is resolved instead of failing;
-        # a dangling symlink resolves through its own target chain rather
-        # than hiding behind its parent.
-        MAX_SYMLINK_DEPTH = 16
-
-        def resolved_path(path, depth = 0)
-          raise Ace::Lab::InvalidConfigurationError, "trusted policy path has a symlink cycle" if depth > MAX_SYMLINK_DEPTH
-          expanded = File.expand_path(path)
-          candidate = expanded
-          candidate = File.dirname(candidate) until candidate == "/" || lstat?(candidate)
-          resolved = begin
-            File.realpath(candidate)
-          rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
-            dangling_target(candidate, depth) || candidate
-          end
-          return resolved unless resolved == candidate && lstat?(candidate) && File.symlink?(candidate)
-          dangling_target(candidate, depth) || resolved
-        rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
-          expanded
-        end
-
-        # Follow a dangling symlink's own target chain; nil when the link
-        # cannot be resolved to any concrete location.
-        def dangling_target(link, depth = 0)
-          raise Ace::Lab::InvalidConfigurationError, "trusted policy path has a symlink cycle" if depth > MAX_SYMLINK_DEPTH
-          target = File.readlink(link)
-          target = File.expand_path(target, File.dirname(link)) unless Pathname.new(target).absolute?
-          resolved_path(target, depth + 1)
-        rescue Errno::ENOENT, Errno::EACCES
-          nil
-        end
-
-        def lstat?(path)
-          File.lstat(path)
-          true
-        rescue Errno::ENOENT
-          false
-        end
-
-        def parse_time(value)
-          Time.iso8601(value.to_s)
-        rescue ArgumentError
-          raise Ace::Lab::InvalidConfigurationError, "trusted policy has invalid expiry"
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/organisms/authority_composition.rb

@@ -1,87 +0,0 @@
-# frozen_string_literal: true
-
-require "ace/assign/authority/server"
-require "ace/assign/authority/router"
-require "ace/assign/authority/launch_lifecycle"
-require "ace/assign/authority/endcap"
-require_relative "../molecules/protected_service_policy"
-require "ace/hitl/providers/lab"
-require "ace/hitl/providers/lab/protected_assignment_binding"
-require "ace/hitl/lifecycle/service_publication_binding"
-require "ace/hitl/lifecycle/service"
-
-module Ace
-  module Lab
-    module Organisms
-      # The only full-service composition. The deployed map chooses identity
-      # and placement; source selects all handlers, policy and evidence readers.
-      class AuthorityComposition
-        REQUIRED_ENDCAP = %w[submit_candidate export_candidate assign_review accept_review request_service
-          begin_dispatch publication_challenge publication_continue claim_service_settlement complete_service complete_no_effect submit_result finish recover bind_inbox
-          service_status evidence_fetch].freeze
-
-        def initialize(authority_id:, deployment: Ace::Assign::Authority::Deployment.load,
-          kernel: Ace::Runtime::Molecules::ProtectedLinux.new)
-          @authority_id, @deployment, @kernel = authority_id, deployment, kernel
-        end
-
-        def build
-          @deployment.verify_composition!(@authority_id, composition: "services")
-          unless (REQUIRED_ENDCAP - Ace::Assign::Authority::Endcap::OPERATIONS).empty?
-            raise InvalidConfigurationError, "full-service source composition is incomplete"
-          end
-          projects = @deployment.data.fetch("launch_mappings").values
-            .select { |map| map.fetch("authority_id") == @authority_id }.map { |map| map.fetch("project_id") }.uniq
-          raise InvalidConfigurationError, "full-service authority has no projects" if projects.empty?
-          projects.each do |id|
-            project = @deployment.project(id)
-            unless project["service_receivers"].is_a?(Hash) && !project["service_receivers"].empty?
