ace-lab 0.8.0 → 0.9.0

data/lib/ace/lab/organisms/ordinary_assignment_client.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "securerandom"
+require "ace/assign/authority/retained_input"
 require "ace/assign/authority/ordinary_client"
 require "ace/assign/authority/ordinary_lifecycle"
 require "ace/assign/organisms/prepared_work_builder"
@@ -13,6 +14,7 @@ module Ace
       # Only Assign's installed owner registers, advances and accepts execution.
       class OrdinaryAssignmentClient
         A = Ace::Assign::Authority
+        Files = A::RetainedInput
         REQUEST_KEYS = %w[version project_id operation mutation_id params parts].freeze
 
         def initialize(project:, config: nil, client_factory: nil)
@@ -31,7 +33,7 @@ module Ace
               pane.is_a?(String) && Molecules::OrdinaryOwnerConfig::PANE.match?(pane)
             raise ArgumentError, "preparation requires project and native pane selectors"
           end
-          directory = create_output(output)
+          directory = Files.create_output(output)
           prepared = Ace::Assign::Organisms::PreparedWorkBuilder.new(export_root: directory)
             .call(task_ref: task, project_id: project, dependency_reports: dependency_reports)
           definition = JSON.parse(prepared.fetch("definition_bytes"))
@@ -43,22 +45,22 @@ module Ace
               "prepared_head" => prepared.fetch("head"), "prepared_tree" => prepared.fetch("tree"),
               "manifest_sha256" => reference.fetch("manifest_sha256")},
             "parts" => [{"file" => "prepared.bundle", "bytes" => prepared.fetch("bytes"), "sha256" => prepared.fetch("sha256")}]}
-          write_file(directory, "definition.json", prepared.fetch("definition_bytes"))
-          write_file(directory, "prepared.bundle", prepared.fetch("bundle"))
-          write_file(directory, "request.json", JSON.generate(request) + "\n")
+          Files.write_file(directory, "definition.json", prepared.fetch("definition_bytes"))
+          Files.write_file(directory, "prepared.bundle", prepared.fetch("bundle"))
+          Files.write_file(directory, "request.json", JSON.generate(request) + "\n")
           {"project_id" => project, "assignment_id" => prepared.fetch("assignment_id"),
             "scope" => prepared.fetch("scope"), "request" => File.join(directory, "request.json"), "prepared" => true}
         end
 
         def request(input:, output: nil)
-          request = JSON.parse(self.class.read_file(input, 16_384), allow_duplicate_key: false, create_additions: false, max_nesting: 24)
+          request = JSON.parse(Files.read_file(input, 16_384), allow_duplicate_key: false, create_additions: false, max_nesting: 24)
           unless request.is_a?(Hash) && request.keys.sort == REQUEST_KEYS.sort && request["version"].is_a?(Integer) && request["version"] == 1 &&
               request["project_id"] == @project && A::OrdinaryLifecycle::OPERATIONS.include?(request["operation"]) &&
               request["params"].is_a?(Hash) && !request["params"].key?("transfer") && request["parts"].is_a?(Array)
             raise ArgumentError, "retained ordinary request selection is invalid"
           end
           operation = request.fetch("operation")
-          read = %w[registration_status assignment_snapshot result_status result_snapshot].include?(operation)
+          read = %w[registration_status assignment_snapshot result_status result_snapshot supervisor_status export_candidate review_status merge_evidence].include?(operation)
           mutation = request.fetch("mutation_id")
           unless read ? mutation.nil? : mutation.is_a?(String) && Ace::Assign::Molecules::JournalMutation::ID.match?(mutation)
             raise ArgumentError, "retained mutation ID must be explicit; read operations require null"
@@ -72,7 +74,7 @@ module Ace
           parts = upload && read_parts(request.fetch("parts"), input, transfer.fetch(:purpose))
           # No local metadata is interpreted as successful execution. Download
           # files are merely a projection of the authenticated canonical reply.
-          directory = download && self.class.create_output(output)
+          directory = download && Files.create_output(output)
           client = @client_factory.call(project_id: @project, service: @config.service,
             verify_selection: @config.method(:verify_owner!), scratch_root: directory || nil)
           reply = client.call(operation, request.fetch("params"), mutation_id: request.fetch("mutation_id"),
@@ -81,48 +83,17 @@ module Ace
           if download
             files = reply.parts.each_with_index.map do |bytes, index|
               name = format("part-%02d.bytes", index)
-              self.class.write_file(directory, name, bytes)
+              Files.write_file(directory, name, bytes)
               {"file" => File.join(directory, name), "bytes" => bytes.bytesize, "sha256" => Digest::SHA256.hexdigest(bytes)}
             end
             envelope["files"] = files
-            self.class.write_file(directory, "response.json", JSON.generate(envelope) + "\n")
+            Files.write_file(directory, "response.json", JSON.generate(envelope) + "\n")
           end
           envelope
         rescue JSON::ParserError
           raise ArgumentError, "retained request is not valid bounded JSON"
         end
 
