ace-lab 0.9.0 → 0.13.0

data/lib/ace/lab/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Lab
-    VERSION = "0.9.0"
+    VERSION = "0.13.0"
   end
 end

data/lib/ace/lab.rb

@@ -2,30 +2,46 @@
 
 require_relative "lab/version"
 require "ace/support/config"
+require "rbconfig"
 
 require_relative "lab/errors"
 require_relative "lab/authorization_path"
+require_relative "lab/install_manifest_path"
 
 # Load all ace-lab components
 require_relative "lab/atoms/topology_schema"
+require_relative "lab/atoms/install_schema"
 require_relative "lab/atoms/binding_freshness"
 require_relative "lab/atoms/public_projection"
-require_relative "lab/atoms/service_input"
-require_relative "lab/models/service_receipt"
 require_relative "lab/models/runtime_binding"
 require_relative "lab/models/topology_entry"
 require_relative "lab/models/query_result"
+require_relative "lab/models/status_report"
 require_relative "lab/molecules/topology_loader"
+require_relative "lab/molecules/config_state_classifier"
+require_relative "lab/molecules/lab_state_scanner"
 require_relative "lab/molecules/caller_authorizer"
 require_relative "lab/molecules/grant_resolver"
-require_relative "lab/molecules/hitl_authorizer"
-require_relative "lab/molecules/service_policy"
-require_relative "lab/molecules/service_executor"
+require_relative "lab/molecules/grant_provisioner"
+require_relative "lab/molecules/install_manifest_loader"
+require_relative "lab/molecules/account_provisioner"
+require_relative "lab/molecules/directory_provisioner"
+require_relative "lab/molecules/key_provisioner"
+require_relative "lab/molecules/role_verifier"
+require_relative "lab/organisms/prepare"
+require_relative "lab/organisms/project_add"
+require_relative "lab/organisms/install"
+require_relative "lab/organisms/verify"
+require_relative "lab/molecules/repository_provisioner"
+require_relative "lab/molecules/overseer_provisioner"
+require_relative "lab/molecules/project_registry"
+require_relative "lab/molecules/forge_merge_config"
+require_relative "lab/molecules/forgejo_merge_adapter"
 require_relative "lab/molecules/inventory_query"
 require_relative "lab/molecules/exact_resolver"
 require_relative "lab/molecules/capability_router"
 require_relative "lab/organisms/topology_service"
-require_relative "lab/organisms/service_request_service"
+require_relative "lab/organisms/status_service"
 require_relative "lab/cli"
 
 module Ace
@@ -37,6 +53,18 @@ module Ace
         File.expand_path("../..", __dir__)
     end
 
+    # Host platform family used for account-provisioning defaults
+    # ("darwin" or "linux"). A method (not a constant) so tests stub the
+    # seam without any caller-controllable production override.
+    # @return [String]
+    def self.host_platform
+      case RbConfig::CONFIG["host_os"]
+      when /darwin/ then "darwin"
+      when /linux/ then "linux"
+      else "unknown"
+      end
+    end
+
     # Check if debug mode is enabled
     # @return [Boolean]
     def self.debug?

