ace-lab 0.9.0 → 0.13.0

data/lib/ace/lab/molecules/protected_service_policy.rb

@@ -1,156 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require "etc"
-require "ace/assign/atoms/evidence_digest"
-require_relative "../authorization_path"
-require_relative "../atoms/service_input"
-require "ace/git/atoms/service_pr_input"
-require_relative "grant_resolver"
-require_relative "caller_authorizer"
-require_relative "service_policy"
-require_relative "../atoms/protected_workspace_prune_input"
-require_relative "../atoms/protected_publication_input"
-
-module Ace
-  module Lab
-    module Molecules
-      # The receiver and authority share the existing input/policy owners.
-      # Only composition supplies collaborators; no wire-selected policy,
-      # executable, input path or caller identity is accepted here.
-      class ProtectedServicePolicy
-        def initialize(proposal_resolver:, document_loader: nil, cleanup_owner: nil)
-          @proposal_resolver = proposal_resolver
-          @cleanup_owner = cleanup_owner
-          @document_loader = document_loader || -> { GrantResolver.trusted_document(Ace::Lab.authorization_path) }
-        end
-
-        def input_binding(bytes, expected_digest:, expected_target:, operation:)
-          unless bytes.is_a?(String) && bytes.bytesize.between?(1, Atoms::ServiceInput::MAX_BYTES)
-            raise ArgumentError, "structured service input exceeds its fixed limit"
-          end
-          input = if operation == "prune-preserved-workspace"
-            Atoms::ProtectedWorkspacePruneInput.parse(bytes)
-          elsif operation == "publish"
-            Atoms::ProtectedPublicationInput.decode!(bytes)
-          else
-            JSON.parse(bytes)
-          end
-          raise ArgumentError, "structured service input must be an object" unless input.is_a?(Hash)
-          Atoms::ServiceInput.validate!(input)
-          if Ace::Git::Atoms::ServicePrInput::OPERATIONS.include?(operation)
-            Ace::Git::Atoms::ServicePrInput.validate(input, operation: operation)
-          end
-          digest = Atoms::ServiceInput.digest(input)
-          target = Atoms::ServiceInput.target(input)
-          unless digest == expected_digest && target == expected_target
-            raise SecurityError, "structured service input differs from the bound digest or target"
-          end
-          deep_freeze(input: input, input_digest: digest, target: target)
-        rescue JSON::ParserError
-          raise ArgumentError, "structured service input must be valid JSON"
-        end
-
-        def prepare!(binding, input_bytes:)
-          input = input_binding(input_bytes, expected_digest: binding.fetch("input_digest"),
-            expected_target: binding.fetch("target"), operation: binding.fetch("operation"))
-          if binding["operation"] == "publish" && input.fetch(:input).dig("publication", "head") != binding.fetch("candidate_head")
-            raise SecurityError, "publication input head differs from admitted candidate"
-          end
-          authorized = authorize!(binding)
-          canonical = snapshot(binding).merge("executor_uid" => authorized.fetch(:operation).fetch("executor_uid"), "transport" => "unix")
-          deep_freeze(authorized.merge(binding: canonical, input: input.fetch(:input)))
-        end
-
-        # Selected by installed composition, independently of receiver fields.
-        # Ordinary services never acquire this domain-specific root capability.
-        def dispatch_owner_binding!(binding)
-          return nil unless binding.fetch("operation") == "prune-preserved-workspace"
-          unless @cleanup_owner
-            raise SecurityError, "fixed cleanup owner composition is unavailable"
-          end
-          @cleanup_owner.identity!
-        end
-
-        # Called again inside each claim/begin CAS retry using the immutable
-        # binding and ephemeral parsed input, never a caller filesystem path.
