ace-lab 0.9.0 → 0.13.0

data/lib/ace/lab/cli/commands/assignment.rb

@@ -1,92 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "../../organisms/ordinary_assignment_client"
-require "ace/assign/organisms/ordinary_driver"
-
-module Ace
-  module Lab
-    module CLI
-      module Commands
-        module Assignment
-          class Drive < Ace::Support::Cli::Command
-            desc "Drive or inspect one original ordinary execution through its installed owner"
-            option :project, required: true, desc: "Installed project ID; never inferred from local Assign"
-            option :context, required: true, desc: "Original retained ordinary context.json"
-            option :operation, required: true, desc: "status, supervisor, adopt-supervisor, bootstrap, next, start, step-start, step-finish, fail, result, adopt, replay"
-            option :previous_binding_sha256, desc: "Exact canonical old supervisor binding digest for adoption"
-            option :output, desc: "New private directory for accepted bootstrap context"
-            option :pane, desc: "Actual native caller pane (defaults to HERDR_PANE)"
-            option :generation, type: :integer, desc: "Exact canonical generation observed before mutation"
-            option :step, desc: "Exact queue step within the retained scope"
-            option :report, desc: "Executed step's bounded UTF-8 report file"
-            option :message, desc: "Failure reason"
-            option :receipt, desc: "Attributable execution receipt JSON"
-            option :artifact, type: :array, desc: "Artifact files in receipt order"
-            option :request, desc: "Original mutation request to replay after reconciliation"
-
-            def call(project:, context:, operation:, **options)
-              transport = Organisms::OrdinaryAssignmentClient.new(project: project)
-              driver = Ace::Assign::Organisms::OrdinaryDriver.new(path: context, project: project, transport: transport)
-              pane = options[:pane] || ENV["HERDR_PANE"]
-              result = case operation
-              when "status" then driver.status
-              when "supervisor" then driver.supervisor
-              when "adopt-supervisor"
-                driver.adopt_supervisor(pane: pane, generation: options.fetch(:generation),
-                  previous_binding_sha256: options.fetch(:previous_binding_sha256))
-              when "bootstrap" then driver.bootstrap(output: options.fetch(:output))
-              when "next" then driver.queue
-              when "start" then driver.start(pane: pane)
-              when "step-start", "step-finish", "fail"
-                driver.progress(operation: {"step-start" => "queue_start", "step-finish" => "queue_finish", "fail" => "queue_fail"}.fetch(operation),
-                  pane: pane, generation: options.fetch(:generation), step: options[:step],
-                  report: operation == "step-finish" ? options.fetch(:report) : nil,
-                  message: operation == "fail" ? options.fetch(:message) : nil)
-              when "result"
-                driver.submit(pane: pane, generation: options.fetch(:generation), receipt: options.fetch(:receipt), artifacts: options[:artifact] || [])
-              when "adopt" then driver.adopt(pane: pane)
-              when "replay" then driver.replay(input: options.fetch(:request))
-              else raise ArgumentError, "unknown ordinary driver operation"
-              end
-              puts JSON.generate(result)
-            rescue ArgumentError, KeyError, SystemCallError, Ace::Assign::Error, Ace::Runtime::Error, Ace::Lab::Error => error
-              raise Ace::Support::Cli::Error, "ordinary execution unavailable: #{error.message}; inspect the original context with --operation status"
-            end
-          end
-
-          class Prepare < Ace::Support::Cli::Command
-            desc "Retain reviewed task input for ordinary Assign registration"
-            option :project, required: true, desc: "Installed project ID"
-            option :task, required: true, desc: "Reviewed leaf task ID"
-            option :pane, required: true, desc: "Actual supervisor pane for registration"
-            option :output, required: true, desc: "New private directory for retained input"
-            option :dependency_reports, desc: "JSON array of explicit dependency report selections"
-
-            def call(project:, task:, pane:, output:, **options)
-              reports = options[:dependency_reports] ? JSON.parse(Ace::Assign::Authority::RetainedInput.read_file(
