ace-lab 0.9.0 → 0.13.0

data/lib/ace/lab/molecules/ordinary_socket.rb

@@ -1,126 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require "socket"
-
-module Ace
-  module Lab
-    module Molecules
-      # Admission transport between the ordinary fixed merge producer and the
-      # installed ordinary receiver: one bounded JSON document each way over
-      # a configured unix stream socket with a fixed deadline. Authentication
-      # is mutual through OS peer credentials — the producer verifies the receiver's
-      # configured UID and transmits the verified local caller identity, so
-      # no caller-selected credential, token or endpoint exists. This is not
-      # an HTTP transport; a lost or unauthenticated response is a
-      # caller-side blocker (ordinary_merge_unavailable), never a refusal.
-      class OrdinarySocket
-        LIMIT = 16_384
-        HANDSHAKE = "ace-lab/ordinary-merge/v1"
-
-        # @param socket_path [String] installed receiver endpoint (configuration)
-        # @param receiver_uid [Integer] the only UID the receiver may run as
-        # @param deadline [Time] absolute deadline for connect/write/read
-        def initialize(socket_path:, receiver_uid:, deadline: Time.now.utc + 30)
-          @socket_path = socket_path
-          @receiver_uid = receiver_uid
-          @deadline = deadline
-        end
-
-        # Submit one bounded request document; returns the parsed response
-        # document. Any framing, deadline or identity failure raises
-        # OrdinaryUnavailable so the producer can classify the blocker.
-        def submit(document)
-          payload = JSON.generate(document)
-          raise OrdinaryUnavailable, "request document exceeds the wire bound" if payload.bytesize > LIMIT
-          socket = nil
-          begin
-            socket = UNIXSocket.new(@socket_path)
-            verify_peer!(socket)
-            write_all!(socket, "#{HANDSHAKE} #{payload.bytesize}\n#{payload}")
-            response = read_response!(socket)
-          rescue OrdinaryUnavailable
-            raise
-          rescue SystemCallError, IOError, SocketError, NotImplementedError => e
-            raise OrdinaryUnavailable, "receiver transport failed: #{e.class}"
-          ensure
-            begin
-              socket&.close
-            rescue IOError
-              nil
-            end
-          end
-          response
-        end
-
-        class OrdinaryUnavailable < ::StandardError; end
-
-        private
-
-        def verify_peer!(socket)
-          peer_uid, = socket.getpeereid
-          return if peer_uid == @receiver_uid
-          raise OrdinaryUnavailable, "receiver endpoint identity is not the installed receiver"
-        end
-
-        def write_all!(socket, bytes)
-          written = 0
-          while written < bytes.bytesize
-            begin
-              raise OrdinaryUnavailable, "receiver write deadline expired" if expired?
-              written += socket.write_nonblock(bytes.byteslice(written..))
-            rescue IO::WaitWritable
-              socket.wait_writable(remaining!) or raise OrdinaryUnavailable, "receiver write deadline expired"
-            end
-          end
-        end
-
-        def read_response!(socket)
-          header = read_line!(socket)
-          match = /\A#{Regexp.escape(HANDSHAKE)} (\d{1,5})\n\z/o.match(header)
-          raise OrdinaryUnavailable, "receiver response header is invalid" unless match
-          length = Integer(match[1])
-          raise OrdinaryUnavailable, "receiver response exceeds the wire bound" if length > LIMIT
-          body = read_exact!(socket, length)
-          JSON.parse(body, allow_duplicate_key: false, create_additions: false, max_nesting: 16)
-        rescue JSON::ParserError
-          raise OrdinaryUnavailable, "receiver response is not valid JSON"
-        end
-
-        def read_line!(socket)
-          line = +""
-          until line.end_with?("\n")
-            raise OrdinaryUnavailable, "receiver response header is unbounded" if line.bytesize > 128
-            line << read_exact!(socket, 1)
-          end
-          line
-        end
-
-        def read_exact!(socket, length)
-          buffer = +""
-          while buffer.bytesize < length
-            begin
-              raise OrdinaryUnavailable, "receiver read deadline expired" if expired?
-              chunk = socket.read_nonblock(length - buffer.bytesize)
-              raise OrdinaryUnavailable, "receiver closed the connection" if chunk.nil?