-        def authorize!(binding)
-          uid = binding.fetch("caller_uid")
-          document = visible_document!(project: binding.fetch("project_id"), uid: uid)
-          resolver = ->(reference, exact) { @proposal_resolver.call(binding.fetch("project_id"), reference, exact) }
-          policy = ServicePolicy.new(document, resolver)
-          operation = policy.operation!(binding.fetch("operation"), project: binding.fetch("project_id"), service_id: binding.fetch("service_id"))
-          unless operation.fetch("transport", "local") == "local"
-            raise Ace::Lab::InvalidConfigurationError, "protected receiver requires a fixed local handler operation"
-          end
-          unless operation.fetch("executor_uid").positive? && operation.fetch("executor_uid") != uid
-            raise SecurityError, "protected executor must be a separate nonroot account"
-          end
-          if binding.key?("executor_uid") && binding["executor_uid"] != operation.fetch("executor_uid")
-            raise SecurityError, "configured executor differs from the recorded claim"
-          end
-          decision = policy.authorize!(binding.fetch("authorization"), binding)
-          digest = Ace::Assign::Atoms::EvidenceDigest.digest("operation" => operation, "authorization" => decision,
-            "caller_uid" => uid, "project_id" => binding.fetch("project_id"))
-          if binding.key?("policy_digest") && binding["policy_digest"] != digest
-            raise SecurityError, "service policy changed after claim"
-          end
-          deep_freeze(operation: snapshot(operation), policy_digest: digest,
-            operation_digest: Ace::Assign::Atoms::EvidenceDigest.digest(operation))
-        end
-
-        # Read-only selection of the installed named cleanup receiver; no
-        # proposal authorization or effect capability is minted by preview.
-        def workspace_prune_receiver!(project:, uid:, service_id:, executor_uid:)
-          document = visible_document!(project: project, uid: uid)
-          policy = ServicePolicy.new(document, ->(*) { raise SecurityError, "preview cannot resolve proposal grants" })
-          operation = policy.operation!("prune-preserved-workspace", project: project, service_id: service_id)
-          unless operation.fetch("executor_uid") == executor_uid && executor_uid.is_a?(Integer) && executor_uid.positive? && executor_uid != uid
-            raise SecurityError, "preview receiver differs from the installed cleanup operation"
-          end
-          true
-        end
-
-        def visible!(project:, uid:)
-          visible_document!(project: project, uid: uid)
-          true
-        end
-
-        def authorize_update!(existing, replacement, _pending)
-          initial_effect = existing.nil? && %w[accepted uncertain].include?(replacement["state"])
-          fresh_dispatch = existing && existing["dispatch_phase"] == "issued" && replacement["dispatch_phase"] == "dispatch_started"
-          authorize!(replacement) if initial_effect || fresh_dispatch
-          true
-        end
-
-        private
-
-        def visible_document!(project:, uid:)
-          raise SecurityError, "protected caller UID is invalid" unless uid.is_a?(Integer) && uid.positive?
-          username = begin
-            Etc.getpwuid(uid).name
-          rescue ArgumentError
-            nil
-          end
-          document = @document_loader.call
-          identities = CallerAuthorizer.matchable_identities(username, uid)
-          visibility = CallerAuthorizer.new(principals: document.fetch("principals", {}), identity: identities)
-          raise SecurityError, "caller project grant has been revoked" unless visibility.authorized?(project)
-          document
-        end
-
-        def snapshot(value)
-          JSON.parse(JSON.generate(value))
-        end
-
-        def deep_freeze(value)
-          case value
-          when Hash then value.each { |key, item| deep_freeze(key); deep_freeze(item) }
-          when Array then value.each { |item| deep_freeze(item) }
-          end
-          value.freeze
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/molecules/service_executor.rb

@@ -1,99 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require "ace/herdr/molecules/bounded_process"
-require "socket"
-require "timeout"
-require "time"
-
-module Ace
-  module Lab
-    module Molecules
-      # Executes one fixed, deployment-configured argv under its OS account.
-      # Domain handlers receive structured JSON on stdin and return a small
-      # receipt; their stdout/stderr are never journaled or returned to callers.
-      class ServiceExecutor
-        # The trusted policy is reloaded through +policy_loader+ immediately
-        # before the effect: a revocation or operation change after the claim
-        # must still stop dispatch. The candidate head is revalidated through
-        # +head_loader+ for the same reason: a concurrent commit must not let
-        # a stale reviewed candidate execute.