-                options.fetch(:dependency_reports), 65_536), allow_duplicate_key: false, create_additions: false, max_nesting: 16) : []
-              puts JSON.generate(Organisms::OrdinaryAssignmentClient.prepare(project: project, task: task,
-                pane: pane, output: output, dependency_reports: reports))
-            rescue JSON::ParserError, ArgumentError, KeyError, SystemCallError, Ace::Assign::Error, Ace::Runtime::Error => error
-              raise Ace::Support::Cli::Error, "ordinary preparation incomplete: #{error.message}; retain existing files"
-            end
-          end
-
-          class Request < Ace::Support::Cli::Command
-            desc "Send one retained operation to the installed ordinary Assign owner"
-            option :project, required: true, desc: "Installed project ID"
-            option :input, required: true, desc: "Retained request JSON with original mutation and part digests"
-            option :output, desc: "New private directory for a canonical snapshot download"
-
-            def call(project:, input:, **options)
-              service = Organisms::OrdinaryAssignmentClient.new(project: project)
-              puts JSON.generate(service.request(input: input, output: options[:output]))
-            rescue ArgumentError, KeyError, SystemCallError, Ace::Assign::Error, Ace::Runtime::Error, Ace::Lab::Error => error
-              raise Ace::Support::Cli::Error, "ordinary assignment unavailable: #{error.message}; retain the original request; inspect status before new work"
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/cli/commands/command_execute.rb

@@ -1,28 +0,0 @@
-# frozen_string_literal: true
-require_relative "../../organisms/command_executor"
-module Ace
-  module Lab
-    module CLI
-      module Commands
-        class CommandExecute < Ace::Support::Cli::Command
-          desc "Execute one admitted command for the installed root launcher"
-          option :project, required: true
-          option :fd, type: :integer, required: true
-          def call(project:, fd:, **)
-            raise SecurityError unless Process.uid.zero? && Process.euid.zero? && fd >= 3
-            bytes = $stdin.read(16_385)
-            raise ArgumentError if bytes.bytesize > 16_384
-            request = JSON.parse(bytes, allow_duplicate_key: false, create_additions: false, max_nesting: 16)
-            socket = UNIXSocket.for_fd(fd)
-            Organisms::CommandExecutor.new(project: project).run(socket: socket, request: request)
-            0 # Child status belongs to the framed result, not helper transport.
-          rescue StandardError, SecurityError
-            raise Ace::Support::Cli::Error, "command uncertain; inspect original execution reference"
-          ensure
-            socket&.close unless socket&.closed?
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/cli/commands/run.rb

@@ -1,65 +0,0 @@
-# frozen_string_literal: true
-require "optparse"
-require_relative "../../organisms/command_run_client"
-module Ace
-  module Lab
-    module CLI
-      module Commands
-        class Run < Ace::Support::Cli::Command
-          desc "Run one explicitly authorized project command"
-          option :project, required: true, desc: "Installed project ID"
-          option :as, desc: "Configured permitted executor"
-          option :service, repeat: true, desc: "Replace default services with this complete set"
-          argument :argv, type: :array, desc: "Literal command argv after --"
-
-          def self.parse(args)
-            separator = args.index("--")
-            raise ArgumentError, "run requires -- followed by literal command argv" unless separator && separator < args.size - 1
-            switches, argv = args.first(separator), args.drop(separator + 1)
-            options = {executor: nil, services: nil}
-            seen = {}
-            parser = OptionParser.new
-            %w[project as].each do |name|
-              parser.on("--#{name} VALUE") do |value|
-                raise ArgumentError, "duplicate --#{name}" if seen[name]
-                seen[name] = true
-                options[name == "as" ? :executor : :project] = value
-              end
-            end
-            parser.on("--service VALUE") { |value| (options[:services] ||= []) << value }
-            parser.parse!(switches)
-            raise ArgumentError, "run requires one --project and no extra options" unless seen["project"] && switches.empty?
