ace-lab 0.9.0 → 0.13.0

data/lib/ace/lab/organisms/protected_service_recovery.rb

@@ -1,185 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Lab
-    module Organisms
-      class ProtectedServiceReceiver
-        RECOVERY_BINDING = %w[assignment_id attempt_id candidate_generation head request_id].freeze
-        RECOVERY_EXECUTION = %w[mapping_id candidate_generation head claim_binding dispatch_phase].freeze
-        CLEANUP_RECOVERY_EXECUTION = (RECOVERY_EXECUTION + %w[operation_owner_binding executor_process_binding
-          request_event_digest dispatch_event_digest]).freeze
-        RECOVERY_CHALLENGE = %w[request_id input_digest claim_binding no_effect_challenge challenge_generation
-          failure_event_digest failure_generation challenge_event_digest].freeze
-
-        def recover_no_effect(binding:, input_bytes:, mutation_id:, expected_generation:)
-          request_id = nil
-          recovery_binding!(binding, input_bytes, mutation_id, expected_generation)
-          params = immutable(binding)
-          input_bytes = input_bytes.dup.freeze
-          mutation_id = mutation_id.dup.freeze
-          recovery_binding!(params, input_bytes, mutation_id, expected_generation)
-          request_id = params.fetch("request_id")
-          recovery_executor!
-          status, context, input = recovery_status!(params, input_bytes)
-          return projection(status) if %w[succeeded failed-settled].include?(status.fetch("state"))
-          unless context["challenge"]
-            claim_params = params.merge("expected_generation" => expected_generation)
-            begin
-              @client.call("claim_service_settlement", claim_params, mutation_id: mutation_id)
-            rescue Ace::Runtime::RuntimeUnavailableError
-              # Recover a possibly accepted challenge through current status,
-              # never refreshing the original generation or silently claiming.
-            end
-            status, context, input = recovery_status!(params, input_bytes)
-            return projection(status) if %w[succeeded failed-settled].include?(status.fetch("state"))
-            return uncertain(request_id) unless context["challenge"]
-          end
-          operation = recovery_inspector!(context)
-          root = Ace::Assign::Authority::PrivateDirectory.verify!(@receiver.fetch("staging_root"))
-          directory = Dir.mktmpdir("recovery-", root)
-          File.chmod(0o700, directory)
-          identity = File.lstat(directory)
-          envelope = immutable("version" => 1, "kind" => "service_no_effect_inspection",
-            "request" => context.fetch("request"), "input" => input.fetch(:input),
-            "execution" => context.fetch("execution"), "challenge" => context.fetch("challenge"))
-          # The selected inspector supplies retained success or positive absence;
-          # neither follows from a timeout or process/scope cleanup.
-          if context.dig("request", "operation") == "prune-preserved-workspace"
-            return uncertain(request_id) unless @cleanup_owner && context.dig("execution", "dispatch_phase") == "dispatch_started"
-            inspected_kind, artifacts = cleanup_inspection_evidence!(context, input.fetch(:input))
-            if inspected_kind == "succeeded"
-              evidence = artifacts.each_with_index.map do |artifact, index|
-                {"ref" => "cleanup-#{index}", "sha256" => Digest::SHA256.hexdigest(artifact)}
-              end
-              receipt = JSON.generate(context.fetch("request").merge("outcome" => "succeeded", "evidence" => evidence))
-              completion = params.merge("claim_binding" => context.dig("execution", "claim_binding"),
-                "receipt_sha256" => Digest::SHA256.hexdigest(receipt))
-              @client.call("complete_service", completion,
-                mutation_id: Digest::SHA256.hexdigest("cleanup-completed:#{mutation_id}"),
-                upload_parts: [receipt] + artifacts, purpose: :receipt_artifacts)
-              completed, = recovery_status!(params, input_bytes)
-              return uncertain(request_id) unless completed["state"] == "succeeded"
-              cleanup_staging(directory, identity, prefix: "recovery-")
-              return projection(completed)
-            end
-            response = {"outcome" => "failed", "request_id" => request_id,
-              "input_digest" => context.dig("request", "input_digest"), "evidence" => artifacts.each_with_index.map do |artifact, index|
-                {"ref" => index.zero? ? "cleanup-inspection-no-effect" : "cleanup-inspection-selection", "sha256" => Digest::SHA256.hexdigest(artifact)}
-              end}
-          else
-            response = @handler.execute(operation: immutable(operation), envelope: envelope, candidate_root: directory)
-          end
-          return uncertain(request_id) unless response && response["outcome"] == "failed" &&
-            response["request_id"] == request_id && response["input_digest"] == context.dig("request", "input_digest")
-          artifacts ||= Ace::Assign::Authority::EvidenceTransfer.read_staged(root: directory, evidence: response.fetch("evidence"))
-          receipt = context.fetch("request").merge("outcome" => "failed", "evidence" => response.fetch("evidence"))
-          bytes = JSON.generate(receipt)
-          completion_params = params.merge("claim_binding" => context.dig("execution", "claim_binding"),
-            "reconciliation_challenge" => context.fetch("challenge").slice("no_effect_challenge", "challenge_generation", "challenge_event_digest"),
-            "receipt_sha256" => Digest::SHA256.hexdigest(bytes))
-          @client.call("complete_no_effect", completion_params,
-            mutation_id: Digest::SHA256.hexdigest("no-effect:#{mutation_id}"),
-            upload_parts: [bytes] + artifacts, purpose: :receipt_artifacts)
-          # Protected status invokes the shared canonical receipt/import reader.