-              buffer << chunk
-            rescue IO::WaitReadable
-              socket.wait_readable(remaining!) or raise OrdinaryUnavailable, "receiver read deadline expired"
-            end
-          end
-          buffer
-        end
-
-        def expired?
-          Time.now.utc >= @deadline
-        end
-
-        def remaining!
-          left = @deadline - Time.now.utc
-          raise OrdinaryUnavailable, "receiver deadline expired" if left <= 0
-          left
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/molecules/ordinary_worktree_read.rb

@@ -1,216 +0,0 @@
-# frozen_string_literal: true
-
-require "ace/assign/molecules/installed_journal_read"
-
-module Ace
-  module Lab
-    module Molecules
-      # Observe a mutable ordinary worker checkout. The root-installed project
-      # selection supplies both boundaries; caller input never selects a Git
-      # repository. This is historical observation, not a checkout freeze.
-      class OrdinaryWorktreeRead
-        def initialize(root:, common_dir:, deadline:)
-          @root, @common, @deadline = root, common_dir, deadline
-          [root, common_dir].each { |path| absolute!(path) }
-        end
-
-        def observe(cwd)
-          absolute!(cwd)
-          remaining
-          unless within?(cwd, @root)
-            unavailable!("worker working directory is outside installed worktrees")
-          end
-          before = selection(cwd)
-          head = git(before, "rev-parse", "--verify", "HEAD^{commit}").strip
-          unavailable!("worker HEAD is unavailable") unless head.match?(/\A[0-9a-f]{40}\z/)
-          after = selection(cwd)
-          unless before == after && git(after, "rev-parse", "--verify", "HEAD^{commit}").strip == head
-            unavailable!("worker checkout changed during observation")
-          end
-          {"cwd" => cwd, "worktree" => before.fetch("worktree"), "git_dir" => before.fetch("git_dir"),
-            "common_dir" => @common, "head" => head}
-        rescue SystemCallError, IOError, Timeout::Error, Ace::Herdr::Molecules::BoundedProcess::PostLaunchError
-          unavailable!("worker checkout cannot be observed")
-        end
-
-        def ref_head(cwd, ref)
-          unless ref.is_a?(String) && ref.match?(%r{\Arefs/[a-zA-Z0-9_./-]+\z}) && !ref.include?("..")
-            unavailable!("selected Git ref is invalid")
-          end
-          with_selected_read(cwd) do |selected|
-            head = git(selected, "rev-parse", "--verify", "#{ref}^{commit}").strip
-            unavailable!("selected ref is not a commit") unless head.match?(/\A[0-9a-f]{40}\z/)
-            head
-          end
-        end
-
-        def commit?(cwd, head)
-          exact_head!(head)
-          with_selected_read(cwd) do |selected|
-            git(selected, "rev-parse", "--verify", "--quiet", "#{head}^{commit}", allowed_status: [0, 1], result: true).status.success?
-          end
-        end
-
-        def ancestor?(cwd, ancestor, descendant)
-          exact_head!(ancestor); exact_head!(descendant)
-          with_selected_read(cwd) do |selected|
-            git(selected, "merge-base", "--is-ancestor", ancestor, descendant, allowed_status: [0, 1], result: true).status.success?
-          end
-        end
-
-        private
-
-        def exact_head!(head)
-          unavailable!("selected Git head is invalid") unless head.is_a?(String) && head.match?(/\A[0-9a-f]{40}\z/)
-        end
-
-        def with_selected_read(cwd)
-          absolute!(cwd)
-          unavailable!("selected repository leaves installed worktrees") unless within?(cwd, @root)
-          before = selection(cwd)
-          value = yield before
-          unavailable!("selected repository changed during read") unless before == selection(cwd)
-          value
-        rescue SystemCallError, IOError, Timeout::Error, Ace::Herdr::Molecules::BoundedProcess::PostLaunchError => error
-          unavailable!("selected repository cannot be observed (#{error.class})")
-        end
-
-        def selection(cwd)
-          directory!(cwd)
-          directory!(@common)
-          worktree = cwd
-          loop do
-            break if File.exist?(File.join(worktree, ".git")) || File.symlink?(File.join(worktree, ".git"))
-            unavailable!("worker checkout is unavailable") if worktree == @root
-            worktree = File.dirname(worktree)
-          end
-          marker = File.join(worktree, ".git")
-          metadata = {}
-          git_dir = if File.lstat(marker).directory?