-            options.merge(argv: argv)
-          rescue OptionParser::ParseError, ArgumentError
-            raise Ace::Support::Cli::Error, "usage_error: run requires unique project/executor options and literal argv after --"
-          end
-
-          def self.invoke(args)
-            options = parse(args)
-            project = options.delete(:project)
-            client = Organisms::CommandRunClient.new(project: project)
-            begin
-              client.run(**options, pane: ENV["HERDR_PANE_ID"])
-            rescue StandardError, SecurityError
-              # Once admission may have crossed the owner boundary, even a
-              # malformed stream is uncertainty, never a fresh usage refusal.
-              raise Ace::Support::Cli::Error, "command_uncertain: inspect the original execution reference before new work"
-            end
-          rescue Ace::Lab::InvalidConfigurationError
-            raise Ace::Support::Cli::Error, "invalid_command_context: installed project selection is unavailable"
-          end
-        end
-        class RunStatus < Ace::Support::Cli::Command
-          desc "Inspect an original command execution without running it"
-          option :project, required: true
-          option :reference, required: true
-          def call(project:, reference:, **)
-            puts JSON.generate(Organisms::CommandRunClient.new(project: project).status(reference))
-          rescue StandardError, SecurityError
-            raise Ace::Support::Cli::Error, "command_status_unavailable: preserve original execution reference"
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/cli/commands/service.rb

@@ -1,240 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require "ace/support/cli"
-require "ace/assign"
-require_relative "support"
-require_relative "../../organisms/protected_service_request"
-require_relative "../../organisms/ordinary_merge_request"
-require_relative "../../organisms/ordinary_merge_receiver"
-require_relative "../../organisms/ordinary_authority_composition"
-require_relative "../../molecules/ordinary_listener"
-require_relative "../../molecules/ordinary_receiver_config"
-
-module Ace
-  module Lab
-    module CLI
-      module Commands
-        module Service
-          module Output
-            def service
-              @service ||= Organisms::ServiceRequestService.new
-            end
-
-            def protected_service
-              @protected_service ||= Organisms::ProtectedServiceRequest.new
-            end
-
-            def protected_refusal(error)
-              code = (error.is_a?(ArgumentError) || error.is_a?(SecurityError)) ? "protected_service_refused" : "protected_service_unavailable"
-              message = error.is_a?(JSON::ParserError) ? "protected installed selection unavailable" : error.message.to_s.scrub[0, 512]
-              emit({"status" => "error", "error" => {"code" => code, "message" => message}})
-            end
-
-            def emit(envelope)
-              puts JSON.generate(envelope)
-              return if envelope["status"] == "ok"
-              error = envelope.fetch("error")
-              code = error.fetch("code")
-              message = error.fetch("message")
-              raise Ace::Support::Cli::Error, "#{code}: #{message}"
-            end
-          end
-
-          class Request < Ace::Support::Cli::Command
-            include Ace::Support::Cli::Base
-            include Runtime
-            include Output
-
-            desc "Request one authorized, configured service operation"
-            option :project, type: :string, required: true, desc: "Project stable ID"
-            option :assignment, type: :string, required: true, desc: "Assignment ID"
-            option :attempt, type: :string, required: true, desc: "Managed attempt ID"
-            option :operation, type: :string, required: true, desc: "Named operation"
-            option :input, type: :string, required: true, desc: "Structured JSON input file"
-            option :authorization, type: :string, required: true, desc: "Exact authorization reference"
-            option :request_id, type: :string, required: true, desc: "Idempotency key"
-            option :dry_run, type: :boolean, desc: "Validate without claiming or executing"