-          # Never accept a terminal state string without that authentication.
-          settled, = recovery_status!(params, input_bytes)
-          return uncertain(request_id) unless settled["state"] == "failed-settled"
-          cleanup_staging(directory, identity, prefix: "recovery-")
-          projection(settled)
-        rescue Ace::Assign::Error, Ace::Runtime::RuntimeUnavailableError, Ace::Lab::InvalidConfigurationError,
-          SecurityError, ArgumentError, KeyError, TypeError, SystemCallError
-          uncertain(request_id)
-        end
-
-        private
-
-        def recovery_binding!(binding, bytes, mutation_id, generation)
-          unless binding.is_a?(Hash) && binding.keys.sort == RECOVERY_BINDING.sort &&
-              %w[assignment_id attempt_id request_id].all? { |key| binding[key].is_a?(String) && binding[key].match?(Ace::Assign::Molecules::JournalMutation::ID) } &&
-              binding["head"].is_a?(String) && binding["head"].match?(Ace::Assign::Authority::CandidateTransfer::SHA) &&
-              binding["candidate_generation"].is_a?(Integer) && binding["candidate_generation"] >= 0 &&
-              generation.is_a?(Integer) && generation.positive? && bytes.is_a?(String) &&
-              mutation_id.is_a?(String) && mutation_id.match?(Ace::Assign::Molecules::JournalMutation::ID)
-            raise ArgumentError, "original recovery binding is invalid"
-          end
-        end
-
-        def recovery_executor!
-          me = @kernel.capture(Process.pid)
-          credentials = @project.fetch("peer_credentials").fetch(@receiver.fetch("executor_uid").to_s)
-          unless me["uid"] == @receiver.fetch("executor_uid") && me["gid"] == credentials.fetch("gid") &&
-              me["groups"] == credentials.fetch("groups")
-            raise SecurityError, "recovery executor differs"
-          end
-          @kernel.live!(me)
-        end
-
-        def recovery_status!(params, bytes)
-          reply = @client.call("service_status", params)
-          data = reply.data
-          context = data.fetch("settlement_context")
-          unless context.is_a?(Hash) && context.keys.sort == %w[version request execution challenge].sort &&
-              context["version"].is_a?(Integer) && context["version"] == 1
-            raise SecurityError, "canonical recovery context is malformed"
-          end
-          request, execution, challenge = context.values_at("request", "execution", "challenge")
-          execution_fields = request.is_a?(Hash) && request["operation"] == "prune-preserved-workspace" &&
-            execution.is_a?(Hash) && execution["dispatch_phase"] == "dispatch_started" ? CLEANUP_RECOVERY_EXECUTION : RECOVERY_EXECUTION
-          unless request.is_a?(Hash) && request.keys.sort == Ace::Assign::Molecules::EvidenceJournal::TERMINAL_BINDING_FIELDS.sort &&
-              execution.is_a?(Hash) && execution.keys.sort == execution_fields.sort &&
-              %w[assignment_id attempt_id request_id].all? { |key| request[key] == params.fetch(key) } &&
-              request["project_id"] == @map.fetch("project_id") && request["executor_uid"] == @receiver.fetch("executor_uid") &&
-              request["transport"] == "unix" && request["candidate_head"] == params.fetch("head") &&
-              execution["mapping_id"] == @mapping_id && execution["candidate_generation"] == params.fetch("candidate_generation") &&
-              execution["head"] == params.fetch("head") && %w[issued dispatch_started].include?(execution["dispatch_phase"]) &&
-              %w[uncertain failed succeeded failed-settled].include?(data["state"]) &&
-              data["request_id"] == params.fetch("request_id") && data["service_id"] == @service_id
-            raise SecurityError, "canonical recovery original binding differs"