metadata

@@ -1,28 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ace-lab
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.13.0
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-16 00:00:00.000000000 Z
+date: 2026-10-20 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: ace-runtime
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.3'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.3'
 - !ruby/object:Gem::Dependency
   name: ace-support-cli
   requirement: !ruby/object:Gem::Requirement
@@ -65,48 +51,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.18'
-- !ruby/object:Gem::Dependency
-  name: ace-assign
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.70'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.70'
-- !ruby/object:Gem::Dependency
-  name: ace-herdr
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.6'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.6'
-- !ruby/object:Gem::Dependency
-  name: ace-hitl
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.16'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '0.16'
 - !ruby/object:Gem::Dependency
   name: ace-git-forgejo
   requirement: !ruby/object:Gem::Requirement
@@ -205,9 +149,11 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.22'
-description: Read-only topology registry and capability router. Resolves stable project,
-  agent, and service IDs from ADR-022 configuration without invoking Lab, reading
-  credentials, tracking work, or guessing transient pane/session identifiers.
+description: 'Lab environment package: read-only topology registry and capability
+  router (stable project, agent, and service IDs from ADR-022 configuration), the
+  lab status snapshot, and ace-lab prepare — idempotent preparation of accounts, directories,
+  permissions, ed25519 keys, and role bindings from a root-owned install manifest.
+  No queue, journal, or command kernel.'
 email:
 - mc@cs3b.com
 executables:
@@ -224,74 +170,54 @@ files:
 - exe/ace-lab
 - lib/ace/lab.rb
 - lib/ace/lab/atoms/binding_freshness.rb
-- lib/ace/lab/atoms/protected_publication_input.rb
-- lib/ace/lab/atoms/protected_workspace_prune_input.rb
-- lib/ace/lab/atoms/protected_workspace_prune_preview.rb
+- lib/ace/lab/atoms/install_schema.rb
 - lib/ace/lab/atoms/public_projection.rb
-- lib/ace/lab/atoms/service_input.rb
 - lib/ace/lab/atoms/topology_schema.rb
 - lib/ace/lab/authorization_path.rb
 - lib/ace/lab/cli.rb
 - lib/ace/lab/cli/commands/agents.rb
-- lib/ace/lab/cli/commands/assignment.rb
-- lib/ace/lab/cli/commands/command_execute.rb
+- lib/ace/lab/cli/commands/install.rb
+- lib/ace/lab/cli/commands/prepare.rb
+- lib/ace/lab/cli/commands/project_add.rb
 - lib/ace/lab/cli/commands/projects.rb
 - lib/ace/lab/cli/commands/resolve.rb
 - lib/ace/lab/cli/commands/route.rb
-- lib/ace/lab/cli/commands/run.rb
-- lib/ace/lab/cli/commands/service.rb
 - lib/ace/lab/cli/commands/services.rb
+- lib/ace/lab/cli/commands/status.rb
 - lib/ace/lab/cli/commands/support.rb
+- lib/ace/lab/cli/commands/verify.rb
 - lib/ace/lab/errors.rb
+- lib/ace/lab/install_manifest_path.rb
 - lib/ace/lab/models/query_result.rb
 - lib/ace/lab/models/runtime_binding.rb
-- lib/ace/lab/models/service_receipt.rb
+- lib/ace/lab/models/status_report.rb
 - lib/ace/lab/models/topology_entry.rb
+- lib/ace/lab/molecules/account_provisioner.rb
 - lib/ace/lab/molecules/caller_authorizer.rb
