ace-runtime 0.1.1 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 69f400097fa32edf5aa93a7628416c5687a1991aa8987aee0a852473e670a0bf
-  data.tar.gz: '0412886bb099e653d49ea3edc8f75d523156c200ffe29ed8f396b3f2261e5b43'
+  metadata.gz: a1da4bd15724f798d3cf8a885c8f992035904e8bc6d95fb7d3c6a87df2ee729a
+  data.tar.gz: 18d24a182510e477b565a5a1ee91d7bc2367fcb4f017f67843335c5d27b2a266
 SHA512:
-  metadata.gz: 99ef79b7c87d7ed944ed80b3faa1defa7da23bc4b1e0e02b481e7f1f4d1e64c9a00c341d384f974a31e65588eb1037fd5a2ad25c90ed80a9e1f09f850f263620
-  data.tar.gz: ceec3d164c446ebdd7bb5f4b139ce19c0b53df2475299e1c9e1891076165b0312e94224a3a9916af00cee136a96da367b8dc462947b09724a3f84a0d178e1c41
+  metadata.gz: 3b09aa5a8962e7dedaabb1e0da2b0f9079e5b8d9d61015a72408ca66fff68b900fc75f458007ded17a41218a5148f1d0a0bf59c494f11f4784f2333b9bc079a7
+  data.tar.gz: eedb9d9395625b1f0c788586f345e296f2c05e141b5935b25bd02af08cddf975dbf15853830b3b42977e309a05c60f852a798ed2c0e846b00e711b5d6c2f2cba

data/CHANGELOG.md

@@ -6,6 +6,24 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-10-05
+
+### Added
+
+- Authenticate bounded root-produced network profile/report/trace artifacts with closed strict JSON schemas, exact context/check joins and held protected file descriptors. Missing or incomplete evidence refuses; effective network enforcement and immutable publication remain the domain installer’s responsibility.
+
+- Verify fixed execution-unit artifact bytes and typed effective system-manager properties, including retained parent activation hierarchy, service enablement routes and exact native/readiness commands. Installation verification remains separate from live boundary and whole-scope proof.
+
+- Add fixed system-systemd unit operations with bounded noninteractive jobs and descriptor-pinned cgroup-v2 population/membership observation. These primitives do not manufacture canonical scope proof or claim installed boundary acceptance.
+
+- Ship the immutable native worker gate and protected Linux/socket primitives with exact process birth, pidfd exit, enforced Yama 2, empty capability sets and NoNewPrivs checks.
+
+- Add read-only process ownership observation with PID birth identity, OS ancestry, unknown liveness and shared adapter contract coverage.
+
+### Fixed
+
+- Parse genuine typed nsfs mount roots while rejecting them as backing-storage projections, and query activation properties through the correct fixed slice and service interfaces.
+
 ## [0.1.1] - 2026-10-04
 
 ### Fixed

data/README.md

@@ -18,6 +18,7 @@ Eleven operations, keyword-arg surfaces mirroring today's consumer calls:
 |-----------|---------|
 | Context | `runtime.context` → `{in_runtime:, session:, window:, pane:}` |
 | Ensure window | `runtime.ensure_window(name:, root:, preset: nil)` — idempotent by normalized name; conflicting root/preset raises `WindowConflictError` |
+| Process identity | `runtime.process_binding(pane:, caller_pid:)` → verified owner/native binding or nil (unknown); read-only, no authorization |
 | Prepare pane | `runtime.prepare_pane(window:)` — splits when needed; target stays alive after a submitted command exits |
 | Focus | `runtime.focus(window:)` |
 | Send | `runtime.send(pane:, command: nil, items: [])` — ordered `{message: String}` / `{key: String}` entries |
@@ -118,3 +119,11 @@ adapter-authoring walkthrough.
 Note: adapters intentionally define `send` (the intent operation),
 which overrides `Object#send`. Use `__send__` for reflective dispatch
 on adapter objects.
+
+## Recoverable process ownership
+
+`process_binding(pane:, caller_pid:)` identifies a caller's owner below the exact native retained shell. The returned string-keyed object binds `runtime`, `session`, `pane`, `shell_identity` and `process_identity`; each OS identity carries PID, UID, start time and host. Herdr additionally binds durable terminal ID, agent kind and immutable native agent session, and corroborates the owner against foreground process information. No command line arguments are stored.
+
+An absent or non-native caller, retained shell without its owner, inaccessible OS facts, zombie or mismatched process returns nil. Native transport failures keep the standard typed error model. Consumers must compare the complete binding on each recovery observation. A process binding proves liveness only and grants no actor, service, effect or HITL authority. Unknown observation preserves resources; it does not prove all descendants stopped.
+
+Process birth uses Linux boot ID with `/proc` start ticks or Darwin libproc microsecond birth. Whole-second `ps lstart` is never identity evidence. Unsupported/unreadable exact birth facilities return unknown. Capture brackets process metadata with birth reads, and native ownership revalidates the whole ancestor chain before returning it.