-          end
-          if !challenge.nil? && (!challenge.is_a?(Hash) || challenge.keys.sort != RECOVERY_CHALLENGE.sort ||
-              !%w[challenge_generation failure_generation].all? { |key| challenge[key].is_a?(Integer) && challenge[key].positive? } ||
-              challenge["request_id"] != request["request_id"] || challenge["input_digest"] != request["input_digest"] ||
-              challenge["claim_binding"] != execution["claim_binding"])
-            raise SecurityError, "canonical recovery challenge differs"
-          end
-          input = @inputs.input_binding(bytes, expected_digest: request.fetch("input_digest"),
-            expected_target: request.fetch("target"), operation: request.fetch("operation"))
-          [data, immutable(context), input]
-        end
-
-        def cleanup_inspection_evidence!(context, input)
-          request, execution = context.values_at("request", "execution")
-          result = @cleanup_owner.inspect!(request: request.slice("request_id", "input_digest").merge(
-            "claim_binding" => execution.fetch("claim_binding"),
-            "request_event_digest" => execution.fetch("request_event_digest"),
-            "dispatch_event_digest" => execution.fetch("dispatch_event_digest"), "input" => input,
-            "challenge_ref" => context.fetch("challenge").slice("challenge_event_digest")),
-            operation_owner_binding: execution.fetch("operation_owner_binding"))
-          unless result.is_a?(Hash) && result.keys.sort == %i[bytes kind receipt_ref] &&
-              %w[succeeded failed-no-effect].include?(result[:kind])
-            raise SecurityError, "original cleanup inspection kind differs"
-          end
-          success = result.fetch(:kind) == "succeeded"
-          ref, bytes = result.values_at(:receipt_ref, :bytes)
-          unless ref.is_a?(Hash) && ref.keys.sort == %w[bytes path sha256] && bytes.is_a?(String) &&
-              bytes.bytesize.between?(1, 65_536) && ref["bytes"].is_a?(Integer) && ref["bytes"] == bytes.bytesize &&
-              ref["sha256"] == Digest::SHA256.hexdigest(bytes)
-            raise SecurityError, "original cleanup inspection result differs"
-          end
-          selection = {"schema" => success ? Ace::Assign::Authority::ServiceCleanupEvidence::ROOT_SELECTION_SCHEMA : Ace::Assign::Authority::ServiceCleanupEvidence::ROOT_INSPECTION_SELECTION_SCHEMA,
-            "request_id" => request.fetch("request_id"), "input_digest" => request.fetch("input_digest"),
-            "operation_owner_binding_digest" => Ace::Assign::Atoms::EvidenceDigest.digest(execution.fetch("operation_owner_binding")),
-            (success ? "receipt_ref" : "inspection_ref") => ref}
-          [result.fetch(:kind), [bytes, JSON.generate(selection)].freeze].freeze
-        end
-
-        def recovery_inspector!(context)
-          request = context.fetch("request")
-          policy = Molecules::ServicePolicy.new(Molecules::GrantResolver.trusted_document(Ace::Lab.authorization_path))
-          policy.inspection!(request.fetch("operation"), project: @map.fetch("project_id"),
-            service_id: @service_id, executor_uid: @receiver.fetch("executor_uid"))
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/organisms/protected_service_request.rb

@@ -1,128 +0,0 @@
-# frozen_string_literal: true
-require "ace/assign/authority/protected_assignment_context"
-require "ace/assign/organisms/protected_delivery_coordinator"
-require_relative "protected_service_client"
-require "ace/git/atoms/service_pr_input"
-
-module Ace
-  module Lab
-    module Organisms
-      # Public selection adapter. The original authority and fixed receiver
-      # own every grant/effect; this adapter has no local journal or executor.