 - lib/ace/lab/molecules/capability_router.rb
-- lib/ace/lab/molecules/command_owner_admission.rb
-- lib/ace/lab/molecules/command_policy.rb
+- lib/ace/lab/molecules/config_state_classifier.rb
+- lib/ace/lab/molecules/directory_provisioner.rb
 - lib/ace/lab/molecules/exact_resolver.rb
 - lib/ace/lab/molecules/forge_merge_config.rb
 - lib/ace/lab/molecules/forgejo_merge_adapter.rb
+- lib/ace/lab/molecules/grant_provisioner.rb
 - lib/ace/lab/molecules/grant_resolver.rb
-- lib/ace/lab/molecules/hitl_authorizer.rb
+- lib/ace/lab/molecules/hitl_routes.rb
+- lib/ace/lab/molecules/install_manifest_loader.rb
 - lib/ace/lab/molecules/inventory_query.rb
-- lib/ace/lab/molecules/ordinary_admission_resolver.rb
-- lib/ace/lab/molecules/ordinary_listener.rb
-- lib/ace/lab/molecules/ordinary_merge_read.rb
-- lib/ace/lab/molecules/ordinary_native_read.rb
-- lib/ace/lab/molecules/ordinary_owner_admission.rb
-- lib/ace/lab/molecules/ordinary_owner_config.rb
-- lib/ace/lab/molecules/ordinary_receiver_config.rb
-- lib/ace/lab/molecules/ordinary_socket.rb
-- lib/ace/lab/molecules/ordinary_worktree_read.rb
-- lib/ace/lab/molecules/protected_cleanup_owner_admission.rb
-- lib/ace/lab/molecules/protected_cleanup_owner_client.rb
-- lib/ace/lab/molecules/protected_cleanup_owner_identity.rb
-- lib/ace/lab/molecules/protected_publication_publisher.rb
-- lib/ace/lab/molecules/protected_service_handler.rb
-- lib/ace/lab/molecules/protected_service_policy.rb
-- lib/ace/lab/molecules/service_executor.rb
-- lib/ace/lab/molecules/service_policy.rb
+- lib/ace/lab/molecules/key_provisioner.rb
+- lib/ace/lab/molecules/lab_state_scanner.rb
+- lib/ace/lab/molecules/overseer_provisioner.rb
+- lib/ace/lab/molecules/project_registry.rb
+- lib/ace/lab/molecules/repository_provisioner.rb
+- lib/ace/lab/molecules/role_verifier.rb
 - lib/ace/lab/molecules/topology_loader.rb
-- lib/ace/lab/organisms/authority_composition.rb
-- lib/ace/lab/organisms/command_executor.rb
-- lib/ace/lab/organisms/command_run_client.rb
-- lib/ace/lab/organisms/ordinary_assignment_client.rb
-- lib/ace/lab/organisms/ordinary_authority_composition.rb
-- lib/ace/lab/organisms/ordinary_merge_receiver.rb
-- lib/ace/lab/organisms/ordinary_merge_request.rb
-- lib/ace/lab/organisms/protected_cleanup_owner.rb
-- lib/ace/lab/organisms/protected_service_client.rb
-- lib/ace/lab/organisms/protected_service_listener.rb
-- lib/ace/lab/organisms/protected_service_publication.rb
-- lib/ace/lab/organisms/protected_service_receiver.rb
-- lib/ace/lab/organisms/protected_service_recovery.rb
-- lib/ace/lab/organisms/protected_service_request.rb
-- lib/ace/lab/organisms/protected_service_worker.rb
-- lib/ace/lab/organisms/service_request_service.rb
+- lib/ace/lab/organisms/install.rb
+- lib/ace/lab/organisms/prepare.rb
+- lib/ace/lab/organisms/project_add.rb
+- lib/ace/lab/organisms/status_service.rb
 - lib/ace/lab/organisms/topology_service.rb
+- lib/ace/lab/organisms/verify.rb
 - lib/ace/lab/version.rb
 homepage: https://github.com/cs3b/ace
 licenses:
@@ -317,6 +243,6 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 3.6.9
 specification_version: 4
-summary: 'Topology and routing CLI for the Lab: address projects, agents, and services
-  by stable IDs'
+summary: 'Lab environment CLI: topology queries, lab status, and prepare-phase convergence
+  from the trusted install manifest'
 test_files: []

