ace-lab 0.9.0 → 0.13.0

data/lib/ace/lab/organisms/command_executor.rb

@@ -1,220 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require "pty"
-require "etc"
-require "fiddle"
-require "base64"
-require "io/console"
-require "ace/runtime/molecules/owned_child_scope"
-require_relative "command_run_client"
-
-module Ace
-  module Lab
-    module Organisms
-      # Short-lived execution child of the installed root labd, not a listener
-      # or another journal owner. A single Ruby thread forks the gated executor.
-      class CommandExecutor
-        def initialize(project:, owner: nil)
-          @project = project
-          @owner = owner || CommandRunClient.new(project: project).owner
-        end
-
-        def run(socket:, request:)
-          raise SecurityError, "command executor requires Linux root" unless RUBY_PLATFORM.include?("linux") && Process.uid.zero? && Process.euid.zero?
-          strict!(request, %w[execution_id caller tty rows cols])
-          id = request.fetch("execution_id")
-          raise ArgumentError, "invalid command reference" unless id.is_a?(String) && Molecules::CommandPolicy::ID.match?(id)
-          interactive = request.fetch("tty")
-          raise ArgumentError, "invalid terminal mode" unless [true, false].include?(interactive)
-          rows, cols = geometry(request)
-          params = {"execution_id" => id}
-          initial = @owner.call("command_status", params).data
-          unless initial["phase"] == "admitted" && initial.dig("definition", "requester") == request.fetch("caller")
-            raise SecurityError, "original command already claimed or requester differs"
-          end
-          definition = initial.fetch("definition")
-          unless definition.fetch("secret_references").empty?
-            raise SecurityError, "secret command execution capability is not installed"
-          end
-          claimed = @owner.call("command_claim", params.merge("caller" => request.fetch("caller")), mutation_id: "command-claim.#{id}")
-          raise SecurityError, "claim replay cannot execute" if claimed.replayed
-          launch(socket, id, definition, interactive, rows, cols)
-        end
-
-        private
-
-        def launch(socket, id, definition, interactive, rows, cols)
-          raise SecurityError, "command fork requires a single-thread helper" unless Thread.list.count(&:alive?) == 1
-          scope = Ace::Runtime::Molecules::OwnedChildScope.new
-          executor = definition.fetch("executor")
-          user = Etc.getpwuid(executor.fetch("uid"))
-          environment = {"HOME" => executor.fetch("home"), "USER" => user.name, "LOGNAME" => user.name,
-            "PATH" => executor.fetch("path").join(":")}.merge(executor.fetch("environment"))
-          if interactive
-            parent_input, child_output = PTY.open
-            parent_output, child_input = parent_input, child_output
-            child_output.winsize = [rows, cols]
-          else
-            child_input, parent_input = IO.pipe
-            parent_output, child_output = IO.pipe
-            parent_error, child_error = IO.pipe
-          end
-          gate_read, gate_write = IO.pipe
-          ready_read, ready_write = IO.pipe
-          child = fork do
-            begin
-              socket.close
-              [parent_input, parent_output, parent_error, gate_write, ready_read].compact.uniq.each(&:close)
-              Process.setsid
-              child_input.ioctl(0x540E, 0) if interactive # Linux TIOCSCTTY
-              $stdin.reopen(child_input)
-              $stdout.reopen(child_output)
-              $stderr.reopen(child_error || child_output)
-              [child_input, child_output, child_error].compact.uniq.each(&:close)
-              Process.groups = executor.fetch("groups")
-              Process::GID.change_privilege(executor.fetch("gid"))
-              Process::UID.change_privilege(executor.fetch("uid"))
-              File.umask(0o077)
-              prctl = Fiddle::Function.new(Fiddle::Handle::DEFAULT["prctl"],
-                [Fiddle::TYPE_INT, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG], Fiddle::TYPE_INT)
-              raise SecurityError, "cannot inhibit privilege gain" unless prctl.call(38, 1, 0, 0, 0).zero?