-        def execute(operation:, request:, input:, policy_loader:, authorization:, head_loader:)
-          fresh = policy_loader.call
-          current = fresh.operation!(request.fetch("operation"), project: request.fetch("project_id"),
-            service_id: request.fetch("service_id"))
-          raise SecurityError, "executor operation changed before dispatch" unless current == operation
-          fresh.authorize!(authorization, request)
-          unless head_loader.call == request.fetch("candidate_head")
-            raise SecurityError, "candidate head changed before dispatch"
-          end
-          if Time.iso8601(current.fetch("lease_expires_at")) <= Time.now.utc
-            raise SecurityError, "executor lease has expired"
-          end
-          out = if operation.fetch("transport", "local") == "unix"
-            invoke_unix(operation, request, input)
-          else
-            invoke_local(operation, request, input)
-          end
-          return nil unless out && out.bytesize <= 16 * 1024
-          response = JSON.parse(out)
-          return nil unless valid_response?(response, request)
-          {"outcome" => response.fetch("outcome"), "evidence" => response.fetch("evidence"),
-           "executor_uid" => current.fetch("executor_uid")}
-        rescue JSON::ParserError, Timeout::Error, SystemCallError, IOError,
-          Ace::Herdr::Molecules::BoundedProcess::PostLaunchError
-          # Transport failures after the claim (broken pipe, connection
-          # reset, socket loss) leave the effect unknown: uncertainty, not a
-          # classified crash, is the honest outcome.
-          nil
-        end
-
-        private
-
-        # The existing process owner bounds both streams and the whole run,
-        # and cleans the owned process group on timeout and normal exit.
-        def invoke_local(operation, request, input)
-          unless Process.uid == operation.fetch("executor_uid") && Process.euid == operation.fetch("executor_uid")
-            raise SecurityError, "current OS identity is not the configured executor"
-          end
-          result = Ace::Herdr::Molecules::BoundedProcess.call(operation.fetch("argv"),
-            stdin_data: JSON.generate({"request" => request, "input" => input}),
-            timeout_s: 30, output_limit: 16 * 1024, stderr_limit: 8192, cleanup_group: true)
-          result.stdout if result.status.success? && !result.oversized
-        end
-
-        def invoke_unix(operation, request, input)
-          path = operation.fetch("socket_path")
-          stat = File.lstat(path)
-          unless stat.socket? && stat.uid == operation.fetch("executor_uid") && (stat.mode & 0o002).zero?
-            raise SecurityError, "service socket owner or permissions do not match the executor"
-          end
-          # One deadline covers connecting, writing, and reading: a stalled
-          # peer must leave the claimed effect uncertain, never block.
-          Timeout.timeout(30) do
-            UNIXSocket.open(path) do |socket|
-              peer_uid, = socket.getpeereid
-              raise SecurityError, "service peer identity does not match the executor" unless peer_uid == stat.uid
-              socket.write(JSON.generate({"request" => request, "input" => input}) + "\n")
-              socket.flush
-              socket.gets(16 * 1024 + 1)
-            end
-          end
-        end
-
-        def valid_response?(response, request)
-          response.is_a?(Hash) && response.keys.sort == %w[evidence input_digest outcome request_id] &&
-            response["request_id"] == request["request_id"] &&
-            response["input_digest"] == request["input_digest"] &&
-            %w[succeeded failed].include?(response["outcome"]) &&
-            response["evidence"].is_a?(Array) && !response["evidence"].empty? &&
-            response["evidence"].all? do |item|
-              item.is_a?(Hash) && item.keys.sort == %w[ref sha256] &&
-                item["ref"].is_a?(String) && item["ref"].match?(/\A[a-zA-Z0-9_.:\/-]{1,256}\z/) &&
-                item["sha256"].is_a?(String) && item["sha256"].match?(/\A[0-9a-f]{64}\z/)
-            end
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/molecules/service_policy.rb

@@ -1,289 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "../errors"
-require_relative "../atoms/service_input"
-require "ace/assign/errors"
-require "pathname"
-require "time"
-
-module Ace
-  module Lab
-    module Molecules
-      # Deployment-owned operation and authorization facts. The caller may
-      # name a reference but cannot define its scope or executor binding.
-      class ServicePolicy
-        NAME = /\A[a-z][a-z0-9-]{0,63}\z/
-        ID = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/
-
-        def initialize(document, proposal_resolver = nil)
-          @document = document
-          @operations = document.fetch("operations", {})
-          @authorizations = document.fetch("authorizations", {})
-          @proposal_resolver = proposal_resolver
-          unless @operations.is_a?(Hash) && @authorizations.is_a?(Hash)
-            raise Ace::Lab::InvalidConfigurationError, "trusted service policy must contain mappings"
-          end
-        end
-
-        # The trusted installation document as loaded. Decisions are mutable;
-        # all other configuration remains bound for the receiver lifetime.