data/lib/ace/lab/atoms/protected_publication_input.rb

@@ -1,50 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "service_input"
-
-module Ace
-  module Lab
-    module Atoms
-      # One accepted artifact, never a queue selector or a build instruction.
-      module ProtectedPublicationInput
-        REGISTRY = "https://rubygems.org"
-        PUBLICATION_FIELDS = %w[gem_name version head registry artifact_relative_path].freeze
-        NAME = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/
-        VERSION = /\A[0-9]+(?:\.[0-9A-Za-z]+)*(?:-[0-9A-Za-z]+(?:\.[0-9A-Za-z]+)*)?\z/
-
-        def self.decode!(bytes)
-          unless bytes.is_a?(String) && bytes.bytesize.between?(1, ServiceInput::MAX_BYTES)
-            raise ArgumentError, "publication input exceeds its bound"
-          end
-          input = JSON.parse(bytes, allow_duplicate_key: false, allow_comments: false,
-            allow_nan: false, create_additions: false, max_nesting: 16)
-          validate!(input)
-        rescue JSON::ParserError
-          raise ArgumentError, "publication input must be valid JSON"
-        end
-
-        def self.validate!(input)
-          unless input.is_a?(Hash) && input.keys.sort == %w[publication target] &&
-              input["publication"].is_a?(Hash) && input["publication"].keys.sort == PUBLICATION_FIELDS.sort &&
-              input["target"].is_a?(Hash) && input["target"].keys.sort == %w[artifact_digest resource]
-            raise ArgumentError, "publication input fields differ"
-          end
-          value = input.fetch("publication")
-          name, version, head, registry, path = value.values_at(*PUBLICATION_FIELDS)
-          unless name.is_a?(String) && name.match?(NAME) && version.is_a?(String) &&
-              version.bytesize.between?(1, 128) && version.match?(VERSION) &&
-              head.is_a?(String) && head.match?(/\A[0-9a-f]{40}\z/) && registry == REGISTRY &&
-              path.is_a?(String) && path.bytesize.between?(1, 4096) && path.end_with?(".gem") &&
-              path.split("/", -1).all? { |part| part.match?(/\A[a-zA-Z0-9_.-]+\z/) && !%w[. ..].include?(part) } &&
-              input.dig("target", "resource") == "rubygems:#{name}:#{version}" &&
-              input.dig("target", "artifact_digest").is_a?(String) &&
-              input.dig("target", "artifact_digest").match?(ServiceInput::SHA256)
-            raise ArgumentError, "publication artifact selection differs"
-          end
-          ServiceInput.validate!(input)
-          input
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/atoms/protected_workspace_prune_input.rb