-            option :mode, type: :string, desc: "ordinary-merge selects the ordinary fixed merge producer"
-            option :queue_entry, type: :string, desc: "Original queue entry (ordinary merge)"
-
-            option :mapping, type: :string, desc: "Original protected mapping ID"
-            option :scope, type: :string, desc: "Original hierarchical prepared scope"
-            option :service, type: :string, desc: "Installed receiver ID"
-            option :candidate_head, type: :string, desc: "Exact approved candidate head"
-            option :candidate_generation, type: :integer, desc: "Original candidate generation"
-            option :expected_generation, type: :integer, desc: "Original authority generation"
-
-            def call(project:, assignment:, attempt:, operation:, input:, authorization:, request_id:, **options)
-              reject_identity_flags!(options)
-              mode = options[:mode]
-              if mode && mode != Organisms::OrdinaryMergeRequest::MODE
-                return emit(Organisms::OrdinaryMergeRequest.refusal_envelope("ordinary_merge_invalid_request",
-                  "unknown service mode", request_id: request_id, input_digest: nil))
-              end
-              if mode
-                begin
-                  return emit(ordinary_request(project: project, assignment: assignment, attempt: attempt,
-                    queue_entry: options[:queue_entry], operation: operation, input: input,
-                    authorization: authorization, request_id: request_id, **options))
-                rescue Ace::Assign::AttemptErrors::EvidenceUnavailable, Ace::Lab::InvalidConfigurationError => e
-                  # Infra failures (unreadable canonical evidence, malformed
-                  # installed configuration, unavailable topology) are the
-                  # caller-side blocker, never a raw crash and never a durable
-                  # reference (review r1 finding B).
-                  return emit(Organisms::OrdinaryMergeRequest.refusal_envelope(
-                    "ordinary_merge_unavailable", e.message, request_id: request_id, input_digest: nil
-                  ))
-                end
-              end
-              selected = protected_service.selected?(options)
-              if selected
-                return emit(protected_service.request(project: project, assignment: assignment, attempt: attempt,
-                  operation: operation, input_path: input, authorization: authorization, request_id: request_id, **options))
-              end
-              emit(service.request(project: project, assignment: assignment, attempt: attempt,
-                operation: operation, input_path: input, authorization: authorization,
-                request_id: request_id, dry_run: options[:dry_run]))
-            rescue ArgumentError, Ace::Assign::Error, Ace::Git::Error, Ace::Runtime::RuntimeUnavailableError, JSON::ParserError, SecurityError, KeyError, SystemCallError => error
-              raise if selected == false || mode
-              protected_refusal(error)
-            end
-
-            private
-
-            def ordinary_producer
-              @ordinary_producer ||= Organisms::OrdinaryMergeRequest.new
-            end
-
-            # The ordinary refusal envelope is emitted exactly as received;
-            # it is classified for the non-zero exit like every refusal.
-            def ordinary_request(**arguments)
-              ordinary_producer.request(**arguments)
-            end
-          end
-
-          class Status < Ace::Support::Cli::Command
-            include Ace::Support::Cli::Base
-            include Runtime
-            include Output
-
-            desc "Read the authoritative outcome of a service request"
-            option :request, type: :string, required: true, desc: "Request ID"
-            option :format, type: :string, desc: "Output format (json only)"
-            option :mode, type: :string, desc: "ordinary-merge selects the read-only ordinary status"
-            option :reference, type: :string, desc: "Opaque ordinary merge reference"
-            option :queue_entry, type: :string, desc: "Original queue entry (ordinary merge)"
-
-            option :project, type: :string, desc: "Original project ID"