-              raise InvalidConfigurationError, "full-service project has no fixed receiver"
-            end
-          end
-
-          journals = {}
-          endcap = nil
-          projects.each do |id|
-            project = @deployment.project(id)
-            reader = nil
-            journal = Ace::Assign::Molecules::EvidenceJournal.new(repo_root: project.fetch("journal_repository"),
-              checkout_root: project.fetch("evidence_checkout_root"), ref: project.fetch("evidence_git_ref"), mode: :protected,
-              evidence_reader: ->(reference, record, state, pending) { reader.call(reference, record, state, pending) },
-              service_authorizer: ->(existing, replacement, pending) {
-                endcap.authorize_service_update!(journal: journals.fetch(id), existing: existing,
-                  replacement: replacement, pending: pending)
-              })
-            reader = Ace::Assign::Authority::ServiceEvidence.new(journal: journal)
-            journals[id] = journal
-          end
-          policy = Molecules::ProtectedServicePolicy.new(proposal_resolver: ->(project, reference, binding) {
-            journals.fetch(project).proposal_authorize!(reference, binding)
-          })
-          history = Ace::Assign::Authority::DeploymentHistory.load
-          launch = Ace::Assign::Authority::LaunchLifecycle.new(deployment: @deployment, deployment_history: history,
-            kernel: @kernel, journals: journals)
-          endcap = Ace::Assign::Authority::Endcap.new(deployment: @deployment, launch: launch, kernel: @kernel,
-            service_policy: policy, deployment_history: history)
-          router = Ace::Assign::Authority::Router.new(launch: launch, handlers: [endcap])
-          Ace::Assign::Authority::Server.new(authority_id: @authority_id, deployment: @deployment, kernel: @kernel,
-            lifecycle: router, composition: "services", services: [publication_hitl(endcap, journals)])
-        end
-
-        private
-
-        def publication_hitl(endcap, journals)
-          provider = Ace::Hitl::Providers::Lab
-          policy = provider.grants_policy(grants_path: provider::DEFAULT_GRANTS_PATH)
-          unless policy.service_uid == @deployment.authority(@authority_id).fetch("uid")
-            raise InvalidConfigurationError, "protected HITL service principal differs from installed authority"
-          end
-          ordinary = provider::ProtectedAssignmentBinding.new(authority: endcap, kernel: @kernel, journals: journals)
-          binding = Ace::Hitl::Lifecycle::ServicePublicationBinding.new(ordinary: ordinary, authority: endcap, kernel: @kernel)
-          Ace::Hitl::Lifecycle::Service.new(root: provider::DEFAULT_STORE_ROOT,
-            socket_path: provider::DEFAULT_SOCKET_PATH, binding: binding, policy: policy)
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/organisms/ordinary_assignment_client.rb

@@ -1,149 +0,0 @@
-# frozen_string_literal: true
-
-require "securerandom"
-require "ace/assign/authority/ordinary_client"
-require "ace/assign/authority/ordinary_lifecycle"
-require "ace/assign/organisms/prepared_work_builder"
-require_relative "../molecules/ordinary_owner_config"
-
-module Ace
-  module Lab
-    module Organisms
-      # File inputs retain the exact mutation and bytes across response loss.
-      # Only Assign's installed owner registers, advances and accepts execution.
-      class OrdinaryAssignmentClient
-        A = Ace::Assign::Authority
-        REQUEST_KEYS = %w[version project_id operation mutation_id params parts].freeze
-
-        def initialize(project:, config: nil, client_factory: nil)
-          @project = project
-          @config = config || Molecules::OrdinaryOwnerConfig.load(project: project)
-          unless @config.is_a?(Molecules::OrdinaryOwnerConfig) && @config.project == project
-            raise ArgumentError, "ordinary assignment project selection differs"
-          end
-          @client_factory = client_factory || ->(**options) { A::OrdinaryClient.new(**options) }
-        end
-
-        # Preparation produces input only, so it is also available on the host.
-        # Reusing an existing output directory never rebuilds or resubmits work.