@@ -1,114 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-
-module Ace
-  module Lab
-    module Atoms
-      # Structural input validation only. Canonical ownership, preservation and
-      # current permission are independently verified by the operation owners.
-      module ProtectedWorkspacePruneInput
-        MAX_BYTES = 65_536
-        ID = /\A[A-Za-z0-9_.-]{1,200}\z/
-        SHA = /\A[0-9a-f]{64}\z/
-        COMMIT = /\A(?:[0-9a-f]{40}|[0-9a-f]{64})\z/
-        ASSOCIATION = %w[project_id mapping_id assignment_id attempt_id].freeze
-
-        module_function
-
-        def parse(bytes)
-          reject! unless bytes.is_a?(String) && bytes.bytesize.between?(1, MAX_BYTES)
-          text = bytes.dup.force_encoding(Encoding::UTF_8)
-          reject! unless text.valid_encoding?
-          input = JSON.parse(text, create_additions: false, max_nesting: 16,
-            allow_nan: false, allow_comments: false, allow_duplicate_key: false)
-          object!(input, %w[schema maintenance target publication preservation])
-          reject! unless input.fetch("schema") == "ace.protected-workspace-prune/v1"
-          association!(input.fetch("maintenance"))
-          target = object!(input.fetch("target"), ASSOCIATION +
-            %w[resource artifact_digest descriptor_sha256 binding_event_digest release_event_digest journal_commit])
-          ASSOCIATION.each { |field| token!(target.fetch(field)) }
-          %w[artifact_digest descriptor_sha256 binding_event_digest release_event_digest].each { |key| digest!(target.fetch(key)) }
-          commit!(target.fetch("journal_commit"))
-          resource = "workspace:#{target.fetch('project_id')}:#{target.fetch('mapping_id')}:#{target.fetch('assignment_id')}"
-          reject! unless resource.bytesize <= 256 && target.fetch("resource") == resource
-          publication = object!(input.fetch("publication"), %w[descriptor_sha256 installation_ref])
-          digest!(publication.fetch("descriptor_sha256"))
-          reference!(publication.fetch("installation_ref"))
-          preservation!(input.fetch("preservation"))
-          freeze_value(input)
-        rescue JSON::ParserError, JSON::NestingError, EncodingError
-          reject!
-        end
-
-        def preservation!(value)
-          object!(value, %w[head branch destinations manifest_sha256])
-          commit!(value.fetch("head"))
-          branch = value.fetch("branch")
-          unless branch.nil?
-            ref!(branch)
-            reject! unless branch.start_with?("refs/heads/")
-          end
-          digest!(value.fetch("manifest_sha256"))
-          destinations = value.fetch("destinations")
-          reject! unless destinations.is_a?(Array) && destinations.length <= 64
-          identities = destinations.map do |entry|
-            object!(entry, %w[repository_id ref head])
-            token!(entry.fetch("repository_id"))
-            ref!(entry.fetch("ref"))
-            commit!(entry.fetch("head"))
-            entry.values_at("repository_id", "ref", "head")
-          end
-          reject! unless identities == identities.sort && identities.uniq == identities
-        end
-
-        def association!(value)
-          object!(value, ASSOCIATION)
-          value.each_value { |item| token!(item) }
-        end
-
-        def reference!(value)
-          object!(value, %w[path bytes sha256])
-          path = value.fetch("path")
-          reject! unless path.is_a?(String) && path.bytesize.between?(2, 4096) &&
-            path.start_with?("/") && !path.include?("\0") && !path.end_with?("/") &&
-            path.split("/", -1).drop(1).all? { |part| !part.empty? && !%w[. ..].include?(part) }
-          reject! unless value.fetch("bytes").is_a?(Integer) && value.fetch("bytes").between?(1, MAX_BYTES)
-          digest!(value.fetch("sha256"))
-        end
-
-        def object!(value, fields)
-          reject! unless value.is_a?(Hash) && value.keys.sort == fields.sort
-          value
-        end
-
-        def token!(value)
-          reject! unless value.is_a?(String) && ID.match?(value)
-        end
-
-        def digest!(value)
-          reject! unless value.is_a?(String) && SHA.match?(value)
-        end
-
-        def commit!(value)
-          reject! unless value.is_a?(String) && COMMIT.match?(value)
-        end
-
-        def ref!(value)
-          reject! unless value.is_a?(String) && value.bytesize.between?(6, 256) &&
-            value.start_with?("refs/") && !value.match?(/[\x00-\x20\x7f~^:?*\[\\]/) &&
-            !value.include?("..") && !value.include?("@{") && !value.end_with?(".") &&
-            value.split("/", -1).all? { |part| !part.empty? && !part.start_with?(".") && !part.end_with?(".lock") }
-        end
-
-        def freeze_value(value)
-          value.each { |key, item| key.freeze; freeze_value(item) } if value.is_a?(Hash)
-          value.each { |item| freeze_value(item) } if value.is_a?(Array)
-          value.freeze
-        end
-
-        def reject! = raise(ArgumentError, "invalid protected prune input")
-      end
-    end
-  end
-end