-            option :assignment, type: :string, desc: "Original assignment ID"
-            option :attempt, type: :string, desc: "Original attempt ID"
-            option :mapping, type: :string, desc: "Original protected mapping ID"
-            option :scope, type: :string, desc: "Original hierarchical prepared scope"
-            option :candidate_head, type: :string, desc: "Exact approved candidate head"
-            option :candidate_generation, type: :integer, desc: "Original candidate generation"
-            option :input_digest, type: :string, desc: "Original normalized input SHA-256"
-            option :target, type: :string, desc: "Original target resource ID"
-            option :artifact_digest, type: :string, desc: "Original artifact SHA-256 (omit for null)"
-
-            def call(request:, **options)
-              reject_identity_flags!(options)
-              mode = options[:mode]
-              if mode && mode != Organisms::OrdinaryMergeRequest::MODE
-                return emit(Organisms::OrdinaryMergeRequest.refusal_envelope("ordinary_merge_invalid_request",
-                  "unknown service mode", request_id: request, input_digest: nil,
-                  schema: Ace::Assign::Atoms::FixedMergeSchemas::STATUS_ERROR_SCHEMA_ID))
-              end
-              if mode
-                ensure_json_format!(options)
-                begin
-                  return emit(ordinary_producer.status(project: options[:project], assignment: options[:assignment],
-                    attempt: options[:attempt], queue_entry: options[:queue_entry], reference: options[:reference],
-                    request: request, input_digest: options[:input_digest], **options))
-                rescue Ace::Assign::AttemptErrors::EvidenceUnavailable, Ace::Lab::InvalidConfigurationError => e
-                  return emit(Organisms::OrdinaryMergeRequest.refusal_envelope(
-                    "ordinary_merge_unavailable", e.message, request_id: request, input_digest: nil,
-                    schema: Ace::Assign::Atoms::FixedMergeSchemas::STATUS_ERROR_SCHEMA_ID
-                  ))
-                end
-              end
-              selected = protected_service.selected?(options)
-              if selected
-                return emit(protected_service.status(request_id: request, **options))
-              end
-              emit(service.status(request_id: request))
-            rescue ArgumentError, Ace::Assign::Error, Ace::Git::Error, Ace::Runtime::RuntimeUnavailableError, JSON::ParserError, SecurityError, KeyError, SystemCallError => error
-              raise if selected == false || mode
-              protected_refusal(error)
-            end
-
-            private
-
-            def ordinary_producer
-              @ordinary_producer ||= Organisms::OrdinaryMergeRequest.new
-            end
-          end
-
-          # The ordinary receiver serve entrypoint (spec 8x3.t.xz9.4
-          # execution clauses; 8x3.t.xz9.5 integration handoff): binds the
-          # configured unix socket, mutually authenticates every connection
-          # through OS peer credentials, admits through the canonical Assign
-          # coordinator, executes the authorized fixed operation — one REAL
-          # Forgejo merge under the scoped host-installed service identity —
-          # and settles the exact terminal receipt proven by real forge
-          # readback. Configuration is one explicit deployment-owned file
-          # plus the host-installed authorization and forge-merge documents;
-          # the host owns their placement and credentials. Blocks until
-          # stopped.
-          class Listen < Ace::Support::Cli::Command
-            include Ace::Support::Cli::Base
-            include Output
-
-            desc "Serve ordinary Assign, HITL and fixed merge under the installed journal owner"
-            option :mode, type: :string, required: true,
-              desc: "ordinary-merge selects the ordinary fixed merge receiver"
-            option :project, type: :string, required: true, desc: "Project stable ID"
-            option :config, type: :string, required: true,
-              desc: "Deployment-owned receiver configuration file (YAML)"
-
-            def call(mode:, project:, config:, **options)
-              unless options.empty?