-        attr_reader :document
-
-        def self.configuration_digest(document)
-          Atoms::ServiceInput.digest(document.except("authorizations"))
-        end
-
-        def operation!(name, project:, service_id:)
-          raise ArgumentError, "invalid operation name" unless name.to_s.match?(NAME)
-          operation = @operations[name]
-          raise SecurityError, "operation is not configured" unless operation.is_a?(Hash)
-          unless operation["project"] == project && operation["service_id"] == service_id
-            raise SecurityError, "operation does not authorize the selected service in this project"
-          end
-          transport = operation.fetch("transport", "local")
-          unless %w[local unix].include?(transport)
-            raise Ace::Lab::InvalidConfigurationError, "configured service transport is invalid"
-          end
-          if transport == "local"
-            argv = operation["argv"]
-            unless argv.is_a?(Array) && !argv.empty? && argv.all? { |v| v.is_a?(String) && !v.empty? } &&
-                argv.first.start_with?("/") && File.file?(argv.first) && File.executable?(argv.first)
-              raise Ace::Lab::InvalidConfigurationError, "configured operation needs a fixed executable argv"
-            end
-          elsif !operation["socket_path"].is_a?(String) || !operation["socket_path"].start_with?("/")
-            raise Ace::Lab::InvalidConfigurationError, "unix service needs an absolute socket path"
-          end
-          uid = operation["executor_uid"]
-          raise Ace::Lab::InvalidConfigurationError, "configured executor UID is invalid" unless uid.is_a?(Integer) && uid >= 0
-          if transport == "local"
-            # Every path component is validated (symlinks resolved, writable
-            # ancestors rejected) and the validated resolved file replaces
-            # the configured argv entry, so execution cannot be redirected
-            # between validation and dispatch.
-            resolved = trusted_executable!(operation["argv"].first, uid)
-            operation = operation.merge("argv" => [resolved] + operation["argv"][1..])
-          end
-          expires_at = parse_time(operation["lease_expires_at"])
-          raise SecurityError, "executor lease has expired" if expires_at <= Time.now.utc
-          if operation["host_maintenance"] == true
-            # Maintenance executes a fixed updater outside the replaced
-            # deployment; a socket-only operation has no executable to place
-            # and cannot prove the maintenance boundary.
-            unless transport == "local"
-              raise Ace::Lab::InvalidConfigurationError,
-                "host maintenance requires a local executable transport"
-            end
-            deployment_root = operation["deployment_root"].to_s
-            sink_path = operation["evidence_sink"].to_s
-            unless deployment_root.start_with?("/") && sink_path.start_with?("/")
-              raise Ace::Lab::InvalidConfigurationError,
-                "host maintenance needs absolute deployment and evidence sink paths"
-            end
-            deployment = resolved_path(deployment_root)
-            sink = resolved_path(sink_path)
-            executable = operation.dig("argv", 0).to_s
-            unless deployment.start_with?("/") && sink.start_with?("/") && executable.start_with?("/") &&
-                !inside?(executable, deployment) && !inside?(sink, deployment)
-              raise Ace::Lab::InvalidConfigurationError,
-                "host maintenance needs executable and evidence sink outside the replaced deployment"
-            end
-          end
-          operation
-        end
-
-        def authorize!(reference, binding)
-          raise ArgumentError, "invalid authorization reference" unless reference.to_s.match?(ID)
-          if reference.start_with?("proposal-")
-            raise SecurityError, "canonical proposal authority is unavailable" unless @proposal_resolver
-            begin
-              return @proposal_resolver.call(reference, binding)
-            rescue Ace::Assign::Error
-              raise SecurityError, "canonical proposal does not authorize this exact effect"
-            end
-          end
-          decision = @authorizations[reference]
-          raise SecurityError, "authorization reference is unresolved" unless decision.is_a?(Hash)
-          required = %w[operation project_id assignment_id attempt_id input_digest target candidate_head caller_uid]
-          unless required.all? { |key| decision[key] == binding[key] }
-            raise SecurityError, "authorization does not match the exact service request"
-          end
-          raise SecurityError, "authorization has expired" if parse_time(decision["expires_at"]) <= Time.now.utc
-          decision
-        end
-
-        # ---- ordinary fixed merge admission policy (spec 8x3.t.xz9.4) ------
-        #
-        # The installed ordinary section is the separately configured
-        # ordinary receiver mapping and admission policy. It supplies
-        # identity and placement only: the caller selects no endpoint,
-        # credential or receiver. An absent project section or a disabled
-        # admission flag is rollback: new admission is unavailable while
-        # canonical records and read-only status stay preserved.