data/lib/ace/lab/atoms/protected_workspace_prune_preview.rb

@@ -1,86 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "protected_workspace_prune_input"
-require "ace/assign/molecules/execution_scope_lineage"
-require "ace/assign/atoms/evidence_digest"
-
-module Ace
-  module Lab
-    module Atoms
-      # Closed transport data only; canonical and physical owners must
-      # independently authenticate these selectors before any effect.
-      module ProtectedWorkspacePrunePreview
-        Input = ProtectedWorkspacePruneInput
-        CONTEXT = %w[journal_commit maintenance head candidate_generation worker_process_binding caller_process_binding].freeze
-        RESULT = %w[schema kind intent_digest publication maintenance maintenance_context target preservation inventory_sha256 file_count total_bytes].freeze
-        module_function
-
-        def intent!(value)
-          Input.object!(value, %w[schema maintenance target publication destinations])
-          Input.reject! unless value["schema"] == "ace.protected-workspace-prune-preview/v1"
-          Input.association!(value.fetch("maintenance"))
-          target = value.fetch("target")
-          Input.object!(target, Input::ASSOCIATION + %w[resource descriptor_sha256 binding_event_digest release_event_digest journal_commit])
-          Input::ASSOCIATION.each { |key| Input.token!(target.fetch(key)) }
-          %w[descriptor_sha256 binding_event_digest release_event_digest].each { |key| Input.digest!(target.fetch(key)) }
-          Input.commit!(target.fetch("journal_commit"))
-          expected = "workspace:#{target.fetch('project_id')}:#{target.fetch('mapping_id')}:#{target.fetch('assignment_id')}"
-          Input.reject! unless expected.bytesize <= 256 && target["resource"] == expected
-          publication = Input.object!(value.fetch("publication"), %w[descriptor_sha256 installation_ref])
-          Input.digest!(publication.fetch("descriptor_sha256"))
-          Input.reference!(publication.fetch("installation_ref"))
-          # Reuse the existing exact destination/ref owner, without accepting
-          # or manufacturing a preservation authority assertion.
-          destinations!(value.fetch("destinations"))
-          Input.reject! if JSON.generate(value).bytesize > Input::MAX_BYTES
-          Input.freeze_value(value)
-        end
-
-        def destinations!(destinations)
-          Input.reject! unless destinations.is_a?(Array) && destinations.length <= 64
-          ids = destinations.map do |entry|
-            Input.object!(entry, %w[repository_id ref head])
-            Input.token!(entry.fetch("repository_id")); Input.ref!(entry.fetch("ref")); Input.commit!(entry.fetch("head"))
-            entry.values_at("repository_id", "ref", "head")
-          end
-          Input.reject! unless ids == ids.sort && ids == ids.uniq
-        end
-
-        def context!(value)
-          Input.object!(value, CONTEXT)
-          Input.commit!(value.fetch("journal_commit"))
-          Input.association!(value.fetch("maintenance"))
-          Input.commit!(value.fetch("head"))
-          Input.reject! unless value["candidate_generation"].is_a?(Integer) && value["candidate_generation"].positive?
-          original = value.fetch("worker_process_binding")
-          birth = original.is_a?(Hash) && original["started_at"]
-          boot = birth.is_a?(String) && birth.match(/\Alinux:([0-9a-f-]{36}):[0-9]+\z/)&.captures&.first
-          %w[worker_process_binding caller_process_binding].each do |key|
-            Ace::Assign::Molecules::ExecutionScopeLineage.validate_process_identity!(value.fetch(key), boot_id: boot)
-          end
-          Input.reject! if JSON.generate(value).bytesize > 16_384
-          Input.freeze_value(value)
-        end
-
-        def result!(value, intent:, context:)
-          Input.object!(value, RESULT)
-          Input.reject! unless value.values_at("schema", "kind") == ["ace.protected-workspace-prune-preview-result/v1", "preview"]
-          Input.reject! unless value["intent_digest"] == Ace::Assign::Atoms::EvidenceDigest.digest(intent) &&
-            value["maintenance_context"] == context && value["maintenance"] == intent["maintenance"] &&
-            value["publication"] == intent["publication"] && value.fetch("target").except("artifact_digest") == intent["target"]
-          input = {"schema" => "ace.protected-workspace-prune/v1"}.merge(value.slice("maintenance", "target", "publication", "preservation"))
-          Input.parse(JSON.generate(input))
-          Input.digest!(value.fetch("inventory_sha256"))
-          Input.reject! unless value["inventory_sha256"] == value.dig("preservation", "manifest_sha256")
-          Input.reject! unless value["file_count"].is_a?(Integer) && value["file_count"].between?(0, 4096) &&
-            value["total_bytes"].is_a?(Integer) && value["total_bytes"].between?(0, 256 * 1024 * 1024)
-          Input.reject! unless value.dig("preservation", "destinations") == intent["destinations"] &&
-            value.dig("target", "artifact_digest") == Ace::Assign::Atoms::EvidenceDigest.digest(
-              "target" => intent.fetch("target"), "preservation" => value.fetch("preservation"))
-          Input.reject! if JSON.generate(value).bytesize > 16_384
-          Input.freeze_value(value)
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/atoms/service_input.rb