-        def self.prepare(project:, task:, pane:, output:, dependency_reports: [])
-          unless project.is_a?(String) && Molecules::OrdinaryOwnerConfig::ID.match?(project) &&
-              pane.is_a?(String) && Molecules::OrdinaryOwnerConfig::PANE.match?(pane)
-            raise ArgumentError, "preparation requires project and native pane selectors"
-          end
-          directory = create_output(output)
-          prepared = Ace::Assign::Organisms::PreparedWorkBuilder.new(export_root: directory)
-            .call(task_ref: task, project_id: project, dependency_reports: dependency_reports)
-          definition = JSON.parse(prepared.fetch("definition_bytes"))
-          reference = definition.fetch("prepared_work")
-          request = {"version" => 1, "project_id" => project, "operation" => "register_assignment",
-            "mutation_id" => SecureRandom.hex(16), "params" => {
-              "assignment_id" => prepared.fetch("assignment_id"), "pane" => pane, "expected_generation" => 0,
-              "definition_digest" => Digest::SHA256.hexdigest(prepared.fetch("definition_bytes")),
-              "prepared_head" => prepared.fetch("head"), "prepared_tree" => prepared.fetch("tree"),
-              "manifest_sha256" => reference.fetch("manifest_sha256")},
-            "parts" => [{"file" => "prepared.bundle", "bytes" => prepared.fetch("bytes"), "sha256" => prepared.fetch("sha256")}]}
-          write_file(directory, "definition.json", prepared.fetch("definition_bytes"))
-          write_file(directory, "prepared.bundle", prepared.fetch("bundle"))
-          write_file(directory, "request.json", JSON.generate(request) + "\n")
-          {"project_id" => project, "assignment_id" => prepared.fetch("assignment_id"),
-            "scope" => prepared.fetch("scope"), "request" => File.join(directory, "request.json"), "prepared" => true}
-        end
-
-        def request(input:, output: nil)
-          request = JSON.parse(self.class.read_file(input, 16_384), allow_duplicate_key: false, create_additions: false, max_nesting: 24)
-          unless request.is_a?(Hash) && request.keys.sort == REQUEST_KEYS.sort && request["version"].is_a?(Integer) && request["version"] == 1 &&
-              request["project_id"] == @project && A::OrdinaryLifecycle::OPERATIONS.include?(request["operation"]) &&
-              request["params"].is_a?(Hash) && !request["params"].key?("transfer") && request["parts"].is_a?(Array)
-            raise ArgumentError, "retained ordinary request selection is invalid"
-          end
-          operation = request.fetch("operation")
-          read = %w[registration_status assignment_snapshot result_status result_snapshot].include?(operation)
-          mutation = request.fetch("mutation_id")
-          unless read ? mutation.nil? : mutation.is_a?(String) && Ace::Assign::Molecules::JournalMutation::ID.match?(mutation)
-            raise ArgumentError, "retained mutation ID must be explicit; read operations require null"
-          end
-          transfer = A::OrdinaryLifecycle::TRANSFER_OPERATIONS[operation]
-          download = transfer && transfer.fetch(:direction) == :download
-          upload = transfer && transfer.fetch(:direction) == :upload
-          unless (!!output == !!download) && (request["parts"].empty? || upload)
-            raise ArgumentError, "download requires a new --output directory; only uploads accept parts"
-          end
-          parts = upload && read_parts(request.fetch("parts"), input, transfer.fetch(:purpose))
-          # No local metadata is interpreted as successful execution. Download
-          # files are merely a projection of the authenticated canonical reply.
-          directory = download && self.class.create_output(output)
-          client = @client_factory.call(project_id: @project, service: @config.service,
-            verify_selection: @config.method(:verify_owner!), scratch_root: directory || nil)
-          reply = client.call(operation, request.fetch("params"), mutation_id: request.fetch("mutation_id"),
-            upload_parts: parts || nil, download: !!download, purpose: transfer && transfer.fetch(:purpose))
-          envelope = {"status" => "ok", "data" => reply.data, "transport" => {"replayed" => reply.replayed}}
-          if download
-            files = reply.parts.each_with_index.map do |bytes, index|
-              name = format("part-%02d.bytes", index)
-              self.class.write_file(directory, name, bytes)
-              {"file" => File.join(directory, name), "bytes" => bytes.bytesize, "sha256" => Digest::SHA256.hexdigest(bytes)}
-            end
-            envelope["files"] = files
-            self.class.write_file(directory, "response.json", JSON.generate(envelope) + "\n")
-          end
-          envelope
-        rescue JSON::ParserError
-          raise ArgumentError, "retained request is not valid bounded JSON"
-        end
-
-        def self.read_file(path, limit)
-          File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
-            before = file.stat
-            raise ArgumentError, "retained input is not a bounded regular file" unless before.file? && before.size.between?(0, limit)
-            bytes = (file.read(limit + 1) || "").b
-            after, selected = file.stat, File.lstat(path)
-            identity = ->(stat) { [stat.dev, stat.ino, stat.size, stat.mtime, stat.ctime] }
-            unless bytes.bytesize == before.size && identity.call(before) == identity.call(after) &&
-                identity.call(after) == identity.call(selected) && !selected.symlink?
-              raise ArgumentError, "retained input changed during read"
-            end
-            bytes.freeze
-          end
-        end
-
-        def self.create_output(path)
-          raise ArgumentError, "output must be a new directory path" unless path.is_a?(String) && !path.empty?