-        ORDINARY_SECTION_KEYS = %w[projects].freeze
-        ORDINARY_PROJECT_KEYS = %w[receiver_id socket_path receiver_uid principal admission journal_repository journal_ref].freeze
-        ORDINARY_AUTHORIZATION_KEYS = %w[operation project_id assignment_id attempt_id queue_entry
-          input_digest forge pr_url head_repository head_ref candidate_head base_repository
-          base_ref expected_base_head expires_at].freeze
-        # expires_at bounds the decision itself; it is never exact-matched
-        # against the request binding, which carries no expiry.
-        ORDINARY_BINDING_KEYS = ORDINARY_AUTHORIZATION_KEYS - %w[expires_at].freeze
-
-        def ordinary_receiver!(project)
-          section = @document["ordinary"]
-          return nil unless section.is_a?(Hash)
-          validate_ordinary_section!(section)
-          entry = section.fetch("projects")[project.to_s]
-          return nil unless entry.is_a?(Hash)
-          entry
-        end
-
-        # The ordinary admission decision: exact-match on every closed
-        # binding key, like authorize!, but over the ordinary request
-        # identity (forge/PR/repository/ref) instead of execution selectors.
-        def authorize_ordinary!(reference, binding)
-          raise ArgumentError, "invalid authorization reference" unless reference.to_s.match?(ID)
-          decision = @authorizations[reference]
-          raise SecurityError, "authorization reference is unresolved" unless decision.is_a?(Hash)
-          unless ORDINARY_AUTHORIZATION_KEYS.all? { |key| decision.key?(key) }
-            raise SecurityError, "authorization reference is not an ordinary merge decision"
-          end
-          unless ORDINARY_BINDING_KEYS.all? { |key| decision[key] == binding[key] }
-            raise SecurityError, "authorization does not match the exact ordinary merge request"
-          end
-          raise SecurityError, "authorization has expired" if parse_time(decision["expires_at"]) <= Time.now.utc
-          decision
-        end
-
-        def validate_ordinary_section!(section)
-          unless (section.keys - ORDINARY_SECTION_KEYS).empty? && section["projects"].is_a?(Hash)
-            raise Ace::Lab::InvalidConfigurationError, "ordinary section must map projects"
-          end
-          section.fetch("projects").each do |project, entry|
-            unless project.is_a?(String) && project.match?(ID) && entry.is_a?(Hash) &&
-                (entry.keys - ORDINARY_PROJECT_KEYS).empty?
-              raise Ace::Lab::InvalidConfigurationError, "ordinary project section is invalid"
-            end
-            unless entry["receiver_id"].is_a?(String) && entry["receiver_id"].match?(ID) &&
-                entry["socket_path"].is_a?(String) && entry["socket_path"].start_with?("/") &&
-                entry["receiver_uid"].is_a?(Integer) && entry["receiver_uid"].positive? &&
-                entry["principal"].is_a?(String) && !entry["principal"].empty?
-              raise Ace::Lab::InvalidConfigurationError, "ordinary receiver mapping is incomplete"
-            end
-            admission = entry.fetch("admission", "enabled")
-            unless %w[enabled disabled].include?(admission)
-              raise Ace::Lab::InvalidConfigurationError, "ordinary admission flag is invalid"
-            end
-            repository, ref = entry.values_at("journal_repository", "journal_ref")
-            unless repository.is_a?(String) && repository.start_with?("/") && !repository.include?("\0") &&
-                File.expand_path(repository) == repository &&
-                ref.is_a?(String) && ref.match?(%r{\Arefs/[a-zA-Z0-9_-]+(?:/[a-zA-Z0-9_-]+)+\z})
-              raise Ace::Lab::InvalidConfigurationError, "ordinary journal selection is invalid"
-            end
-          end
-          true
-        end
-
-        # Inspection never renews effect permission or selects effect argv.
-        def inspection!(name, project:, service_id:, executor_uid:)
-          raise ArgumentError, "invalid inspection operation" unless name.is_a?(String) && name.match?(NAME)
-          operation = @operations[name]
-          unless operation.is_a?(Hash) && operation["project"] == project && operation["service_id"] == service_id &&
-              operation["executor_uid"].is_a?(Integer) && operation["executor_uid"] == executor_uid &&
-              operation.fetch("transport", "local") == "local"
-            raise SecurityError, "inspection does not match the selected original executor"
-          end
-          # This source-composed inspector uses the fixed original root SDK;
-          # configured handler argv cannot select or replace that owner.