@@ -1,92 +0,0 @@
-# frozen_string_literal: true
-
-require "digest"
-require "json"
-
-module Ace
-  module Lab
-    module Atoms
-      # Bounded structured input for a named service operation. Only the
-      # digest enters the request index; input values never enter the journal.
-      module ServiceInput
-        MAX_BYTES = 64 * 1024
-        FORBIDDEN_KEYS = /credential|password|secret|token|private.key|authorization|\Aenv\z/i
-        SHA256 = /\A[0-9a-f]{64}\z/
-        RESOURCE = /\A[a-zA-Z0-9_.:\/-]{1,256}\z/
-
-        def self.load(path)
-          begin
-            flags = File::RDONLY | File::NOFOLLOW | File::NONBLOCK
-            data = File.open(path, flags) do |file|
-              before = file.stat
-              unless before.file? && before.size <= MAX_BYTES && same_file?(before, File.lstat(path))
-                raise ArgumentError, "input must be a bounded regular file"
-              end
-              content = file.read(MAX_BYTES + 1).to_s
-              unless content.bytesize <= MAX_BYTES && same_file?(before, file.stat) &&
-                  same_file?(before, File.lstat(path))
-                raise ArgumentError, "input file changed while reading"
-              end
-              JSON.parse(content, allow_duplicate_key: false, allow_comments: false,
-                allow_nan: false, create_additions: false, max_nesting: 16)
-            end
-          rescue SystemCallError, IOError
-            raise ArgumentError, "input file is unreadable"
-          end
-          raise ArgumentError, "input must be a JSON object" unless data.is_a?(Hash)
-          validate!(data)
-          data
-        rescue JSON::ParserError
-          raise ArgumentError, "input must be valid JSON"
-        end
-
-        def self.same_file?(left, right)
-          [left.dev, left.ino, left.mode, left.uid, left.gid, left.size, left.mtime, left.ctime] ==
-            [right.dev, right.ino, right.mode, right.uid, right.gid, right.size, right.mtime, right.ctime]
-        end
-        private_class_method :same_file?
-
-        def self.digest(data)
-          Digest::SHA256.hexdigest(JSON.generate(canonical(data)))
-        end
-
-        def self.target(data)
-          target = data["target"]
-          raise ArgumentError, "input.target must be an object" unless target.is_a?(Hash)
-          resource = target["resource"]
-          artifact = target["artifact_digest"]
-          raise ArgumentError, "input.target.resource must be a stable resource ID" unless
-            resource.is_a?(String) && resource.match?(RESOURCE)
-          if artifact && (!artifact.is_a?(String) || !artifact.match?(SHA256))
-            raise ArgumentError, "input.target.artifact_digest must be SHA-256"
-          end
-          {"resource" => resource, "artifact_digest" => artifact}
-        end
-
-        def self.canonical(value)
-          case value
-          when Hash then value.keys.sort.each_with_object({}) { |key, result| result[key] = canonical(value[key]) }
-          when Array then value.map { |item| canonical(item) }
-          else value
-          end
-        end
-
-        def self.validate!(value, depth = 0)
-          raise ArgumentError, "input nesting is too deep" if depth > 16
-          case value
-          when Hash
-            value.each do |key, item|
-              raise ArgumentError, "input has a forbidden field" if !key.is_a?(String) || key.match?(FORBIDDEN_KEYS)
-              validate!(item, depth + 1)
-            end
-          when Array then value.each { |item| validate!(item, depth + 1) }
-          when String, Integer, Float, TrueClass, FalseClass, NilClass
-            raise ArgumentError, "input contains a non-finite number" if value.is_a?(Float) && !value.finite?
-          else
-            raise ArgumentError, "input contains an unsupported value"
-          end
-        end
-      end
-    end
-  end
-end