-        def self.read_file(path, limit)
-          File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
-            before = file.stat
-            raise ArgumentError, "retained input is not a bounded regular file" unless before.file? && before.size.between?(0, limit)
-            bytes = (file.read(limit + 1) || "").b
-            after, selected = file.stat, File.lstat(path)
-            identity = ->(stat) { [stat.dev, stat.ino, stat.size, stat.mtime, stat.ctime] }
-            unless bytes.bytesize == before.size && identity.call(before) == identity.call(after) &&
-                identity.call(after) == identity.call(selected) && !selected.symlink?
-              raise ArgumentError, "retained input changed during read"
-            end
-            bytes.freeze
-          end
-        end
-
-        def self.create_output(path)
-          raise ArgumentError, "output must be a new directory path" unless path.is_a?(String) && !path.empty?
-          directory = File.expand_path(path)
-          Dir.mkdir(directory, 0o700)
-          A::PrivateDirectory.verify!(directory)
-          directory
-        end
-
-        def self.write_file(directory, name, bytes)
-          File.open(File.join(directory, name), File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0o600) do |file|
-            file.write(bytes)
-            file.flush
-            file.fsync
-          end
-        end
-
         private
 
         def read_parts(entries, input, purpose)
@@ -136,7 +107,7 @@ module Ace
             raise ArgumentError, "retained upload inventory is invalid"
           end
           entries.map do |entry|
-            bytes = self.class.read_file(File.expand_path(entry.fetch("file"), File.dirname(File.expand_path(input))), per_part)
+            bytes = Files.read_file(File.expand_path(entry.fetch("file"), File.dirname(File.expand_path(input))), per_part)
             unless bytes.bytesize == entry.fetch("bytes") && Digest::SHA256.hexdigest(bytes) == entry.fetch("sha256")
               raise ArgumentError, "retained upload bytes changed; preserve the original mutation"
             end

data/lib/ace/lab/organisms/ordinary_authority_composition.rb

@@ -8,6 +8,8 @@ require "ace/hitl/lifecycle/service"
 require "ace/hitl/lifecycle/tls_authority"
 require "ace/hitl/lifecycle/tls_service"
 require_relative "../molecules/ordinary_owner_admission"
+require_relative "../molecules/caller_authorizer"
+require_relative "../molecules/command_owner_admission"
 require_relative "../molecules/ordinary_listener"
 require_relative "ordinary_merge_receiver"
 