-            directory!(marker)
-            unavailable!("worker belongs to another project") unless marker == @common
-            marker
-          else
-            bytes = regular!(marker, metadata, 4096)
-            match = bytes.match(/\Agitdir: ([^\n\0]+)\n?\z/)
-            unavailable!("worker Git pointer is invalid") unless match
-            selected = File.expand_path(match[1], worktree)
-            unless File.dirname(selected) == File.join(@common, "worktrees")
-              unavailable!("worker Git pointer leaves installed project")
-            end
-            directory!(selected)
-            common = regular!(File.join(selected, "commondir"), metadata, 4096).strip
-            unavailable!("worker common directory differs") unless File.expand_path(common, selected) == @common
-            back = regular!(File.join(selected, "gitdir"), metadata, 4096).strip
-            unavailable!("worker Git backpointer differs") unless back == marker
-            selected
-          end
-          @entries = 0
-          %w[objects refs].each { |name| storage!(File.join(@common, name)) }
-          %w[commondir shallow reftable info/grafts objects/info/alternates objects/info/http-alternates].each do |name|
-            path = File.join(@common, name)
-            unavailable!("worker object storage is redirected") if File.exist?(path) || File.symlink?(path)
-          end
-          regular!(File.join(git_dir, "HEAD"), metadata, 4096)
-          packed = File.join(@common, "packed-refs")
-          storage!(packed) if File.exist?(packed) || File.symlink?(packed)
-          local_refs = File.join(git_dir, "refs")
-          storage!(local_refs) if git_dir != @common && (File.exist?(local_refs) || File.symlink?(local_refs))
-          config!(File.join(@common, "config"), metadata)
-          local = File.join(git_dir, "config.worktree")
-          config!(local, metadata) if File.exist?(local) || File.symlink?(local)
-          {"worktree" => worktree, "git_dir" => git_dir, "metadata" => metadata,
-            "directories" => [cwd, worktree, git_dir, @common].to_h { |path| [path, identity(File.lstat(path))] }}
-        end
-
-        def config!(path, metadata)
-          bytes = regular!(path, metadata, 65_536)
-          output = run(["config", "--no-includes", "--null", "--list", "--file", "/dev/stdin"], stdin: bytes)
-          output.split("\0").each do |entry|
-            key, value = entry.split("\n", 2)
-            if key.start_with?("include.", "includeif.", "extensions.") || key == "core.worktree" ||
-                key == "core.repositoryformatversion" && value != "0"
-              unavailable!("worker Git configuration redirects project storage")
-            end
-          end
-        end
-
-        def git(selected, *argv, allowed_status: [0], result: false)
-          captured = run_result(["--git-dir=#{selected.fetch('git_dir')}", "--work-tree=#{selected.fetch('worktree')}",
-            "-c", "safe.directory=#{selected.fetch('worktree')}", "-c", "core.hooksPath=/dev/null",
-            "-c", "core.fsmonitor=false", "-c", "protocol.allow=never", *argv],
-            environment: {"GIT_COMMON_DIR" => @common, "GIT_OBJECT_DIRECTORY" => File.join(@common, "objects")}, allowed_status: allowed_status)
-          result ? captured : captured.stdout
-        end
-
-        def run(argv, stdin: "", environment: {})
-          run_result(argv, stdin: stdin, environment: environment).stdout
-        end
-
-        def run_result(argv, stdin: "", environment: {}, allowed_status: [0])
-          result = Ace::Herdr::Molecules::BoundedProcess.call(["/usr/bin/git", "--no-pager", *argv],
-            environment: Ace::Assign::Molecules::InstalledJournalRead::ENVIRONMENT.merge(environment), chdir: "/",
-            stdin_data: stdin, timeout_s: remaining, output_limit: 65_536, cleanup_group: true)
-          unavailable!("worker Git read failed or exceeded its bound") unless allowed_status.include?(result.status.exitstatus) && !result.oversized
-          result
-        end
-
-        def regular!(path, metadata, limit)
-          directory!(File.dirname(path))
-          File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
-            before = file.stat
-            unavailable!("worker metadata must be a bounded regular file") unless before.file? && before.size <= limit
-            bytes = file.read(limit + 1)
-            unless bytes.bytesize <= limit && stamp(before) == stamp(file.stat) && stamp(before) == stamp(File.lstat(path))
-              unavailable!("worker metadata changed during read")
-            end
-            metadata[path] = [stamp(before), bytes]
-            bytes
-          end
-        end
-
-        def directory!(path)
-          current = path
-          loop do
-            remaining
-            stat = File.lstat(current)
-            unavailable!("worker directory is redirected") unless stat.directory? && !stat.symlink?