-      class ProtectedServiceRequest
-        FLAGS = %i[mapping scope service candidate_head candidate_generation expected_generation input_digest target artifact_digest].freeze
-        LIMIT = 16_384
-
-        def initialize(context: Ace::Assign::Authority::ProtectedAssignmentContext.load, ingress_factory: nil)
-          @context = context
-          @ingress = ingress_factory || ->(**selection) { ProtectedServiceClient.new(**selection) }
-        end
-
-        def selected?(options)
-          @context.protected_participant? || @context.mapping_hint? || FLAGS.any? { |key| !options[key].nil? }
-        end
-
-        def request(project:, assignment:, attempt:, operation:, input_path:, authorization:, request_id:, **options)
-          refuse_nonworker!
-          unless (options.keys - %i[mapping scope service candidate_head candidate_generation expected_generation dry_run]).empty?
-            raise ArgumentError, "protected request rejects incompatible options"
-          end
-          raise ArgumentError, "protected service request requires a fixed PR operation and no dry-run" unless Ace::Git::Atoms::ServicePrInput::OPERATIONS.include?(operation) && !options[:dry_run]
-          validate!(project, assignment, attempt, request_id, options)
-          unless authorization.is_a?(String) && authorization.match?(Molecules::ServicePolicy::ID) &&
-              options[:service].is_a?(String) && options[:service].match?(Molecules::ServicePolicy::ID) &&
-              options[:expected_generation].is_a?(Integer) && options[:expected_generation].positive?
-            raise ArgumentError, "protected service request requires receiver, authorization and original generation"
-          end
-          input = Atoms::ServiceInput.load(input_path)
-          Ace::Git::Atoms::ServicePrInput.validate(input, operation: operation)
-          target = Atoms::ServiceInput.target(input)
-          digest = Atoms::ServiceInput.digest(input)
-          prepared = resolve!(project, assignment, attempt, options)
-          selection = {"project_id" => project, "mapping_id" => options.fetch(:mapping), "assignment_id" => assignment,
-            "attempt_id" => attempt, "scope" => options.fetch(:scope), "service_id" => options.fetch(:service),
-            "candidate_head" => options.fetch(:candidate_head), "candidate_generation" => options.fetch(:candidate_generation),
-            "expected_generation" => options.fetch(:expected_generation), "request_id" => request_id,
-            "input_digest" => digest, "target" => target}
-          submission = {"assignment_id" => assignment, "attempt_id" => attempt, "expected_generation" => options.fetch(:expected_generation),
-            "candidate_generation" => options.fetch(:candidate_generation), "head" => options.fetch(:candidate_head),
-            "request_id" => request_id, "operation" => operation, "input_digest" => digest, "target" => target,
-            "authorization" => authorization}
-          mutation = Digest::SHA256.hexdigest("qkb.#{operation}.claim:v1:#{assignment}:#{attempt}:#{request_id}")
-          claim = @context.with_installed_selection(options: options, input: prepared) do |deployment, kernel, mapping|
-            @ingress.call(mapping_id: mapping, service_id: options.fetch(:service), deployment: deployment, kernel: kernel)
-              .submit(submission: submission, input_bytes: JSON.generate(input), mutation_id: mutation)
-          end
-          envelope = if claim.fetch("type") == "service_claim_accepted"
-            {"status" => "ok", "data" => {"selection" => selection, "claim" => claim}}
-          else
-            code = claim.fetch("type")
-            {"status" => "error", "error" => {"code" => code,
-              "message" => "inspect original canonical service status; no automatic resubmission",
-              "selection" => selection, "claim" => claim}}
-          end
-          bounded!(envelope, selection: selection)
-        end
-
-        def status(request_id:, **options)
-          refuse_nonworker!
-          unless (options.keys - %i[project assignment attempt mapping scope candidate_head candidate_generation input_digest target artifact_digest format]).empty?
-            raise ArgumentError, "protected status rejects incompatible options"
-          end
-          project, assignment, attempt = options.values_at(:project, :assignment, :attempt)
-          validate!(project, assignment, attempt, request_id, options)
-          unless options[:input_digest].is_a?(String) && options[:input_digest].match?(Atoms::ServiceInput::SHA256)
-            raise ArgumentError, "protected status requires original input digest"
-          end
-          target = Atoms::ServiceInput.target({"target" => {"resource" => options[:target], "artifact_digest" => options[:artifact_digest]}})
-          resolve!(project, assignment, attempt, options)
-          data = Ace::Assign::Organisms::ProtectedDeliveryCoordinator.new(client: @context.client(options: options), project_id: project)
-            .perform(assignment_id: assignment, attempt_id: attempt, operation: "status", service_request_id: request_id,
-              candidate_head: options.fetch(:candidate_head), candidate_generation: options.fetch(:candidate_generation),
-              input_digest: options.fetch(:input_digest), target: target)
-          bounded!({"status" => "ok", "data" => data})
-        end
-
-        private
-
-        def refuse_nonworker!