-              Dir.chdir(executor.fetch("cwd"))
-              ready_write.write("R")
-              ready_write.close
-              exit! 125 unless IO.select([gate_read], nil, nil, 35) && gate_read.read(1) == "E"
-              gate_read.close
-              argv = definition.fetch("argv")
-              exec(environment, [File.expand_path(argv.first), argv.first], *argv.drop(1), unsetenv_others: true)
-            rescue Exception
-              exit! 126
-            end
-          end
-          [child_input, child_output, child_error, gate_read, ready_write].compact.uniq.each(&:close)
-          unless IO.select([ready_read], nil, nil, 10) && ready_read.read(1) == "R"
-            raise SecurityError, "child did not reach admission gate"
-          end
-          ready_read.close
-          witness = child_witness(child)
-          bound = @owner.call("command_bind", {"execution_id" => id, "child" => witness}, mutation_id: "command-bind.#{id}")
-          raise SecurityError, "binding replay cannot execute" if bound.replayed
-          gate_write.write("E")
-          gate_write.close
-          send_frame(socket, {"type" => "started", "execution_id" => id})
-          outputs = {parent_output => interactive ? "terminal" : "stdout"}
-          outputs[parent_error] = "stderr" if parent_error
-          pump(socket, parent_input, outputs, child, interactive)
-          scope.cleanup!(leader: child)
-          _, result = Process.waitpid2(child)
-          reaped = true
-          termination = {"exit_status" => result.exitstatus, "signal" => result.termsig}
-          @owner.call("command_complete", {"execution_id" => id, "result" => termination}, mutation_id: "command-complete.#{id}")
-          send_frame(socket, termination.merge("type" => "result", "execution_id" => id))
-          result.exitstatus || 128 + result.termsig
-        ensure
-          [gate_write, ready_read, parent_input, parent_output, parent_error].compact.uniq.each { |io| io.close unless io.closed? }
-          if child && !reaped
-            scope.cleanup!(leader: child)
-            deadline = monotonic + 5
-            loop do
-              break if Process.waitpid(child, Process::WNOHANG)
-              break if monotonic >= deadline
-              IO.select(nil, nil, nil, 0.01)
-            end
-          end
-        end
-
-        def pump(socket, input, outputs, child, interactive)
-          pending = "".b
-          pending_input = "".b
-          input_open = true
-          input_finished = false
-          terminal_at = nil
-          loop do
-            terminal_at ||= monotonic if zombie?(child)
-            break if terminal_at && (outputs.empty? || monotonic - terminal_at >= 1)
-            readers = (pending_input.bytesize < 131_072 ? [socket] : []) + outputs.keys
-            ready = IO.select(readers, pending_input.empty? || input.closed? ? [] : [input], nil, 0.1)
-            next unless ready
-            if ready.first.include?(socket)
-              bytes = socket.read_nonblock(65_536, exception: false)
-              next if bytes == :wait_readable
-              raise IOError, "command client disconnected" unless bytes
-              pending << bytes
-              raise ArgumentError, "command frame exceeds bound" if pending.bytesize > 131_072
-              while (newline = pending.index("\n"))
-                frame = JSON.parse(pending.slice!(0, newline + 1))
-                case frame.fetch("type")
-                when "input"
-                  strict!(frame, %w[type data])
-                  raise ArgumentError, "command input after EOF" unless input_open
-                  pending_input << Base64.strict_decode64(frame.fetch("data"))
-                  raise ArgumentError, "command buffered input exceeds bound" if pending_input.bytesize > 131_072
-                when "resize"
-                  strict!(frame, %w[type rows cols])
-                  raise ArgumentError, "resize requires a terminal" unless interactive
-                  input.winsize = geometry(frame)
-                when "eof"
-                  strict!(frame, %w[type])
-                  raise ArgumentError, "duplicate input EOF" unless input_open
-                  pending_input << "\x04" if interactive
-                  input_open = false
-                else raise ArgumentError, "invalid command input"
-                end
-              end
-            end
-            if ready[1].include?(input)
-              written = input.write_nonblock(pending_input, exception: false)
-              pending_input.slice!(0, written) if written.is_a?(Integer)
-            end
-            if !input_open && pending_input.empty? && !input_finished
-              input.close unless interactive
-              input_finished = true
-            end
-            outputs.keys.each do |output|