@@ -40,12 +42,18 @@ module Ace
             evidence_reader: ->(reference, record, state, pending) { reader.call(reference, record, state, pending) })
           reader = Ace::Assign::Authority::ServiceEvidence.new(journal: journal)
           exclusion = Ace::Assign::Molecules::LifecycleExclusion.new(root: @config.lifecycle_root)
+          command_admission = Molecules::CommandOwnerAdmission.new(base: admission, project: @config.project)
+          command = Ace::Assign::Authority::CommandExecution.new(project: @config.project, journal: journal,
+            admission: command_admission)
+          coordinator = nil
+          lifecycle = Ace::Assign::Authority::OrdinaryLifecycle.new(project: @config.project,
+            admission: admission, journal: journal, exclusion: exclusion, input_root: @config.assignment_root,
+            command_evidence: command,
+            release_authorizer: ->(binding) { authorize_release_artifact!(binding, coordinator) })
           coordinator = Ace::Assign::Organisms::AttemptCoordinator.new(cache_base: @config.assignment_root,
             repo_root: @config.journal.fetch("repository"), journal: journal, lifecycle_exclusion: exclusion,
-            recorded_binding_observer: admission.method(:recorded_binding!))
-          lifecycle = Ace::Assign::Authority::OrdinaryLifecycle.new(project: @config.project,
-            admission: admission, journal: journal, exclusion: exclusion, input_root: @config.assignment_root)
-          router = Ace::Assign::Authority::Router.new(handlers: [lifecycle])
+            recorded_binding_observer: admission.method(:recorded_binding!), ordinary_merge_evidence: lifecycle)
+          router = Ace::Assign::Authority::Router.new(handlers: [lifecycle, command])
           merge = OrdinaryMergeReceiver.new(config: @receiver, coordinator: coordinator,
             policy_document: policy_document, owner_guard: -> { @config.selected_principal!(@receiver.principal_uid) },
             merge_factory: ->(document) {
@@ -55,12 +63,34 @@ module Ace
           listener = Molecules::OrdinaryListener.new(socket_path: @receiver.socket_path,
             peer_uid: @receiver.principal_uid, socket_gid: @receiver.socket_gid, handler: merge,
             logger: ->(message) { warn message })
-          Ace::Assign::Authority::OrdinaryServer.new(admission: admission, lifecycle: router,
+          Ace::Assign::Authority::OrdinaryServer.new(admission: command_admission, lifecycle: router,
             services: hitl_services(coordinator) + [listener])
         end
 
         private
 
+        # Retention reads the existing exact release decision. It neither
+        # consumes an authorization nor dispatches a publication effect.
+        def authorize_release_artifact!(binding, coordinator)
+          @config.verify_owner!
+          document = Molecules::GrantResolver.trusted_document(@receiver.policy_path)
+          verify_join!(document)
+          uid = binding.fetch("caller_uid")
+          unless uid.is_a?(Integer) && uid.positive? && binding.fetch("project_id") == @config.project
+            raise SecurityError, "release artifact caller or project differs"
+          end
+          username = begin
+            Etc.getpwuid(uid)&.name
+          rescue ArgumentError
+            nil
+          end
+          visibility = Molecules::CallerAuthorizer.new(principals: document.fetch("principals", {}),
+            identity: Molecules::CallerAuthorizer.matchable_identities(username, uid))
+          raise SecurityError, "release artifact project grant is unavailable" unless visibility.authorized?(@config.project)
+          Molecules::ServicePolicy.new(document, coordinator.method(:proposal_authorization))
+            .authorize!(binding.fetch("authorization"), binding)
+        end
+
         def verify_join!(document)
           configured = Molecules::ServicePolicy.new(document).ordinary_receiver!(@config.project)
           expected = {"receiver_id" => @receiver.receiver_id, "socket_path" => @receiver.socket_path,