-          if name == "prune-preserved-workspace"
-            return {"executor_uid" => executor_uid, "operation" => name}
-          end
-          argv = operation["no_effect_argv"]
-          unless argv.is_a?(Array) && argv.length.between?(1, 16) &&
-              argv.all? { |value| value.is_a?(String) && value.bytesize.between?(1, 1024) && !value.include?("\0") } &&
-              argv.first.start_with?("/")
-            raise Ace::Lab::InvalidConfigurationError, "operation has no fixed no-effect inspector"
-          end
-          executable = trusted_executable!(argv.first, executor_uid)
-          {"executor_uid" => executor_uid, "argv" => [executable] + argv.drop(1)}
-        end
-
-        private
-
-        # Validate the executable and every directory component on its
-        # resolved path: each must be owned by root or the executor and not
-        # group/other-writable, so no ancestor or symlink component can
-        # redirect the fixed argv. Returns the resolved file path.
-        def trusted_executable!(path, uid)
-          resolved = resolved_path(path.to_s)
-          unless resolved.start_with?("/") && File.file?(resolved) && File.executable?(resolved)
-            raise Ace::Lab::InvalidConfigurationError, "configured executable is unavailable"
-          end
-          Pathname.new(resolved).descend do |component|
-            stat = File.stat(component)
-            unless [0, uid].include?(stat.uid) && (stat.mode & 0o022).zero?
-              raise Ace::Lab::InvalidConfigurationError,
-                "configured executable path has a writable or foreign-owned component: #{component}"
-            end
-          end
-          resolved
-        rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
-          raise Ace::Lab::InvalidConfigurationError, "configured executable is unavailable"
-        end
-
-        def inside?(path, root)
-          expanded = File.expand_path(path)
-          base = File.expand_path(root)
-          expanded == base || expanded.start_with?(base + File::SEPARATOR)
-        end
-
-        # Resolve a configured path through symlinks so placement checks see
-        # the real location. Paths may not exist yet (an evidence sink is
-        # created on first use), so the deepest ancestor — counting symlink
-        # components themselves via lstat — is resolved instead of failing;
-        # a dangling symlink resolves through its own target chain rather
-        # than hiding behind its parent.
-        MAX_SYMLINK_DEPTH = 16
-
-        def resolved_path(path, depth = 0)
-          raise Ace::Lab::InvalidConfigurationError, "trusted policy path has a symlink cycle" if depth > MAX_SYMLINK_DEPTH
-          expanded = File.expand_path(path)
-          candidate = expanded
-          candidate = File.dirname(candidate) until candidate == "/" || lstat?(candidate)
-          resolved = begin
-            File.realpath(candidate)
-          rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
-            dangling_target(candidate, depth) || candidate
-          end
-          return resolved unless resolved == candidate && lstat?(candidate) && File.symlink?(candidate)
-          dangling_target(candidate, depth) || resolved
-        rescue Errno::ENOENT, Errno::EACCES, Errno::ELOOP
-          expanded
-        end
-
-        # Follow a dangling symlink's own target chain; nil when the link
-        # cannot be resolved to any concrete location.
-        def dangling_target(link, depth = 0)
-          raise Ace::Lab::InvalidConfigurationError, "trusted policy path has a symlink cycle" if depth > MAX_SYMLINK_DEPTH
-          target = File.readlink(link)
-          target = File.expand_path(target, File.dirname(link)) unless Pathname.new(target).absolute?
-          resolved_path(target, depth + 1)
-        rescue Errno::ENOENT, Errno::EACCES
-          nil
-        end
-
-        def lstat?(path)
-          File.lstat(path)
-          true
-        rescue Errno::ENOENT
-          false
-        end
-
-        def parse_time(value)
-          Time.iso8601(value.to_s)
-        rescue ArgumentError
-          raise Ace::Lab::InvalidConfigurationError, "trusted policy has invalid expiry"
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/organisms/authority_composition.rb

@@ -1,87 +0,0 @@
-# frozen_string_literal: true
-
-require "ace/assign/authority/server"
-require "ace/assign/authority/router"
-require "ace/assign/authority/launch_lifecycle"
-require "ace/assign/authority/endcap"
-require_relative "../molecules/protected_service_policy"
-require "ace/hitl/providers/lab"
-require "ace/hitl/providers/lab/protected_assignment_binding"
-require "ace/hitl/lifecycle/service_publication_binding"
-require "ace/hitl/lifecycle/service"
-
-module Ace
-  module Lab
-    module Organisms
-      # The only full-service composition. The deployed map chooses identity
-      # and placement; source selects all handlers, policy and evidence readers.