-              next unless ready.first.include?(output)
-              begin
-                bytes = output.read_nonblock(65_536, exception: false)
-              rescue Errno::EIO
-                bytes = nil
-              end
-              next if bytes == :wait_readable
-              if bytes
-                send_frame(socket, {"type" => "output", "stream" => outputs.fetch(output), "data" => Base64.strict_encode64(bytes)})
-              else
-                outputs.delete(output)
-              end
-            end
-          end
-        end
-
-        def child_witness(pid)
-          observer = Ace::Runtime::Molecules::ProcessIdentity.new(executor:
-            Ace::Herdr::Molecules::BoundedObservation.new(deadline: monotonic + 5))
-          identity = observer.capture(pid)
-          raise SecurityError, "child generation unavailable" unless identity
-          status = File.readlines("/proc/#{pid}/status").filter_map { |line| line.include?(":") && line.split(":", 2) }.to_h
-          identity.merge("gid" => status.fetch("Gid").split.first.to_i, "groups" => status.fetch("Groups").split.map(&:to_i).sort,
-            "cwd" => File.readlink("/proc/#{pid}/cwd"), "process_group" => Process.getpgid(pid),
-            "no_new_privs" => Integer(status.fetch("NoNewPrivs").strip, 10),
-            "capabilities" => %w[CapInh CapPrm CapEff CapAmb].to_h { |key| [key, status.fetch(key).strip] })
-        end
-
-        def zombie?(pid) = File.read("/proc/#{pid}/stat").split(")").last.split.first == "Z"
-        def monotonic = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        def geometry(value)
-          rows, cols = value.values_at("rows", "cols")
-          raise ArgumentError, "invalid command geometry" unless [rows, cols].all? { |v| v.is_a?(Integer) && v.between?(1, 65_535) }
-          [rows, cols]
-        end
-        def strict!(value, keys)
-          raise ArgumentError, "invalid command fields" unless value.is_a?(Hash) && value.keys.sort == keys.sort
-        end
-        def send_frame(socket, frame)
-          Ace::Runtime::Molecules::ProtectedSocket.write(socket, frame,
-            deadline: Ace::Runtime::Molecules::ProtectedSocket.deadline(5), limit: 131_072)
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/organisms/command_run_client.rb

@@ -1,131 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require "securerandom"
-require "fileutils"
-require "base64"
-require "io/console"
-require "ace/assign/authority/ordinary_client"
-require_relative "../molecules/ordinary_owner_config"
-require_relative "../molecules/command_policy"
-
-module Ace
-  module Lab
-    module Organisms
-      class CommandRunClient
-        def initialize(project:)
-          @project = project
-          @config = Molecules::OrdinaryOwnerConfig.load(project: project)
-        end
-
-        def owner
-          Ace::Assign::Authority::OrdinaryClient.new(project_id: @project, service: @config.service,
-            verify_selection: @config.method(:verify_owner!))
-        end
-
-        def status(reference)
-          owner.call("command_status", {"execution_id" => reference}).data
-        end
-
-        def run(argv:, executor:, services:, pane: nil)
-          id = SecureRandom.hex(16)
-          selection = {"argv" => argv, "executor" => executor, "services" => services, "pane" => pane}
-          request = {"project" => @project, "execution_id" => id, "selection" => selection,
-            "mutation_id" => "command-admit.#{id}"}
-          parent = File.expand_path(".ace-local/lab-commands")
-          FileUtils.mkdir_p(parent, mode: 0o700)
-          directory = File.join(parent, id)
-          Dir.mkdir(directory, 0o700)
-          File.open(File.join(directory, "request.json"), File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0o600) do |file|
-            file.write(JSON.generate(request) + "\n")
-            file.flush
-            file.fsync
-          end
-          File.open(directory, File::RDONLY) { |parent_io| parent_io.fsync }
-          $stderr.puts "Execution #{id}; inspect with ace-lab run-status --project #{@project} --reference #{id}"
-          reply = owner.call("command_admit", {"execution_id" => id, "selection" => selection}, mutation_id: request.fetch("mutation_id"))
-          raise Ace::Assign::AttemptErrors::Conflict, "original command admission must be reconciled" if reply.replayed
-          stream(id)
-        end
-
-        private
-
-        def stream(id)
-          wire = Ace::Runtime::Molecules::ProtectedSocket
-          policy = Molecules::CommandPolicy.load(project: @project)
-          path = policy.launcher.fetch("socket_path")
-          wire.root_path!(File.dirname(path), directory: true)
-          endpoint = wire.socket_identity(path, mode: 0o660)
-          raise SecurityError, "command launcher endpoint owner differs" unless endpoint.last.zero?