-                return emit(Organisms::OrdinaryMergeRequest.refusal_envelope(
-                  "ordinary_merge_invalid_request",
-                  "unknown listen selector: #{options.keys.sort.join(", ")}",
-                  request_id: "unknown", input_digest: nil
-                ))
-              end
-              unless mode == Organisms::OrdinaryMergeRequest::MODE
-                return emit(Organisms::OrdinaryMergeRequest.refusal_envelope(
-                  "ordinary_merge_invalid_request", "unknown service mode",
-                  request_id: "unknown", input_digest: nil
-                ))
-              end
-              receiver_config = Molecules::OrdinaryReceiverConfig.load(config)
-              unless receiver_config.project == project
-                return emit(Organisms::OrdinaryMergeRequest.refusal_envelope(
-                  "ordinary_merge_selection_mismatch",
-                  "configured project does not match the requested project",
-                  request_id: "unknown", input_digest: nil
-                ))
-              end
-              unless receiver_config.receiver_uid == Process.uid
-                raise Ace::Lab::InvalidConfigurationError, "receiver must run as its configured UID"
-              end
-              server = Organisms::OrdinaryAuthorityComposition.new(receiver_config: receiver_config).build
-              signals = %w[INT TERM].to_h { |signal| [signal, Signal.trap(signal) { server.request_stop }] }
-              server.serve
-            rescue Ace::Lab::InvalidConfigurationError, Ace::Assign::Error, Ace::Runtime::Error, Ace::Hitl::Lifecycle::Error => e
-              emit(Organisms::OrdinaryMergeRequest.refusal_envelope(
-                "ordinary_merge_unavailable", e.message,
-                request_id: "unknown", input_digest: nil
-              ))
-            ensure
-              signals&.each { |signal, handler| Signal.trap(signal, handler) }
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/models/service_receipt.rb

@@ -1,18 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Lab
-    module Models
-      # Non-secret result submitted to the assignment evidence coordinator.
-      # The coordinator independently verifies every binding before acceptance.
-      module ServiceReceipt
-        BINDING_FIELDS = %w[request_id assignment_id attempt_id project_id operation
-          input_digest target candidate_head executor_uid transport].freeze
-
-        def self.build(binding, executor_result)
-          BINDING_FIELDS.to_h { |field| [field, binding.fetch(field)] }.merge(executor_result)
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/molecules/command_owner_admission.rb

@@ -1,183 +0,0 @@
-# frozen_string_literal: true
-
-require "find"
-require "ace/assign/authority/command_execution"
-require "ace/herdr/molecules/bounded_observation"
-require "ace/runtime/molecules/process_identity"
-require_relative "command_policy"
-
-module Ace
-  module Lab
-    module Molecules
-      # Adds the project-command principals to the same installed listener.
-      # Root launch facts do not impersonate a participant/native agent.
-      class CommandOwnerAdmission
-        def initialize(base:, project:, policy_loader: nil)
-          @base, @project = base, project
-          @policy_loader = policy_loader || -> { CommandPolicy.load(project: @project) }
-          @peer = Ace::Assign::Authority::OrdinaryPeer.new
-        end
-        def service = @base.service
-        def verify_listener! = @base.verify_listener!
-        def peer(socket, deadline:) = @base.peer(socket, deadline: deadline)
-        def authorize!(request:, peer:, deadline:)
-          return @base.authorize!(request: request, peer: peer, deadline: deadline) unless Ace::Assign::Authority::CommandExecution::OPERATIONS.include?(request["operation"])
-          raise Ace::Assign::AttemptErrors::UnauthorizedIdentity unless request["project_id"] == @project
-          if %w[command_claim command_bind command_complete].include?(request["operation"])
-            command_launcher!(peer: peer, deadline: deadline)
-          elsif request["operation"] == "command_status"
-            @peer.live!(peer, deadline: deadline) # Handler checks original requester before exposing data.
-          else
-            command_reader!(peer: peer, deadline: deadline)
-          end
-          :worker
-        end
-
-        def command_reader!(peer:, deadline:, definition: nil)
-          @peer.live!(peer, deadline: deadline)
-          return true if peer["uid"] == 0 && command_launcher!(peer: peer, deadline: deadline)
-          if definition
-            # Inspection never grants a second effect. Original requester UID
-            # retains reconciliation after policy revocation or process restart.
-            unless definition.dig("requester", "uid") == peer.fetch("uid")
-              raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "command reference belongs to another requester"
-            end
-            return true
-          end
-          # Authorize visibility through the same closed selection machinery;
-          # absence of any configured grant is a refusal, not native inference.