-          if @context.protected_participant? && !@context.protected_worker?
-            raise Ace::Assign::AttemptErrors::EvidenceUnavailable, "protected service request/status is worker-only"
-          end
-        end
-
-        def validate!(project, assignment, attempt, request_id, options)
-          unless [project, assignment, attempt, request_id, options[:mapping]].all? { |value| value.is_a?(String) && value.match?(Molecules::ServicePolicy::ID) } &&
-              options[:scope].is_a?(String) && options[:scope].match?(Ace::Assign::Authority::PreparedWork::SCOPE) &&
-              options[:candidate_head].is_a?(String) && options[:candidate_head].match?(/\A[0-9a-f]{40}\z/) &&
-              options[:candidate_generation].is_a?(Integer) && options[:candidate_generation].positive?
-            raise ArgumentError, "protected service requires exact original scoped selectors"
-          end
-        end
-
-        def resolve!(project, assignment, attempt, options)
-          input = @context.resolve(options: options.merge(attempt: attempt), assignment_id: assignment, scope: options.fetch(:scope))
-          unless input && input.descriptor.values_at("project_id", "assignment_id", "attempt_id", "scope", "mapping_id") ==
-              [project, assignment, attempt, options.fetch(:scope), options.fetch(:mapping)]
-            raise Ace::Assign::AttemptErrors::EvidenceUnavailable, "original prepared service selection differs"
-          end
-          input
-        end
-
-        def bounded!(envelope, selection: nil)
-          return envelope if JSON.generate(envelope).bytesize <= LIMIT
-          if selection
-            # Submission may already be durable. Never classify lost output as
-            # a pre-effect refusal or retry; retain the original lookup tuple.
-            envelope = {"status" => "error", "error" => {"code" => "service_claim_unconfirmed",
-              "message" => "claim output unavailable; inspect original canonical service status without resubmission",
-              "selection" => selection, "claim" => {"version" => 1, "type" => "service_claim_unconfirmed",
-                "required_action" => "inspect_canonical_service_status"}}}
-            return envelope if JSON.generate(envelope).bytesize <= LIMIT
-          end
-          raise Ace::Assign::AttemptErrors::EvidenceUnavailable, "protected status output exceeds bound"
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/organisms/protected_service_worker.rb

@@ -1,89 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "protected_service_receiver"
-
-module Ace
-  module Lab
-    module Organisms
-      # One admitted worker for one installed receiver. Capacity is acquired
-      # before the canonical claim, not after an accepted request. This owns
-      # execution lifetime only; it never substitutes for canonical status.
-      class ProtectedServiceWorker
-        def initialize(receiver:)
-          @receiver = receiver
-          @mutex = Mutex.new
-          @worker = nil
-          @closing = false
-        end
-
-        def start(submission:, peer:, input_bytes:, mutation_id:, on_claim:, deadline: nil)
-          raise ArgumentError, "receiver acceptance callback unavailable" unless on_claim.respond_to?(:call)
-          now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-          deadline ||= now + 5
-          unless deadline.is_a?(Numeric) && deadline.finite? && deadline > now && deadline <= now + 5
-            raise ArgumentError, "receiver acceptance deadline is invalid"
-          end
-          # Hold independent copies before returning to the socket handler.
-          submission = copy(submission)
-          peer = copy(peer)
-          input_bytes = input_bytes.dup.freeze
-          mutation_id = mutation_id.dup.freeze
-          @mutex.synchronize do
-            raise Ace::Assign::AttemptErrors::Conflict, "receiver capacity unavailable" if @closing || @worker&.alive?
-
-            @worker = Thread.new do
-              remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
-              next({"state" => "uncertain"}) unless remaining.positive?
-              result = @receiver.execute(submission: submission, peer: peer, input_bytes: input_bytes,
-                mutation_id: mutation_id, claim_timeout: [remaining, 5].min,
-                on_claim: lambda do |identity|
-                  begin
-                    on_claim.call(identity)
-                  rescue IOError, SystemCallError
-                    # A lost acceptance reply cannot cancel already admitted
-                    # work or cause a second execution. Status owns recovery.