-            break if current == "/"
-            current = File.dirname(current)
-          end
-        end
-
-        def storage!(path)
-          remaining
-          @entries += 1
-          unavailable!("worker storage inventory exceeds its bound") if @entries > Ace::Assign::Molecules::InstalledJournalRead::ENTRY_LIMIT
-          stat = File.lstat(path)
-          unavailable!("worker storage is redirected") unless !stat.symlink? && (stat.file? || stat.directory?)
-          Dir.each_child(path) { |name| storage!(File.join(path, name)) } if stat.directory?
-        end
-
-        def absolute!(path)
-          unless path.is_a?(String) && path.bytesize.between?(1, 4096) && !path.include?("\0") &&
-              path.start_with?("/") && File.expand_path(path) == path
-            unavailable!("worker path is invalid")
-          end
-        end
-
-        def within?(path, parent) = path == parent || path.start_with?(parent + "/")
-        def identity(stat) = [stat.dev, stat.ino]
-        def stamp(stat) = [stat.dev, stat.ino, stat.size, stat.mtime, stat.ctime]
-
-        def remaining
-          unless @deadline.is_a?(Numeric) && @deadline.finite? && (left = @deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)).positive?
-            unavailable!("worker observation deadline elapsed")
-          end
-          left
-        end
-
-        def unavailable!(reason)
-          raise Ace::Assign::AttemptErrors::EvidenceUnavailable, reason
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/molecules/protected_cleanup_owner_admission.rb

@@ -1,163 +0,0 @@
-# frozen_string_literal: true
-
-require "ace/assign/authority/service_evidence"
-require_relative "protected_cleanup_owner_client"
-require "ace/assign/authority/endcap"
-require "ace/assign/authority/launch_lifecycle"
-
-module Ace
-  module Lab
-    module Molecules
-      # Only the fixed listener supplies the installed journal snapshot and its
-      # independently observed self binding. A frame selects neither owner.
-      class ProtectedCleanupOwnerAdmission
-        FIELDS = %w[schema kind request_id input_digest claim_binding request_event_digest
-          dispatch_event_digest input operation_owner_binding_digest].freeze
-        INSPECT_FIELDS = (FIELDS + %w[challenge_ref]).freeze
-
-        def initialize(deployment:, authority_id:, mapping_id:, service_id:, kernel:, preview_policy: nil)
-          @deployment, @authority_id, @kernel = deployment, authority_id, kernel
-          @mapping_id, @service_id = mapping_id, service_id
-          @preview_policy = preview_policy
-        end
-
-        def identity_reader!(peer)
-          authority = @deployment.authority(@authority_id)
-          if peer.slice("uid", "gid", "groups") == authority.slice("uid", "gid", "groups")
-            @kernel.live!(peer)
-            return true
-          end
-          receiver!(peer)
-        end
-
-        def connection_group!(gid)
-          authority = @deployment.authority(@authority_id)
-          map = @deployment.mapping(@mapping_id)
-          project = @deployment.project(map.fetch("project_id"))
-          receiver = project.fetch("service_receivers").fetch(@service_id)
-          credentials = project.fetch("peer_credentials").fetch(receiver.fetch("executor_uid").to_s)
-          unless gid.is_a?(Integer) && gid.positive? && [authority, credentials].all? { |principal| principal.fetch("gid") == gid || principal.fetch("groups").include?(gid) }
-            raise SecurityError, "cleanup connection group differs from installed principals"
-          end
-          true
-        end
-
-        def receiver!(peer)
-          map = @deployment.mapping(@mapping_id)
-          project = @deployment.project(map.fetch("project_id"))
-          receiver = project.fetch("service_receivers").fetch(@service_id)
-          credentials = project.fetch("peer_credentials").fetch(receiver.fetch("executor_uid").to_s)
-          unless map.fetch("authority_id") == @authority_id && peer.fetch("uid").is_a?(Integer) && peer.fetch("uid").positive? &&