-          document = policy
-          document.reader!(peer.fetch("uid"))
-        end
-
-        def command_request!(selection:, peer:, deadline:)
-          @peer.live!(peer, deadline: deadline)
-          selected = policy.select(selection: selection, peer: peer)
-          if selected.fetch("requester_kind") == "agent"
-            selected["native_binding"] = @base.identity!(peer: peer, pane: selection.fetch("pane"), deadline: deadline).runtime_binding
-          end
-          verify_context!(selected, deadline)
-          selected
-        end
-
-        # Historical execution can outlive its requester. Current root policy
-        # and immutable source/executable must still grant this exact TEST
-        # command; requester liveness does not invent a new execution.
-        def command_test_evidence!(definition:, deadline:)
-          unless definition["purpose"] == "test" && definition.dig("source", "head") && definition.dig("source", "tree") &&
-              policy.select(selection: definition.fetch("selection"), peer: definition.fetch("requester")) == definition.except("native_binding")
-            raise Ace::Assign::AttemptErrors::ReceiptRejected, "executed test command policy was revoked or changed"
-          end
-          verify_context!(definition, deadline)
-        rescue SecurityError, Ace::Lab::InvalidConfigurationError
-          raise Ace::Assign::AttemptErrors::ReceiptRejected, "executed test command policy or source is unavailable"
-        end
-
-        def command_launcher!(peer:, deadline:)
-          @peer.live!(peer, deadline: deadline)
-          expected = JSON.parse(GrantResolver.read_verified(policy.launcher.fetch("identity_path")) || "null")
-          unless expected.is_a?(Hash) && expected.keys.sort == %w[identity schema] &&
-              expected["schema"] == "labd-command-launcher/v1" && expected["identity"].is_a?(Hash) &&
-              expected["identity"]["uid"] == 0 && peer["uid"] == 0
-            raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "installed command launcher differs"
-          end
-          target = expected.fetch("identity")
-          @peer.live!(target, deadline: deadline)
-          cursor = peer
-          64.times do
-            return target if cursor.slice("pid", "uid", "host", "started_at") == target.slice("pid", "uid", "host", "started_at")
-            break unless RUBY_PLATFORM.include?("linux") && cursor["uid"] == 0
-            stat = File.read("/proc/#{cursor.fetch('pid')}/stat")
-            parent = Integer(stat[(stat.rindex(")") + 2)..].split.fetch(1), 10)
-            break if parent <= 1
-            @peer.live!(cursor, deadline: deadline)
-            identity = Ace::Runtime::Molecules::ProcessIdentity.new(executor:
-              Ace::Herdr::Molecules::BoundedObservation.new(deadline: deadline)).capture(parent)
-            break unless identity
-            cursor = identity
-          end
-          raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "command helper is outside installed launcher ancestry"
-        rescue JSON::ParserError, SystemCallError, IndexError, ArgumentError
-          raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "installed command launcher is unavailable"
-        end
-
-        def command_claim!(definition:, caller:, launcher:, deadline:)
-          command_launcher!(peer: launcher, deadline: deadline)
-          unless caller == definition.fetch("requester") && command_request!(selection: definition.fetch("selection"), peer: caller, deadline: deadline) == definition
-            raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "command requester or policy changed"
-          end
-          true
-        end
-
-        def command_child!(definition:, child:, launcher:, deadline:)
-          command_launcher!(peer: launcher, deadline: deadline)
-          unless command_request!(selection: definition.fetch("selection"), peer: definition.fetch("requester"), deadline: deadline) == definition
-            raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "command admission changed before exec"
-          end
-          # The authenticated root daemon witnesses cwd/identity after dropping
-          # the gated child. Owner independently captures its kernel generation.