-          directory = File.expand_path(path)
-          Dir.mkdir(directory, 0o700)
-          A::PrivateDirectory.verify!(directory)
-          directory
-        end
-
-        def self.write_file(directory, name, bytes)
-          File.open(File.join(directory, name), File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0o600) do |file|
-            file.write(bytes)
-            file.flush
-            file.fsync
-          end
-        end
-
-        private
-
-        def read_parts(entries, input, purpose)
-          total, count, per_part = A::TransferCodec::LIMITS.fetch(purpose)
-          unless entries.size.between?(1, count) && entries.all? { |entry|
-              entry.is_a?(Hash) && entry.keys.sort == %w[bytes file sha256] && entry["file"].is_a?(String) &&
-                entry["file"].bytesize.between?(1, 4096) && !entry["file"].include?("\0") &&
-                entry["bytes"].is_a?(Integer) && entry["bytes"].between?(0, per_part) &&
-                entry["sha256"].is_a?(String) && A::TransferCodec::SHA256.match?(entry["sha256"])
-            } && entries.sum { |entry| entry.fetch("bytes") } <= total
-            raise ArgumentError, "retained upload inventory is invalid"
-          end
-          entries.map do |entry|
-            bytes = self.class.read_file(File.expand_path(entry.fetch("file"), File.dirname(File.expand_path(input))), per_part)
-            unless bytes.bytesize == entry.fetch("bytes") && Digest::SHA256.hexdigest(bytes) == entry.fetch("sha256")
-              raise ArgumentError, "retained upload bytes changed; preserve the original mutation"
-            end
-            bytes
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/organisms/ordinary_authority_composition.rb

@@ -1,123 +0,0 @@
-# frozen_string_literal: true
-
-require "ace/assign/authority/ordinary_lifecycle"
-require "ace/assign/authority/ordinary_server"
-require "ace/assign/authority/router"
-require "ace/hitl/providers/lab"
-require "ace/hitl/lifecycle/service"
-require "ace/hitl/lifecycle/tls_authority"
-require "ace/hitl/lifecycle/tls_service"
-require_relative "../molecules/ordinary_owner_admission"
-require_relative "../molecules/ordinary_listener"
-require_relative "ordinary_merge_receiver"
-
-module Ace
-  module Lab
-    module Organisms
-      # Ordinary delivery has one installed journal writer and exclusion owner.
-      # Existing Assign, HITL and merge protocols share that process lifetime;
-      # no requester cache or daemon working directory chooses accepted state.
-      class OrdinaryAuthorityComposition
-        def initialize(receiver_config:, owner_config: nil)
-          unless receiver_config.is_a?(Molecules::OrdinaryReceiverConfig)
-            raise ArgumentError, "ordinary composition needs installed receiver selection"
-          end
-          @receiver = receiver_config
-          @config = owner_config || Molecules::OrdinaryOwnerConfig.load(project: @receiver.project)
-          unless @config.is_a?(Molecules::OrdinaryOwnerConfig)
-            raise ArgumentError, "ordinary composition needs installed assignment selection"
-          end
-        end
-
-        def build
-          @config.verify_listener!
-          policy_document = Molecules::GrantResolver.trusted_document(@receiver.policy_path)
-          verify_join!(policy_document)
-          admission = Molecules::OrdinaryOwnerAdmission.new(config: @config)
-          reader = nil
-          journal = Ace::Assign::Molecules::EvidenceJournal.new(repo_root: @config.journal.fetch("repository"),
-            ref: @config.journal.fetch("ref"), checkout_root: @config.journal.fetch("checkout_root"),
-            evidence_reader: ->(reference, record, state, pending) { reader.call(reference, record, state, pending) })
-          reader = Ace::Assign::Authority::ServiceEvidence.new(journal: journal)
-          exclusion = Ace::Assign::Molecules::LifecycleExclusion.new(root: @config.lifecycle_root)
-          coordinator = Ace::Assign::Organisms::AttemptCoordinator.new(cache_base: @config.assignment_root,
-            repo_root: @config.journal.fetch("repository"), journal: journal, lifecycle_exclusion: exclusion,
-            recorded_binding_observer: admission.method(:recorded_binding!))