-              peer.fetch("uid") == receiver.fetch("executor_uid") && peer.fetch("gid") == credentials.fetch("gid") &&
-              peer.fetch("groups") == credentials.fetch("groups")
-            raise SecurityError, "cleanup installed receiver differs"
-          end
-          @kernel.live!(peer)
-          true
-        rescue KeyError, TypeError
-          raise SecurityError, "cleanup installed receiver unavailable"
-        end
-
-        def preview!(frame:, peer:, operation_owner_binding:, journal:)
-          receiver!(peer)
-          Atoms::ProtectedWorkspacePruneInput.object!(frame, %w[schema kind intent maintenance_context])
-          raise SecurityError, "cleanup preview kind differs" unless frame.values_at("schema", "kind") == [ProtectedCleanupOwnerClient::SCHEMA, "preview"]
-          intent = Atoms::ProtectedWorkspacePrunePreview.intent!(frame.fetch("intent"))
-          supplied = Atoms::ProtectedWorkspacePrunePreview.context!(frame.fetch("maintenance_context"))
-          maintenance = supplied.fetch("maintenance")
-          map = @deployment.mapping(@mapping_id)
-          unless intent.fetch("maintenance") == maintenance && maintenance.fetch("mapping_id") == @mapping_id &&
-              maintenance.fetch("project_id") == map.fetch("project_id") && map.fetch("authority_id") == @authority_id
-            raise SecurityError, "cleanup preview installed scope differs"
-          end
-          raise SecurityError, "cleanup preview policy composition unavailable" unless @preview_policy
-          launch = Ace::Assign::Authority::LaunchLifecycle.new(deployment: @deployment, kernel: @kernel)
-          owner = Ace::Assign::Authority::Endcap.new(deployment: @deployment, launch: launch, kernel: @kernel, service_policy: @preview_policy)
-          params = maintenance.except("project_id").merge("service_id" => @service_id,
-            "worker_process_binding" => supplied.fetch("caller_process_binding"))
-          selected = owner.workspace_prune_preview_context_at!(journal: journal, params: params, map: map, peer: peer, role: :executor)
-          raise SecurityError, "cleanup preview canonical selection changed" unless selected == supplied
-          Atoms::ProtectedWorkspacePruneInput.freeze_value({"intent" => intent, "maintenance_context" => selected,
-            "operation_owner_binding" => operation_owner_binding})
-        rescue KeyError, TypeError, ArgumentError
-          raise SecurityError, "cleanup preview canonical selection unavailable"
-        end
-
-        def admit!(frame:, peer:, operation_owner_binding:, journal:)
-          admit_original!(frame: frame, peer: peer, operation_owner_binding: operation_owner_binding, journal: journal, purpose: :execute)
-        end
-
-        def inspect!(frame:, peer:, operation_owner_binding:, journal:)
-          context = admit_original!(frame: frame, peer: peer, operation_owner_binding: operation_owner_binding, journal: journal, purpose: :inspect)
-          reference = frame.fetch("challenge_ref")
-          Atoms::ProtectedWorkspacePruneInput.object!(reference, %w[challenge_event_digest])
-          Atoms::ProtectedWorkspacePruneInput.digest!(reference.fetch("challenge_event_digest"))
-          challenge = Ace::Assign::Authority::ServiceEvidence.new(journal: journal).challenge!(context.fetch("record"), pending: {commit: context.fetch("commit")})
-          unless challenge.fetch("digest") == reference.fetch("challenge_event_digest")
-            raise SecurityError, "cleanup inspection challenge differs"
-          end
-          Atoms::ProtectedWorkspacePruneInput.freeze_value(context.merge("challenge" => challenge))
-        end
-
-        private
-
-        def admit_original!(frame:, peer:, operation_owner_binding:, journal:, purpose:)
-          receiver!(peer)
-          Atoms::ProtectedWorkspacePruneInput.object!(frame, purpose == :execute ? FIELDS : INSPECT_FIELDS)
-          unless frame.values_at("schema", "kind") == [ProtectedCleanupOwnerClient::SCHEMA, purpose.to_s]
-            raise SecurityError, "cleanup invocation kind differs"