-          keys = %w[pid uid gid groups started_at host cwd process_group no_new_privs capabilities]
-          actual = Ace::Runtime::Molecules::ProcessIdentity.new(executor:
-            Ace::Herdr::Molecules::BoundedObservation.new(deadline: deadline)).capture(child["pid"])
-          executor = definition.fetch("executor")
-          unless child.is_a?(Hash) && child.keys.sort == keys.sort && actual &&
-              actual == child.slice("pid", "uid", "started_at", "host") &&
-              child["no_new_privs"] == 1 && child["capabilities"].is_a?(Hash) &&
-              child["capabilities"].keys.sort == %w[CapAmb CapEff CapInh CapPrm] &&
-              child["capabilities"].values.all? { |value| value.is_a?(String) && value.match?(/\A0{16}\z/) } &&
-              child.values_at("uid", "gid", "groups", "cwd", "process_group") ==
-                [executor.fetch("uid"), executor.fetch("gid"), executor.fetch("groups"), executor.fetch("cwd"), child.fetch("pid")]
-            raise Ace::Assign::AttemptErrors::UnauthorizedIdentity, "gated command child differs"
-          end
-          {"kernel_identity" => actual, "root_witness" => child, "witnessed_by" => launcher}
-        end
-
-        private
-
-        def policy = @policy_loader.call
-
-        def verify_context!(definition, deadline)
-          executor = definition.fetch("executor")
-          cwd = executor.fetch("cwd")
-          wire = Ace::Runtime::Molecules::ProtectedSocket
-          wire.root_path!(cwd, directory: true)
-          executor.fetch("path").each { |entry| GrantResolver.trusted_directory!(entry) }
-          home = executor.fetch("home")
-          GrantResolver.trusted_directory!(home) if File.exist?(home) || File.symlink?(home)
-          count = 0
-          Find.find(cwd) do |path|
-            raise InvalidConfigurationError, "command source exceeds verification bound" if (count += 1) > 20_000 || Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
-            stat = File.lstat(path)
-            unless stat.uid.zero? && (stat.mode & 0o022).zero? && !stat.symlink? && (stat.file? || stat.directory?)
-              raise InvalidConfigurationError, "command source must be an immutable installed view"
-            end
-          end
-          executable = File.expand_path(definition.fetch("argv").first, cwd)
-          raise InvalidConfigurationError, "command executable exceeds verification bound" if File.size(executable) > 64 * 1024 * 1024
-          bytes = GrantResolver.read_verified(executable)
-          unless bytes && File.executable?(executable) && Digest::SHA256.hexdigest(bytes) == definition.fetch("executable_sha256")
-            raise InvalidConfigurationError, "command executable differs"
-          end
-          source = definition.fetch("source")
-          if source.fetch("head")
-            result = Ace::Herdr::Molecules::BoundedProcess.call(["/usr/bin/git", "-c", "safe.directory=#{cwd}",
-              "-c", "core.hooksPath=/dev/null", "-c", "core.fsmonitor=false", "rev-parse", "HEAD", "HEAD^{tree}"],
-              environment: Ace::Assign::Molecules::InstalledJournalRead::ENVIRONMENT, chdir: cwd,
-              stdin_data: "", timeout_s: deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC), output_limit: 1024, cleanup_group: true)
-            unless result.status.success? && result.stdout.lines.map(&:strip) == source.values_at("head", "tree")
-              raise InvalidConfigurationError, "command accepted source differs"
-            end
-            clean = Ace::Herdr::Molecules::BoundedProcess.call(["/usr/bin/git", "-c", "safe.directory=#{cwd}",
-              "-c", "core.hooksPath=/dev/null", "-c", "core.fsmonitor=false", "status", "--porcelain=v1", "-z", "--untracked-files=all"],
-              environment: Ace::Assign::Molecules::InstalledJournalRead::ENVIRONMENT, chdir: cwd,
-              stdin_data: "", timeout_s: deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC), output_limit: 65_536, cleanup_group: true)
-            unless clean.status.success? && clean.stdout.empty? && !clean.oversized
-              raise InvalidConfigurationError, "command accepted source is dirty"
-            end
-          end
-          true
-        end
-      end
-    end
-  end
-end