-          expected = JSON.parse(Molecules::GrantResolver.read_verified(policy.launcher.fetch("identity_path")) || "null")
-          wire.connect(path, deadline: wire.deadline(5)) do |socket|
-            peer = Ace::Assign::Authority::OrdinaryPeer.new.capture(socket)
-            unless expected.is_a?(Hash) && expected["schema"] == "labd-command-launcher/v1" && expected["identity"] == peer
-              raise SecurityError, "command launcher generation differs"
-            end
-            interactive = $stdin.tty? && $stdout.tty?
-            rows, cols = interactive ? $stdin.winsize : [24, 80]
-            wire.write(socket, {"op" => "command_run", "project" => @project, "execution_id" => id,
-              "tty" => interactive, "rows" => rows, "cols" => cols}, deadline: wire.deadline(5), limit: 16_384)
-            if interactive
-              $stdin.raw { pump(socket, id, interactive: true) }
-            else
-              pump(socket, id, interactive: false)
-            end
-          end
-        end
-
-        def pump(socket, id, interactive:)
-          wire = Ace::Runtime::Molecules::ProtectedSocket
-          ingress = wire::Ingress.new(socket)
-          inputs = [socket]
-          resize = false
-          old_winch = Signal.trap("WINCH") { resize = true } if interactive
-          loop do
-            if resize
-              resize = false
-              rows, cols = $stdin.winsize
-              wire.write(socket, {"type" => "resize", "rows" => rows, "cols" => cols}, deadline: wire.deadline(5), limit: 131_072)
-            end
-            ready = IO.select(inputs, nil, nil, 0.25)
-            next unless ready
-            if ready.first.include?(socket)
-              frame = wire.read(ingress, deadline: wire.deadline(5), limit: 131_072)
-              case frame["type"]
-              when "started"
-                raise SecurityError, "invalid command start frame" unless frame.keys.sort == %w[execution_id type]
-                raise SecurityError, "command reference differs" unless frame["execution_id"] == id
-                inputs << $stdin unless inputs.include?($stdin)
-              when "output"
-                raise SecurityError, "invalid command output frame" unless frame.keys.sort == %w[data stream type] && %w[stdout stderr terminal].include?(frame["stream"])
-                destination = frame["stream"] == "stderr" ? $stderr : $stdout
-                destination.write(Base64.strict_decode64(frame.fetch("data")))
-                destination.flush
-              when "result"
-                raise SecurityError, "invalid command result frame" unless frame.keys.sort == %w[execution_id exit_status signal type]
-                raise SecurityError, "command reference differs" unless frame["execution_id"] == id
-                exited, signal = frame.values_at("exit_status", "signal")
-                if exited.is_a?(Integer) && exited.between?(0, 255) && signal.nil?