-                    nil
-                  end
-                end)
-              if submission.fetch("operation") == "publish"
-                while @receiver.publication_active? && !@mutex.synchronize { @closing }
-                  result = @receiver.tick_publication!(request_id: submission.fetch("request_id"),
-                    deadline: Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30)
-                  sleep 0.25 if @receiver.publication_active?
-                end
-                @receiver.release_publication_lifetime!
-              end
-              result
-            end
-          end
-        end
-
-        # Stop admission before joining. A timed-out join preserves both the
-        # worker and closing state; the listener must retain its lifetime lock.
-        def close(timeout:)
-          unless timeout.is_a?(Numeric) && timeout.finite? && timeout >= 0
-            raise ArgumentError, "receiver close deadline is invalid"
-          end
-          worker = @mutex.synchronize do
-            @closing = true
-            @worker
-          end
-          !worker || !worker.join(timeout).nil?
-        end
-
-        private
-
-        def copy(value)
-          duplicate = JSON.parse(JSON.generate(value))
-          freeze_value(duplicate)
-        end
-
-        def freeze_value(value)
-          value.each_value { |child| freeze_value(child) } if value.is_a?(Hash)
-          value.each { |child| freeze_value(child) } if value.is_a?(Array)
-          value.freeze
-        end
-      end
-    end
-  end
-end

data/lib/ace/lab/organisms/service_request_service.rb

@@ -1,249 +0,0 @@
-# frozen_string_literal: true
-
-require "digest"
-require "fileutils"
-require "open3"
-require "ace/assign"
-
-module Ace
-  module Lab
-    module Organisms
-      # Coordinates the generic request contract. ace-assign owns the durable
-      # claim and receipt; this class never writes evidence files directly.
-      class ServiceRequestService
-        # Immutable request identity: a replay must match every field; the
-        # candidate head is deliberately absent because replays return the
-        # head recorded at claim time.
-        SERVICE_REPLAY_FIELDS = %w[project_id operation input_digest assignment_id attempt_id
-          target authorization caller_uid request_id].freeze
-
-        def initialize(topology: nil, policy: nil, coordinator: nil, executor: nil, repo_root: nil)
-          @topology = topology || TopologyService.from_config
-          @policy = policy
-          @repo_root = repo_root || git_toplevel
-          @coordinator = coordinator ||
-            Ace::Assign::Organisms::AttemptCoordinator.new(repo_root: @repo_root)
-          @executor = executor || Molecules::ServiceExecutor.new
-        end
-
-        def request(project:, assignment:, attempt:, operation:, input_path:, authorization:, request_id:, dry_run: false)
-          {project: project, assignment: assignment, attempt: attempt, request: request_id}.each do |name, value|
-            raise ArgumentError, "invalid #{name} ID" unless value.is_a?(String) &&
-              value.match?(Molecules::ServicePolicy::ID)
-          end
-          input = Atoms::ServiceInput.load(input_path)
-          target = Atoms::ServiceInput.target(input)
-          # An identical retry returns the stored outcome — with the head
-          # recorded at claim time — without re-checking attempt, policy, or
-          # routing: a completed request must survive attempt terminality,
-          # authorization expiry, routing changes, and candidate-head
-          # advance. Any changed immutable field under the same request ID is
-          # a conflict, never a replay.
-          existing = @coordinator.service_request_status(request_id)
-          if existing
-            # Current project visibility gates replays: a revoked grant must
-            # not expose stored receipts, though the old operation route and
-            # authorization decision do not need to remain active.
-            visibility = @topology.services(project: project)
-            return visibility.envelope unless visibility.ok?
-            supplied = {"request_id" => request_id, "assignment_id" => assignment, "attempt_id" => attempt,
-                        "project_id" => project, "operation" => operation,
-                        "input_digest" => Atoms::ServiceInput.digest(input), "target" => target,
-                        "caller_uid" => Process.uid, "authorization" => authorization}
-            changed = SERVICE_REPLAY_FIELDS.find do |field|
-              existing[field] != supplied.fetch(field)
-            end
-            if changed
-              raise Ace::Assign::AttemptErrors::Conflict,
-                "Service request #{request_id} has different #{changed}"
-            end
-            if dry_run
-              # A preview of an existing request still validates current
-              # eligibility and reports itself as a dry run.
-              @coordinator.request_eligible!(existing)
-              return {"status" => "ok", "data" => result(existing).fetch("data").merge("dry_run" => true)}
-            end
-            return result(existing)
-          end
-          route = @topology.route(project: project, capability: operation)
-          return route.envelope unless route.ok?