data/docs/usage.md

@@ -187,3 +187,71 @@ The reference implementation is `test/support/fake_runtime_adapter.rb`
 in the ace-runtime gem; the in-gem suite
 (`test/contract/adapter_contract_test.rb`) proves the battery against
 it for both send profiles.
+
+## Root-produced network installation evidence
+
+The source-only `Ace::Runtime::Molecules::NetworkInstallationEvidence` consumer
+checks the protected content selected by the installed scope owner:
+
+```ruby
+result = Ace::Runtime::Molecules::NetworkInstallationEvidence.verify!(
+  selection: boundary_manifest.fetch("network_installation"),
+  expected: {
+    "slot_id" => slot_id,
+    "namespace_path" => installed_namespace_path,
+    "boot_id" => current_boot_id,
+    "namespace_identity" => {"device" => pinned_device, "inode" => pinned_inode},
+    "installer_artifact_sha256" => installed_producer_sha256
+  }
+)
+```
+
+`selection` is exactly `{profile,policy_export,report,installer_artifact}`; each
+reference is exactly `{path,sha256,bytes}`. All keys are strings, paths canonical
+and absolute, SHA256 lowercase, and lengths positive integers. There is no
+caller-uploaded evidence or caller-selected trust root. The namespace identity
+above must come from the owner's actual held, authenticated nsfs network object;
+the owner validates its type/current boot and keeps the namespace pinned through
+admission. This verifier reads content artifacts and never opens/substitutes the
+namespace, probes traffic or grants runtime networking privilege.
+
+Successful output contains exactly `report_id`, `boot_id`, `slot_id`,
+`namespace_path`, `namespace_identity`, `profile_sha256`, `policy_export_sha256`,
+`report_sha256` and `installer_artifact_sha256`, deeply frozen. It authenticates
+installation content, not actual enforcement from a summary boolean. Missing,
+unreadable, malformed, conflicting, oversized or context-mismatched evidence
+raises `Ace::Runtime::RuntimeUnavailableError`; the authority boundary exposes
+that refusal as `evidence_unavailable` and retains public `invalid_input`
+classification for malformed public selectors. No absent-evidence fallback.
+
+The reader pins regular-file and directory descriptors for the complete graph,
+checks exact lengths/digests and revalidates original objects/modes at completion.
+It uses root ownership and no group/other write on supported Linux POSIX local
+filesystems (`ext2`, `ext3`, `ext4`, `xfs`, `btrfs`, `tmpfs`): group mode bits
+represent the access ACL mask, so named non-root ACL users/groups cannot obtain
+write through it. Unknown filesystem models refuse. All ancestors are checked;
+no symlink, untrusted writable ancestor or mutable worker artifact qualifies.
+Content bounds are 1MiB per artifact, 16MiB aggregate and 256 distinct artifacts.
+The profile's 256-entry bound counts its four outer collections only; nested
+ranges, ports and helper/configuration refs are bounded by the profile bytes and
+separate artifact graph limits. Strict JSON parsing requires the declared
+`json >= 2.20, < 3` dependency to reject duplicate keys and comments explicitly.
+
+The trusted domain installer owns complete effective policy/topology comparison,
+independent correlated flow checks, immutable digest-bearing evidence filenames
+and publication that preserves historical artifacts. The generic reference
+schema specifies no basename grammar: this consumer checks selected content and
+protection, and cannot establish publication history. Raw policy/topology/setup
+and correlated observations remain required; unsupported or incomplete domain
+checks must never produce a passing report. Domain source/installed review proves
+those obligations. For each loopback tool, the fixed domain procedure inspects
+the actual selected executable against its profile `artifact_sha256` and retains
+the observation in the exact tool-target trace. The schema provides no executable
+path/ref: generic ACE authenticates the trace/raw refs and digest format; it does
+not compare a tool executable digest with observation bytes or invent a ref.
+Domain acceptance must exercise tool-executable mismatch refusal.
+
+Root installation lifetime, private admission CAS, stage joins,
+namespace containment and maintenance ordering belong to their respective
+installed owners; this verifier does not implement them or supply native,
+packet-filter or installed acceptance by itself.