-                  return exited
-                elsif exited.nil? && signal.is_a?(Integer) && signal.between?(1, 127)
-                  return 128 + signal
-                end
-                raise SecurityError, "command termination is invalid"
-              else
-                raise SecurityError, "command stream is incomplete"
-              end
-            end
-            next unless ready.first.include?($stdin)
-            bytes = $stdin.read_nonblock(8192, exception: false)
-            next if bytes == :wait_readable
-            frame = bytes ? {"type" => "input", "data" => Base64.strict_encode64(bytes)} : {"type" => "eof"}
-            wire.write(socket, frame, deadline: wire.deadline(5), limit: 131_072)
-            inputs.delete($stdin) unless bytes
-          end
-        ensure
-          Signal.trap("WINCH", old_winch) if old_winch
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/organisms/ordinary_assignment_client.rb

@@ -1,120 +0,0 @@
-# frozen_string_literal: true
-
-require "securerandom"
-require "ace/assign/authority/retained_input"
-require "ace/assign/authority/ordinary_client"
-require "ace/assign/authority/ordinary_lifecycle"
-require "ace/assign/organisms/prepared_work_builder"
-require_relative "../molecules/ordinary_owner_config"
-
-module Ace
-  module Lab
-    module Organisms
-      # File inputs retain the exact mutation and bytes across response loss.
-      # Only Assign's installed owner registers, advances and accepts execution.
-      class OrdinaryAssignmentClient
-        A = Ace::Assign::Authority
-        Files = A::RetainedInput
-        REQUEST_KEYS = %w[version project_id operation mutation_id params parts].freeze
-
-        def initialize(project:, config: nil, client_factory: nil)
-          @project = project
-          @config = config || Molecules::OrdinaryOwnerConfig.load(project: project)
-          unless @config.is_a?(Molecules::OrdinaryOwnerConfig) && @config.project == project
-            raise ArgumentError, "ordinary assignment project selection differs"
-          end
-          @client_factory = client_factory || ->(**options) { A::OrdinaryClient.new(**options) }
-        end
-
-        # Preparation produces input only, so it is also available on the host.
-        # Reusing an existing output directory never rebuilds or resubmits work.
-        def self.prepare(project:, task:, pane:, output:, dependency_reports: [])
-          unless project.is_a?(String) && Molecules::OrdinaryOwnerConfig::ID.match?(project) &&
-              pane.is_a?(String) && Molecules::OrdinaryOwnerConfig::PANE.match?(pane)
-            raise ArgumentError, "preparation requires project and native pane selectors"
-          end
-          directory = Files.create_output(output)
-          prepared = Ace::Assign::Organisms::PreparedWorkBuilder.new(export_root: directory)
-            .call(task_ref: task, project_id: project, dependency_reports: dependency_reports)
-          definition = JSON.parse(prepared.fetch("definition_bytes"))
-          reference = definition.fetch("prepared_work")
-          request = {"version" => 1, "project_id" => project, "operation" => "register_assignment",
-            "mutation_id" => SecureRandom.hex(16), "params" => {
-              "assignment_id" => prepared.fetch("assignment_id"), "pane" => pane, "expected_generation" => 0,
-              "definition_digest" => Digest::SHA256.hexdigest(prepared.fetch("definition_bytes")),
-              "prepared_head" => prepared.fetch("head"), "prepared_tree" => prepared.fetch("tree"),
-              "manifest_sha256" => reference.fetch("manifest_sha256")},
-            "parts" => [{"file" => "prepared.bundle", "bytes" => prepared.fetch("bytes"), "sha256" => prepared.fetch("sha256")}]}
-          Files.write_file(directory, "definition.json", prepared.fetch("definition_bytes"))
-          Files.write_file(directory, "prepared.bundle", prepared.fetch("bundle"))
-          Files.write_file(directory, "request.json", JSON.generate(request) + "\n")
-          {"project_id" => project, "assignment_id" => prepared.fetch("assignment_id"),
-            "scope" => prepared.fetch("scope"), "request" => File.join(directory, "request.json"), "prepared" => true}
-        end
-
-        def request(input:, output: nil)
-          request = JSON.parse(Files.read_file(input, 16_384), allow_duplicate_key: false, create_additions: false, max_nesting: 24)
-          unless request.is_a?(Hash) && request.keys.sort == REQUEST_KEYS.sort && request["version"].is_a?(Integer) && request["version"] == 1 &&
-              request["project_id"] == @project && A::OrdinaryLifecycle::OPERATIONS.include?(request["operation"]) &&
-              request["params"].is_a?(Hash) && !request["params"].key?("transfer") && request["parts"].is_a?(Array)
-            raise ArgumentError, "retained ordinary request selection is invalid"
-          end
-          operation = request.fetch("operation")
-          read = %w[registration_status assignment_snapshot result_status result_snapshot supervisor_status export_candidate review_status merge_evidence].include?(operation)
-          mutation = request.fetch("mutation_id")
-          unless read ? mutation.nil? : mutation.is_a?(String) && Ace::Assign::Molecules::JournalMutation::ID.match?(mutation)
-            raise ArgumentError, "retained mutation ID must be explicit; read operations require null"
-          end
-          transfer = A::OrdinaryLifecycle::TRANSFER_OPERATIONS[operation]
-          download = transfer && transfer.fetch(:direction) == :download
-          upload = transfer && transfer.fetch(:direction) == :upload
-          unless (!!output == !!download) && (request["parts"].empty? || upload)
-            raise ArgumentError, "download requires a new --output directory; only uploads accept parts"
-          end
-          parts = upload && read_parts(request.fetch("parts"), input, transfer.fetch(:purpose))
-          # No local metadata is interpreted as successful execution. Download
-          # files are merely a projection of the authenticated canonical reply.