-          service_id = route.data.fetch("entry").fetch("id")
-          trusted = Molecules::GrantResolver.trusted_document(Ace::Lab.authorization_path) unless @policy
-          policy = @policy || Molecules::ServicePolicy.new(trusted,
-            ->(reference, exact) { @coordinator.proposal_authorization(reference, exact) })
-          head = current_head
-          binding = {"request_id" => request_id, "assignment_id" => assignment, "attempt_id" => attempt,
-                     "project_id" => project, "operation" => operation,
-                     "input_digest" => Atoms::ServiceInput.digest(input), "target" => target,
-                     "candidate_head" => head, "caller_uid" => Process.uid}
-          binding["authorization"] = authorization
-          binding["service_id"] = service_id
-          binding["caller_uid"] = Process.uid
-          validate_attempt!(binding)
-          begin
-            operation_policy = policy.operation!(operation, project: project, service_id: service_id)
-            policy.authorize!(authorization, binding)
-          rescue SecurityError, Ace::Lab::InvalidConfigurationError
-            @coordinator.reject_service_request(binding, reason: "policy_rejected") unless dry_run
-            raise
-          end
-          # The trusted policy owns executor identity and transport; the
-          # journaled claim binds them so only that executor identity can
-          # later complete the receipt. A local operation whose configured
-          # executor is not this process is refused before any claim, so no
-          # authorization is consumed by a dispatch that cannot happen.
-          binding["executor_uid"] = operation_policy.fetch("executor_uid")
-          binding["transport"] = transport = operation_policy.fetch("transport", "local")
-          if transport == "local" &&
-              (Process.uid != binding["executor_uid"] || Process.euid != binding["executor_uid"])
-            # A preview records nothing: the durable rejection is only for
-            # real submissions, so the request ID stays reusable.
-            @coordinator.reject_service_request(binding, reason: "executor_identity_unavailable") unless dry_run
-            raise SecurityError, "current OS identity is not the configured executor"
-          end
-
-          if dry_run
-            # The preview applies the same read-only eligibility checks as
-            # the claim — review evidence for external effects and the
-            # current candidate head — so it cannot promise acceptance for a
-            # request that would fail on submission.
-            @coordinator.request_eligible!(binding)
-            preview = {"outcome" => "accepted", "dry_run" => true, "request_id" => request_id,
-                       "project" => project, "operation" => operation, "service_id" => service_id,
-                       "target" => target, "candidate_head" => head}
-            return {"status" => "ok", "data" => preview}
-          end
-
-          # The claim itself records uncertain (dispatch intent): a crash
-          # after the claim leaves uncertainty, never a stranded accepted
-          # state that a retry would return without dispatching.
-          claimed = @coordinator.claim_service_request(binding)
-          return result(claimed) unless claimed["state"] == "uncertain" && claimed["journal_commit"]
-
-          # The executor reloads the trusted policy from disk at the effect
-          # boundary: a revocation after the claim must still stop dispatch.
-          begin
-            receipt = @executor.execute(operation: operation_policy, request: binding, input: input,
-              policy_loader: policy_loader, authorization: authorization,
-              head_loader: -> { current_head })
-          rescue SecurityError, Ace::Lab::InvalidConfigurationError => e
-            # Refusal before invocation: no effect was attempted. When this
-            # process is the executor identity (local transport), record a
-            # proven no-effect settlement instead of stranding uncertainty.
-            settle_pre_invocation_refusal(binding, request_id, e)
-            raise
-          end
-          return result(@coordinator.service_request_status(request_id)) if receipt.nil?
-
-          state = receipt.fetch("outcome")
-          full_receipt = Models::ServiceReceipt.build(binding, receipt)
-          result(@coordinator.transition_service_request(request_id, state: state, receipt: full_receipt))
-        rescue ArgumentError => e
-          failure("invalid_input", e.message)
-        rescue SecurityError => e
-          failure("unauthorized", e.message)
-        rescue Ace::Lab::InvalidConfigurationError => e
-          failure("invalid_configuration", e.message)
-        rescue Ace::Assign::AttemptErrors::Conflict => e
-          failure("conflict", e.message)
-        rescue Ace::Assign::AttemptErrors::NotFound, Ace::Assign::AttemptErrors::ReceiptRejected => e
-          failure("invalid_attempt", e.message)
-        rescue Ace::Assign::AttemptErrors::InvalidState => e
-          failure("invalid_attempt", e.message)
-        rescue Ace::Assign::AttemptErrors::EvidenceUnavailable => e
-          failure("evidence_unavailable", e.message)
-        end
-
-        def status(request_id:)
-          request = @coordinator.service_request_status(request_id)
-          return failure("missing", "service request not found") unless request
-          return failure("unauthorized", "caller does not own the request") unless request["caller_uid"] == Process.uid
-          visibility = @topology.services(project: request["project_id"])
-          return visibility.envelope unless visibility.ok?