-      class AuthorityComposition
-        REQUIRED_ENDCAP = %w[submit_candidate export_candidate assign_review accept_review request_service
-          begin_dispatch publication_challenge publication_continue claim_service_settlement complete_service complete_no_effect submit_result finish recover bind_inbox
-          service_status evidence_fetch].freeze
-
-        def initialize(authority_id:, deployment: Ace::Assign::Authority::Deployment.load,
-          kernel: Ace::Runtime::Molecules::ProtectedLinux.new)
-          @authority_id, @deployment, @kernel = authority_id, deployment, kernel
-        end
-
-        def build
-          @deployment.verify_composition!(@authority_id, composition: "services")
-          unless (REQUIRED_ENDCAP - Ace::Assign::Authority::Endcap::OPERATIONS).empty?
-            raise InvalidConfigurationError, "full-service source composition is incomplete"
-          end
-          projects = @deployment.data.fetch("launch_mappings").values
-            .select { |map| map.fetch("authority_id") == @authority_id }.map { |map| map.fetch("project_id") }.uniq
-          raise InvalidConfigurationError, "full-service authority has no projects" if projects.empty?
-          projects.each do |id|
-            project = @deployment.project(id)
-            unless project["service_receivers"].is_a?(Hash) && !project["service_receivers"].empty?
-              raise InvalidConfigurationError, "full-service project has no fixed receiver"
-            end
-          end
-
-          journals = {}
-          endcap = nil
-          projects.each do |id|
-            project = @deployment.project(id)
-            reader = nil
-            journal = Ace::Assign::Molecules::EvidenceJournal.new(repo_root: project.fetch("journal_repository"),
-              checkout_root: project.fetch("evidence_checkout_root"), ref: project.fetch("evidence_git_ref"), mode: :protected,
-              evidence_reader: ->(reference, record, state, pending) { reader.call(reference, record, state, pending) },
-              service_authorizer: ->(existing, replacement, pending) {
-                endcap.authorize_service_update!(journal: journals.fetch(id), existing: existing,
-                  replacement: replacement, pending: pending)
-              })
-            reader = Ace::Assign::Authority::ServiceEvidence.new(journal: journal)
-            journals[id] = journal
-          end
-          policy = Molecules::ProtectedServicePolicy.new(proposal_resolver: ->(project, reference, binding) {
-            journals.fetch(project).proposal_authorize!(reference, binding)
-          })
-          history = Ace::Assign::Authority::DeploymentHistory.load
-          launch = Ace::Assign::Authority::LaunchLifecycle.new(deployment: @deployment, deployment_history: history,
-            kernel: @kernel, journals: journals)
-          endcap = Ace::Assign::Authority::Endcap.new(deployment: @deployment, launch: launch, kernel: @kernel,
-            service_policy: policy, deployment_history: history)
-          router = Ace::Assign::Authority::Router.new(launch: launch, handlers: [endcap])
-          Ace::Assign::Authority::Server.new(authority_id: @authority_id, deployment: @deployment, kernel: @kernel,
-            lifecycle: router, composition: "services", services: [publication_hitl(endcap, journals)])
-        end
-
-        private
-
-        def publication_hitl(endcap, journals)
-          provider = Ace::Hitl::Providers::Lab
-          policy = provider.grants_policy(grants_path: provider::DEFAULT_GRANTS_PATH)
-          unless policy.service_uid == @deployment.authority(@authority_id).fetch("uid")
-            raise InvalidConfigurationError, "protected HITL service principal differs from installed authority"
-          end
-          ordinary = provider::ProtectedAssignmentBinding.new(authority: endcap, kernel: @kernel, journals: journals)
-          binding = Ace::Hitl::Lifecycle::ServicePublicationBinding.new(ordinary: ordinary, authority: endcap, kernel: @kernel)
-          Ace::Hitl::Lifecycle::Service.new(root: provider::DEFAULT_STORE_ROOT,
-            socket_path: provider::DEFAULT_SOCKET_PATH, binding: binding, policy: policy)
-        end
-      end
-    end
-  end
-end