data/lib/ace/lab/organisms/ordinary_merge_receiver.rb

@@ -140,11 +140,9 @@ module Ace
           unless digest == submission.fetch("input_digest")
             invalid!("canonical request digest does not re-derive from the submission", request_id)
           end
-          # Selection and evidence integrity before authorization: the PR
-          # must target THIS receiver's configured forge repository, and the
-          # handed-over review must be independent of the executor.
+          # Forge selection precedes authorization. Reviewer independence is
+          # resolved by the canonical owner from native starts, not actor names.
           forge_identity!(document, request_id)
-          reviewer_independence!(document, request_id)
           decision = @resolver.decide(submission.fetch("authorization"), authorization_binding(submission))
           unless decision.authorized?
             return OrdinaryMergeRequest.refusal_envelope(decision.code, decision.message,
@@ -190,7 +188,12 @@ module Ace
             settle_no_effect(request_id, record, "canonical proposal is no longer authorized before effect")
             return :refused
           end
-          execute_effect(record)
+          begin
+            @coordinator.with_fixed_merge_evidence(record) { execute_effect(record) }
+          rescue Ace::Assign::AttemptErrors::ReceiptRejected
+            settle_no_effect(request_id, record, "canonical review or executed test proof changed before effect")
+            return :refused
+          end
           :executed
         rescue Ace::Assign::AttemptErrors::InvalidState, Ace::Assign::AttemptErrors::NotFound,
           Ace::Assign::AttemptErrors::Conflict
@@ -378,6 +381,7 @@ module Ace
         # immediately before each privileged effect. No cached decision is a lease.
         def current_authorization_refusal(record)
           @owner_guard&.call
+          @coordinator.verify_fixed_merge_evidence!(record)
           decision = @resolver.decide(record.fetch("authorization"), authorization_binding(record))
           decision.message unless decision.authorized?
         rescue Ace::Lab::InvalidConfigurationError, Ace::Assign::Error => e
@@ -645,19 +649,6 @@ module Ace
           {"owner" => match[1], "repo" => match[2], "index" => match[3].to_i}
         end
 
-        # The independent final-head review is handed over in the request;
-        # the executor's own identity is never an independent reviewer.
-        # Evidence naming the receiver or its principal refuses pre-effect —
-        # it can never be attached as independent review and never grounds
-        # the merge.
-        def reviewer_independence!(document, request_id)
-          reviewer = document.dig("review_evidence", "reviewer")
-          return unless [config.receiver_id, config.principal].include?(reviewer)
-          raise OrdinaryMergeRefusal.new("ordinary_merge_evidence_invalid",
-            "review evidence names the receiver executor, not an independent reviewer",
-            request_id: request_id)
-        end
-
         def selection_refusal!(message, request_id)
           raise OrdinaryMergeRefusal.new("ordinary_merge_selection_mismatch", message,
             request_id: request_id)

data/lib/ace/lab/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Lab
-    VERSION = "0.8.0"
+    VERSION = "0.9.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ace-lab
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.9.0
 platform: ruby
 authors:
 - Michal Czyz
@@ -234,9 +234,11 @@ files:
 - lib/ace/lab/cli.rb
 - lib/ace/lab/cli/commands/agents.rb
 - lib/ace/lab/cli/commands/assignment.rb
+- lib/ace/lab/cli/commands/command_execute.rb
 - lib/ace/lab/cli/commands/projects.rb
 - lib/ace/lab/cli/commands/resolve.rb
 - lib/ace/lab/cli/commands/route.rb
+- lib/ace/lab/cli/commands/run.rb
 - lib/ace/lab/cli/commands/service.rb
 - lib/ace/lab/cli/commands/services.rb
 - lib/ace/lab/cli/commands/support.rb
@@ -247,6 +249,8 @@ files:
 - lib/ace/lab/models/topology_entry.rb
 - lib/ace/lab/molecules/caller_authorizer.rb
 - lib/ace/lab/molecules/capability_router.rb
+- lib/ace/lab/molecules/command_owner_admission.rb
+- lib/ace/lab/molecules/command_policy.rb
 - lib/ace/lab/molecules/exact_resolver.rb
 - lib/ace/lab/molecules/forge_merge_config.rb
 - lib/ace/lab/molecules/forgejo_merge_adapter.rb
@@ -272,6 +276,8 @@ files:
 - lib/ace/lab/molecules/service_policy.rb
 - lib/ace/lab/molecules/topology_loader.rb
 - lib/ace/lab/organisms/authority_composition.rb
+- lib/ace/lab/organisms/command_executor.rb
+- lib/ace/lab/organisms/command_run_client.rb
 - lib/ace/lab/organisms/ordinary_assignment_client.rb
 - lib/ace/lab/organisms/ordinary_authority_composition.rb
 - lib/ace/lab/organisms/ordinary_merge_receiver.rb