-          lifecycle = Ace::Assign::Authority::OrdinaryLifecycle.new(project: @config.project,
-            admission: admission, journal: journal, exclusion: exclusion, input_root: @config.assignment_root)
-          router = Ace::Assign::Authority::Router.new(handlers: [lifecycle])
-          merge = OrdinaryMergeReceiver.new(config: @receiver, coordinator: coordinator,
-            policy_document: policy_document, owner_guard: -> { @config.selected_principal!(@receiver.principal_uid) },
-            merge_factory: ->(document) {
-              Molecules::OrdinaryMergeRead.new(repo_path: @receiver.repo_path, base_ref: document.fetch("base_ref"),
-                root: @receiver.repo_path, common_dir: @config.worktrees.fetch("common_dir"))
-            })
-          listener = Molecules::OrdinaryListener.new(socket_path: @receiver.socket_path,
-            peer_uid: @receiver.principal_uid, socket_gid: @receiver.socket_gid, handler: merge,
-            logger: ->(message) { warn message })
-          Ace::Assign::Authority::OrdinaryServer.new(admission: admission, lifecycle: router,
-            services: hitl_services(coordinator) + [listener])
-        end
-
-        private
-
-        def verify_join!(document)
-          configured = Molecules::ServicePolicy.new(document).ordinary_receiver!(@config.project)
-          expected = {"receiver_id" => @receiver.receiver_id, "socket_path" => @receiver.socket_path,
-            "receiver_uid" => @config.service.fetch("uid"), "principal" => @receiver.principal,
-            "journal_repository" => @config.journal.fetch("repository"), "journal_ref" => @config.journal.fetch("ref")}
-          unless @receiver.project == @config.project && @receiver.receiver_uid == @config.service.fetch("uid") &&
-              configured && configured.slice(*expected.keys) == expected &&
-              @config.participants.key?(@receiver.principal_uid.to_s) &&
-              ![@config.service.fetch("socket_path"), @config.native.fetch("socket_path"), @config.hitl.fetch("socket_path")].include?(@receiver.socket_path)
-            raise InvalidConfigurationError, "ordinary receiver and assignment owner selections differ"
-          end
-        end
-
-        def hitl_services(coordinator)
-          selected = @config.hitl
-          policy = Ace::Hitl::Providers::Lab.grants_policy(grants_path: selected.fetch("grants_path"))
-          unless policy.service_uid == @config.service.fetch("uid")
-            raise InvalidConfigurationError, "ordinary HITL service principal differs from assignment owner"
-          end
-          guard = lambda do
-            @config.verify_owner!
-            unless policy.service_uid == @config.service.fetch("uid")
-              raise Ace::Hitl::Lifecycle::BindingError, "installed HITL service principal changed"
-            end
-          rescue Ace::Lab::InvalidConfigurationError, Ace::Assign::Error => error
-            raise Ace::Hitl::Lifecycle::BindingError, error.message
-          end
-          binding = Ace::Hitl::Providers::Lab::AssignmentBinding.new(coordinator: coordinator,
-            project: @config.project, owner_guard: guard)
-          # Unix requesters and the existing Hermes mTLS transport share the
-          # same owner and one in-memory OTP vault. No second daemon opens the
-          # journal and no synthetic Unix principal represents a certificate.
-          vault = Ace::Hitl::Lifecycle::OtpVault::MemoryVault.new
-          services = [Ace::Hitl::Lifecycle::Service.new(root: selected.fetch("root"),
-            socket_path: selected.fetch("socket_path"), group: selected.fetch("group"),
-            binding: binding, policy: policy, vault: vault)]
-          if selected.key?("tls_authority")
-            authority = Ace::Hitl::Lifecycle::TlsAuthority.load(selected.fetch("tls_authority"))
-            verify_tls_identity!(authority)
-            services << Ace::Hitl::Lifecycle::TlsService.new(root: selected.fetch("root"),
-              binding: binding, project: @config.project, credential: authority.credential,
-              ssl_context: authority.ssl_context!, listen: authority.listen, port: authority.port,
-              group: selected.fetch("group"), vault: vault, decision_policy: policy)
-          end
-          services
-        end
-
-        def verify_tls_identity!(authority)
-          unless authority.project_id == @config.project &&
-              Etc.getpwnam(authority.service_user).uid == @config.service.fetch("uid") &&
-              Etc.getgrnam(authority.service_group).gid == @config.service.fetch("gid")
-            raise InvalidConfigurationError, "ordinary HITL TLS project or service identity differs"
-          end
-        rescue ArgumentError
-          raise InvalidConfigurationError, "ordinary HITL TLS service account is unavailable"
-        end
-      end
-    end
-  end
-end