-          directory = download && Files.create_output(output)
-          client = @client_factory.call(project_id: @project, service: @config.service,
-            verify_selection: @config.method(:verify_owner!), scratch_root: directory || nil)
-          reply = client.call(operation, request.fetch("params"), mutation_id: request.fetch("mutation_id"),
-            upload_parts: parts || nil, download: !!download, purpose: transfer && transfer.fetch(:purpose))
-          envelope = {"status" => "ok", "data" => reply.data, "transport" => {"replayed" => reply.replayed}}
-          if download
-            files = reply.parts.each_with_index.map do |bytes, index|
-              name = format("part-%02d.bytes", index)
-              Files.write_file(directory, name, bytes)
-              {"file" => File.join(directory, name), "bytes" => bytes.bytesize, "sha256" => Digest::SHA256.hexdigest(bytes)}
-            end
-            envelope["files"] = files
-            Files.write_file(directory, "response.json", JSON.generate(envelope) + "\n")
-          end
-          envelope
-        rescue JSON::ParserError
-          raise ArgumentError, "retained request is not valid bounded JSON"
-        end
-
-        private
-
-        def read_parts(entries, input, purpose)
-          total, count, per_part = A::TransferCodec::LIMITS.fetch(purpose)
-          unless entries.size.between?(1, count) && entries.all? { |entry|
-              entry.is_a?(Hash) && entry.keys.sort == %w[bytes file sha256] && entry["file"].is_a?(String) &&
-                entry["file"].bytesize.between?(1, 4096) && !entry["file"].include?("\0") &&
-                entry["bytes"].is_a?(Integer) && entry["bytes"].between?(0, per_part) &&
-                entry["sha256"].is_a?(String) && A::TransferCodec::SHA256.match?(entry["sha256"])
-            } && entries.sum { |entry| entry.fetch("bytes") } <= total
-            raise ArgumentError, "retained upload inventory is invalid"
-          end
-          entries.map do |entry|
-            bytes = Files.read_file(File.expand_path(entry.fetch("file"), File.dirname(File.expand_path(input))), per_part)
-            unless bytes.bytesize == entry.fetch("bytes") && Digest::SHA256.hexdigest(bytes) == entry.fetch("sha256")
-              raise ArgumentError, "retained upload bytes changed; preserve the original mutation"
-            end
-            bytes
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/organisms/ordinary_authority_composition.rb

@@ -1,153 +0,0 @@
-# frozen_string_literal: true
-
-require "ace/assign/authority/ordinary_lifecycle"
-require "ace/assign/authority/ordinary_server"
-require "ace/assign/authority/router"
-require "ace/hitl/providers/lab"
-require "ace/hitl/lifecycle/service"
-require "ace/hitl/lifecycle/tls_authority"
-require "ace/hitl/lifecycle/tls_service"
-require_relative "../molecules/ordinary_owner_admission"
-require_relative "../molecules/caller_authorizer"
-require_relative "../molecules/command_owner_admission"
-require_relative "../molecules/ordinary_listener"
-require_relative "ordinary_merge_receiver"
-
-module Ace
-  module Lab
-    module Organisms
-      # Ordinary delivery has one installed journal writer and exclusion owner.