-          result(request)
-        rescue ArgumentError => e
-          failure("invalid_input", e.message)
-        rescue Ace::Assign::AttemptErrors::EvidenceUnavailable => e
-          failure("evidence_unavailable", e.message)
-        end
-
-        private
-
-        # A refusal raised before the handler was invoked proves no effect
-        # was attempted. When this process runs as the executor identity
-        # (local transport), record the proven no-effect settlement with an
-        # executor-owned attestation; otherwise the claim stays uncertain
-        # for evidence-based reconciliation.
-        def settle_pre_invocation_refusal(binding, request_id, error)
-          return unless binding["transport"] == "local" && Process.uid == binding["executor_uid"]
-          evidence_dir = File.join(@repo_root, "evidence", "service")
-          FileUtils.mkdir_p(evidence_dir)
-          attestation = File.join(evidence_dir, "#{request_id}-no-effect")
-          content = "ace-service-attestation request:#{request_id} " \
-            "input:#{binding.fetch("input_digest")} outcome:failed no-effect:true\n" \
-            "refusal: #{error.message}\n"
-          # Exclusive creation without following symlinks: the caller-controlled
-          # request ID must never truncate an existing file, and the artifact
-          # must stay private to pass the executor-owned verification.
-          File.open(attestation, File::WRONLY | File::CREAT | File::EXCL, 0600) do |file|
-            file.write(content)
-          end
-          receipt = Models::ServiceReceipt.build(binding, {
-            "outcome" => "failed",
-            "evidence" => [{"ref" => "evidence/service/#{request_id}-no-effect",
-                            "sha256" => Digest::SHA256.hexdigest(content)}],
-            "executor_uid" => binding.fetch("executor_uid")
-          })
-          @coordinator.reconcile_service_no_effect(request_id, receipt: receipt)
-        rescue Ace::Assign::AttemptErrors::InvalidState, Ace::Assign::AttemptErrors::ReceiptRejected,
-               Ace::Assign::AttemptErrors::NotFound, Errno::ENOENT, Errno::EACCES, Errno::EEXIST
-          nil
-        end
-
-        # The Git toplevel (not a package directory that happens to hold a
-        # Rakefile) bounds evidence verification for nested invocations.
-        def git_toplevel
-          out, status = Open3.capture2("git", "rev-parse", "--show-toplevel")
-          (status&.success? ? out.strip : Dir.pwd)
-        rescue Errno::ENOENT
-          Dir.pwd
-        end
-
-        def policy_loader
-          if @policy
-            -> { @policy }
-          else
-            -> { Molecules::ServicePolicy.new(Molecules::GrantResolver.trusted_document(Ace::Lab.authorization_path),
-              ->(reference, exact) { @coordinator.proposal_authorization(reference, exact) }) }
-          end
-        end
-
-        def validate_attempt!(binding)
-          attempt = @coordinator.service_attempt(binding)
-          unless attempt.candidate_head.nil? || attempt.candidate_head == binding["candidate_head"]
-            raise SecurityError, "request is not bound to an active managed attempt"
-          end
-        end
-
-        def current_head
-          out, _stderr, status = Open3.capture3("git", "rev-parse", "HEAD", chdir: @repo_root)
-          raise SecurityError, "candidate head is unavailable" unless status.success?
-          out.strip
-        end
-
-        def result(request)
-          public = request.slice("request_id", "assignment_id", "attempt_id", "project_id", "operation",
-            "input_digest", "target", "candidate_head", "service_id", "state", "receipt")
-          # failed-settled is internal bookkeeping: the documented public
-          # outcome stays "failed"; the state field distinguishes settlement.
-          outcome = request.fetch("state") == "failed-settled" ? "failed" : request.fetch("state")
-          {"status" => "ok", "data" => public.merge("outcome" => outcome)}
-        end
-
-        def failure(code, message)
-          {"status" => "error", "error" => {"code" => code, "message" => message}}
-        end
-      end
-    end
-  end
-end