data/lib/ace/runtime/molecules/cgroup_observation.rb

@@ -0,0 +1,148 @@
+# frozen_string_literal: true
+
+require_relative "../errors"
+require_relative "linux_mount_info"
+
+module Ace
+  module Runtime
+    module Molecules
+      # A live descriptor pins the parent object, never the reusable pathname.
+      # Population is an observation only: canonical admission seal and verified
+      # resource boundaries remain the authority owner's responsibility.
+      class CgroupObservation
+        ROOT = "/sys/fs/cgroup"
+        IDENTITY_FIELDS = %w[path mount_id filesystem_type device inode].freeze
+
+        class KernelFiles
+          def open_directory(path)
+            File.open(path, File::RDONLY | File::NOFOLLOW)
+          end
+
+          def read(path, limit:)
+            File.open(path, File::RDONLY | File::NOFOLLOW) do |file|
+              bytes = file.read(limit + 1)
+              raise RuntimeUnavailableError, "kernel scope observation is oversized" if bytes.bytesize > limit
+              bytes
+            end
+          end
+
+          def mount_identity(handle)
+            info = read("/proc/self/fdinfo/#{handle.fileno}", limit: 4096)
+            matches = info.lines.filter_map { |line| /\Amnt_id:\s+([0-9]+)\s*\z/.match(line)&.[](1) }
+            raise RuntimeUnavailableError, "scope mount identity is unavailable" unless matches.size == 1
+            mount_id = Integer(matches.first, 10)
+            mount = LinuxMountInfo.new(read("/proc/self/mountinfo", limit: LinuxMountInfo::LIMIT)).by_id(mount_id)
+            mount.slice("mount_id", "filesystem_type", "root", "mountpoint")
+          end
+        end
+
+        def initialize(files: KernelFiles.new)
+          @files = files
+        end
+
+        def pin(path, expected: nil)
+          validate_path!(path)
+          handle = @files.open_directory(path)
+          identity = identity_for(handle, path)
+          unless expected.nil? || valid_identity?(expected) && identity == expected
+            raise RuntimeUnavailableError, "retained scope object was replaced"
+          end
+          verify_path!(handle, identity)
+          {handle: handle, identity: identity.freeze}
+        rescue SystemCallError, IOError
+          handle&.close
+          raise RuntimeUnavailableError, "exact scope object cannot be pinned"
+        rescue Exception
+          handle&.close
+          raise
+        end
+
+        def observe(pinned)
+          handle, identity = pinned.values_at(:handle, :identity)
+          unless handle && !handle.closed? && valid_identity?(identity) && identity_for(handle, identity.fetch("path")) == identity
+            raise RuntimeUnavailableError, "pinned scope identity changed"
+          end
+          verify_path!(handle, identity)
+          bytes = @files.read("/proc/self/fd/#{handle.fileno}/cgroup.events", limit: 4096)
+          fields = parse_events(bytes)
+          verify_path!(handle, identity)
+          {"cgroup_identity" => identity.dup, "populated" => fields.fetch("populated")}
+        rescue SystemCallError, IOError, KeyError
+          raise RuntimeUnavailableError, "retained scope cannot be observed"
+        end
+
+        # Membership checks use the caller's independently pinned birth policy.
+        # A namespace-relative cgroup value must agree with the host parent;
+        # unresolved membership refuses rather than following another mount.
+        def member!(identity, pinned:, kernel:)
+          kernel.live!(identity)
+          observe(pinned)
+          bytes = @files.read("/proc/#{identity.fetch('pid')}/cgroup", limit: 4096)
+          paths = bytes.lines.filter_map { |line| /\A0::(\/[^\n]*)\n?\z/.match(line)&.[](1) }
+          parent = pinned.fetch(:identity).fetch("path").delete_prefix(ROOT)
+          unless paths.size == 1 && (paths.first == parent || paths.first.start_with?(parent + "/"))
+            raise RuntimeUnavailableError, "process is outside the exact execution scope"
+          end
+          kernel.live!(identity)
+          observe(pinned)
+          true
+        end
+
+        def parse_events(bytes)
+          unless bytes.is_a?(String) && bytes.bytesize.between?(1, 4096)
+            raise RuntimeUnavailableError, "cgroup population is unavailable"
+          end
+          fields = {}
+          bytes.each_line do |line|
+            match = /\A([a-z_]+) ([0-9]+)\n?\z/.match(line)
+            unless match && !fields.key?(match[1])
+              raise RuntimeUnavailableError, "cgroup events are malformed"
+            end
+            fields[match[1]] = Integer(match[2], 10)
+          end
+          unless [0, 1].include?(fields["populated"])
+            raise RuntimeUnavailableError, "cgroup population is not a positive kernel observation"
+          end
+          fields
+        end
+
+        private
+
+        def valid_identity?(value)
+          value.is_a?(Hash) && value.keys.sort == IDENTITY_FIELDS.sort &&
+            value["path"].is_a?(String) && value["filesystem_type"] == "cgroup2" && %w[mount_id device inode].all? do |key|
+              value[key].is_a?(Integer) && value[key] >= 0
+            end
+        end
+
+        def validate_path!(path)
+          unless path.is_a?(String) && path.bytesize <= 4096 && !path.include?("\0") &&
+              path.start_with?(ROOT + "/") && File.expand_path(path) == path && path != ROOT
+            raise RuntimeUnavailableError, "scope must be an exact parent below the unified cgroup root"
+          end
+        end
+
+        def identity_for(handle, path)
+          stat = handle.stat
+          mount = @files.mount_identity(handle)
+          unless stat.directory? && mount["filesystem_type"] == "cgroup2" &&
+              mount["mountpoint"] == ROOT && mount["root"] == "/"
+            raise RuntimeUnavailableError, "scope requires the host unified cgroup-v2 mount"
+          end
+          {"path" => path, "mount_id" => mount.fetch("mount_id"), "filesystem_type" => "cgroup2",
+           "device" => stat.dev, "inode" => stat.ino}
+        end
+
+        def verify_path!(handle, identity)
+          current = @files.open_directory(identity.fetch("path"))
+          unless identity_for(current, identity.fetch("path")) == identity && handle.stat.ino == current.stat.ino
+            raise RuntimeUnavailableError, "scope pathname no longer names its pinned object"
+          end
+          true
+        ensure
+          current&.close
+        end
+      end
+    end
+  end
+end