-      # Existing Assign, HITL and merge protocols share that process lifetime;
-      # no requester cache or daemon working directory chooses accepted state.
-      class OrdinaryAuthorityComposition
-        def initialize(receiver_config:, owner_config: nil)
-          unless receiver_config.is_a?(Molecules::OrdinaryReceiverConfig)
-            raise ArgumentError, "ordinary composition needs installed receiver selection"
-          end
-          @receiver = receiver_config
-          @config = owner_config || Molecules::OrdinaryOwnerConfig.load(project: @receiver.project)
-          unless @config.is_a?(Molecules::OrdinaryOwnerConfig)
-            raise ArgumentError, "ordinary composition needs installed assignment selection"
-          end
-        end
-
-        def build
-          @config.verify_listener!
-          policy_document = Molecules::GrantResolver.trusted_document(@receiver.policy_path)
-          verify_join!(policy_document)
-          admission = Molecules::OrdinaryOwnerAdmission.new(config: @config)
-          reader = nil
-          journal = Ace::Assign::Molecules::EvidenceJournal.new(repo_root: @config.journal.fetch("repository"),
-            ref: @config.journal.fetch("ref"), checkout_root: @config.journal.fetch("checkout_root"),
-            evidence_reader: ->(reference, record, state, pending) { reader.call(reference, record, state, pending) })
-          reader = Ace::Assign::Authority::ServiceEvidence.new(journal: journal)
-          exclusion = Ace::Assign::Molecules::LifecycleExclusion.new(root: @config.lifecycle_root)
-          command_admission = Molecules::CommandOwnerAdmission.new(base: admission, project: @config.project)
-          command = Ace::Assign::Authority::CommandExecution.new(project: @config.project, journal: journal,
-            admission: command_admission)
-          coordinator = nil
-          lifecycle = Ace::Assign::Authority::OrdinaryLifecycle.new(project: @config.project,
-            admission: admission, journal: journal, exclusion: exclusion, input_root: @config.assignment_root,
-            command_evidence: command,
-            release_authorizer: ->(binding) { authorize_release_artifact!(binding, coordinator) })
-          coordinator = Ace::Assign::Organisms::AttemptCoordinator.new(cache_base: @config.assignment_root,
-            repo_root: @config.journal.fetch("repository"), journal: journal, lifecycle_exclusion: exclusion,
-            recorded_binding_observer: admission.method(:recorded_binding!), ordinary_merge_evidence: lifecycle)
-          router = Ace::Assign::Authority::Router.new(handlers: [lifecycle, command])
-          merge = OrdinaryMergeReceiver.new(config: @receiver, coordinator: coordinator,
-            policy_document: policy_document, owner_guard: -> { @config.selected_principal!(@receiver.principal_uid) },
-            merge_factory: ->(document) {
-              Molecules::OrdinaryMergeRead.new(repo_path: @receiver.repo_path, base_ref: document.fetch("base_ref"),
-                root: @receiver.repo_path, common_dir: @config.worktrees.fetch("common_dir"))
-            })
-          listener = Molecules::OrdinaryListener.new(socket_path: @receiver.socket_path,
-            peer_uid: @receiver.principal_uid, socket_gid: @receiver.socket_gid, handler: merge,
-            logger: ->(message) { warn message })
-          Ace::Assign::Authority::OrdinaryServer.new(admission: command_admission, lifecycle: router,
-            services: hitl_services(coordinator) + [listener])
-        end
-
-        private
-
-        # Retention reads the existing exact release decision. It neither
-        # consumes an authorization nor dispatches a publication effect.
-        def authorize_release_artifact!(binding, coordinator)
-          @config.verify_owner!