-          end
-          Atoms::ProtectedWorkspacePruneInput.token!(frame.fetch("request_id"))
-          (FIELDS - %w[schema kind request_id input]).each do |key|
-            Atoms::ProtectedWorkspacePruneInput.digest!(frame.fetch(key))
-          end
-          input = Atoms::ProtectedWorkspacePruneInput.parse(JSON.generate(frame.fetch("input")))
-          unless Atoms::ServiceInput.digest(input) == frame.fetch("input_digest") &&
-              (purpose == :inspect || digest(operation_owner_binding) == frame.fetch("operation_owner_binding_digest"))
-            raise SecurityError, "cleanup original input or owner differs"
-          end
-          maintenance = input.fetch("maintenance")
-          map = @deployment.mapping(maintenance.fetch("mapping_id"))
-          unless maintenance.fetch("mapping_id") == @mapping_id && map.fetch("authority_id") == @authority_id && map.fetch("project_id") == maintenance.fetch("project_id")
-            raise SecurityError, "cleanup installed scope differs"
-          end
-          unless journal.evidence_mode == :protected
-            raise SecurityError, "cleanup requires the installed protected service evidence owner"
-          end
-          commit = journal.ref_value
-          journal.verify_canonical_prefix!(commit: commit)
-          record = journal.service_request(frame.fetch("request_id"), commit: commit)
-          unless record && record.fetch("service_id") == @service_id && record.slice("project_id", "mapping_id", "assignment_id", "attempt_id") == maintenance &&
-              record.values_at("operation", "dispatch_phase") == ["prune-preserved-workspace", "dispatch_started"] &&
-              (purpose == :execute ? record["state"] == "uncertain" : %w[uncertain failed].include?(record["state"])) &&
-              record.slice("request_id", "input_digest", "claim_binding") == frame.slice("request_id", "input_digest", "claim_binding") &&
-              record.fetch("target") == Atoms::ServiceInput.target(input) &&
-              digest(record.fetch("operation_owner_binding")) == frame.fetch("operation_owner_binding_digest") &&
-              (purpose == :inspect || digest(record.fetch("executor_process_binding")) == digest(peer))
-            raise SecurityError, "cleanup canonical original dispatch differs"
-          end
-          Ace::Assign::Authority::ServiceEvidence.new(journal: journal).context(record, pending: {commit: commit})
-          receiver = @deployment.project(map.fetch("project_id")).fetch("service_receivers").fetch(record.fetch("service_id"))
-          credentials = @deployment.project(map.fetch("project_id")).fetch("peer_credentials").fetch(receiver.fetch("executor_uid").to_s)
-          unless peer.fetch("uid") == record.fetch("executor_uid") && peer.fetch("uid") == receiver.fetch("executor_uid") &&
-              peer.fetch("gid") == credentials.fetch("gid") && peer.fetch("groups") == credentials.fetch("groups")
-            raise SecurityError, "cleanup original executor differs"
-          end
-          @kernel.live!(peer)
-          proof = Ace::Assign::Authority::ServiceEvidence.new(journal: journal).cleanup_dispatch_context!(
-            record, commit: commit, selectors: frame.slice("request_event_digest", "dispatch_event_digest"))
-          if purpose == :execute && proof.fetch("dispatch_record") != record
-            raise SecurityError, "cleanup original executable record differs"
-          end
-          Atoms::ProtectedWorkspacePruneInput.freeze_value(JSON.parse(JSON.generate({"commit" => commit,
-            "record" => record, "input" => input, "operation_owner_binding" => operation_owner_binding,
-            "request_event_digest" => frame.fetch("request_event_digest"), "dispatch_event_digest" => frame.fetch("dispatch_event_digest")})))
-        rescue KeyError, TypeError, ArgumentError
-          raise SecurityError, "cleanup canonical admission is unavailable"
-        end
-
-        def digest(value) = Ace::Assign::Atoms::EvidenceDigest.digest(value)
-      end
-    end
-  end
-end