-          document = Molecules::GrantResolver.trusted_document(@receiver.policy_path)
-          verify_join!(document)
-          uid = binding.fetch("caller_uid")
-          unless uid.is_a?(Integer) && uid.positive? && binding.fetch("project_id") == @config.project
-            raise SecurityError, "release artifact caller or project differs"
-          end
-          username = begin
-            Etc.getpwuid(uid)&.name
-          rescue ArgumentError
-            nil
-          end
-          visibility = Molecules::CallerAuthorizer.new(principals: document.fetch("principals", {}),
-            identity: Molecules::CallerAuthorizer.matchable_identities(username, uid))
-          raise SecurityError, "release artifact project grant is unavailable" unless visibility.authorized?(@config.project)
-          Molecules::ServicePolicy.new(document, coordinator.method(:proposal_authorization))
-            .authorize!(binding.fetch("authorization"), binding)
-        end
-
-        def verify_join!(document)
-          configured = Molecules::ServicePolicy.new(document).ordinary_receiver!(@config.project)
-          expected = {"receiver_id" => @receiver.receiver_id, "socket_path" => @receiver.socket_path,
-            "receiver_uid" => @config.service.fetch("uid"), "principal" => @receiver.principal,
-            "journal_repository" => @config.journal.fetch("repository"), "journal_ref" => @config.journal.fetch("ref")}
-          unless @receiver.project == @config.project && @receiver.receiver_uid == @config.service.fetch("uid") &&
-              configured && configured.slice(*expected.keys) == expected &&
-              @config.participants.key?(@receiver.principal_uid.to_s) &&
-              ![@config.service.fetch("socket_path"), @config.native.fetch("socket_path"), @config.hitl.fetch("socket_path")].include?(@receiver.socket_path)
-            raise InvalidConfigurationError, "ordinary receiver and assignment owner selections differ"
-          end
-        end
-
-        def hitl_services(coordinator)
-          selected = @config.hitl
-          policy = Ace::Hitl::Providers::Lab.grants_policy(grants_path: selected.fetch("grants_path"))
-          unless policy.service_uid == @config.service.fetch("uid")
-            raise InvalidConfigurationError, "ordinary HITL service principal differs from assignment owner"
-          end
-          guard = lambda do
-            @config.verify_owner!
-            unless policy.service_uid == @config.service.fetch("uid")
-              raise Ace::Hitl::Lifecycle::BindingError, "installed HITL service principal changed"
-            end
-          rescue Ace::Lab::InvalidConfigurationError, Ace::Assign::Error => error
-            raise Ace::Hitl::Lifecycle::BindingError, error.message
-          end
-          binding = Ace::Hitl::Providers::Lab::AssignmentBinding.new(coordinator: coordinator,
-            project: @config.project, owner_guard: guard)
-          # Unix requesters and the existing Hermes mTLS transport share the
-          # same owner and one in-memory OTP vault. No second daemon opens the
-          # journal and no synthetic Unix principal represents a certificate.
-          vault = Ace::Hitl::Lifecycle::OtpVault::MemoryVault.new
-          services = [Ace::Hitl::Lifecycle::Service.new(root: selected.fetch("root"),
-            socket_path: selected.fetch("socket_path"), group: selected.fetch("group"),
-            binding: binding, policy: policy, vault: vault)]
-          if selected.key?("tls_authority")
-            authority = Ace::Hitl::Lifecycle::TlsAuthority.load(selected.fetch("tls_authority"))
-            verify_tls_identity!(authority)
-            services << Ace::Hitl::Lifecycle::TlsService.new(root: selected.fetch("root"),
-              binding: binding, project: @config.project, credential: authority.credential,
-              ssl_context: authority.ssl_context!, listen: authority.listen, port: authority.port,
-              group: selected.fetch("group"), vault: vault, decision_policy: policy)
-          end
-          services
-        end
-
-        def verify_tls_identity!(authority)
-          unless authority.project_id == @config.project &&
-              Etc.getpwnam(authority.service_user).uid == @config.service.fetch("uid") &&
-              Etc.getgrnam(authority.service_group).gid == @config.service.fetch("gid")
-            raise InvalidConfigurationError, "ordinary HITL TLS project or service identity differs"
-          end
-        rescue ArgumentError
-          raise InvalidConfigurationError, "ordinary HITL TLS service account is unavailable"
-        end
-      end
-    end
-  end
-end