data/lib/ace/runtime/molecules/execution_unit_installation.rb

@@ -0,0 +1,309 @@
+# frozen_string_literal: true
+
+require "json"
+require "digest"
+require "etc"
+require_relative "systemd_scope_manager"
+
+module Ace
+  module Runtime
+    module Molecules
+      # Root-installed artifacts plus the system manager's effective properties.
+      # These establish installation identity, not effective runtime isolation;
+      # the same-User readiness action and live owner verify that separately.
+      class ExecutionUnitInstallation
+        SCHEMA = "ace.execution-unit-manifest/v1"
+        ROLES = %w[slice_fragment service_fragment unit_dropin native_executable native_configuration
+          readiness_executable bootstrap worker_executable runtime_dependency].freeze
+        REQUIRED_ROLES = %w[slice_fragment service_fragment native_executable native_configuration
+          readiness_executable bootstrap worker_executable].freeze
+        SERVICE_REQUIRED = {"Type" => "exec", "Restart" => "no", "RestartForceExitStatus" => [[], []],
+          "KillMode" => "control-group", "SendSIGKILL" => true, "Delegate" => false,
+          "ProtectControlGroups" => true, "NoNewPrivileges" => true, "CapabilityBoundingSet" => 0,
+          "AmbientCapabilities" => 0, "RestrictNamespaces" => 0, "PrivateIPC" => true,
+          "PrivateDevices" => true, "ProtectSystem" => "strict", "DynamicUser" => false,
+          "EnvironmentFiles" => [], "PassEnvironment" => [], "UnsetEnvironment" => [],
+          "StandardOutput" => "journal", "StandardError" => "journal", "RuntimeDirectoryPreserve" => "no",
+          "RuntimeDirectoryMode" => 0o700, "UMask" => 0o077, "RootImage" => "", "RootImageOptions" => [], "RootEphemeral" => false, "ExtensionDirectories" => [],
+          "ExtensionImages" => [], "MountImages" => [], "TemporaryFileSystem" => [], "InaccessiblePaths" => []}.freeze
+        EMPTY_ACTIVATION = %w[Requisite BindsTo PartOf Upholds OnFailure OnSuccess OnFailureOf OnSuccessOf
+          TriggeredBy Triggers PropagatesStopTo StopPropagatedFrom JoinsNamespaceOf].freeze
+        NATIVE_ENVIRONMENT = %w[HERDR_CONFIG_PATH HERDR_SOCKET_PATH HOME SHELL PATH LANG LC_ALL TERM
+          TMPDIR TMP TEMP XDG_CONFIG_HOME XDG_DATA_HOME XDG_STATE_HOME XDG_CACHE_HOME XDG_RUNTIME_DIR CODEX_HOME CLAUDE_CONFIG_DIR].freeze
+        IMPLICIT_NAMESPACE_ROOTS = %w[/dev /proc /sys /run /tmp /var/tmp].freeze
+        EMPTY_EXEC = %w[ExecConditionEx ExecStartPreEx ExecReloadEx ExecStopEx ExecStopPostEx].freeze
+
+        class Files
+          def read(path, limit:)
+            ProtectedSocket.root_path!(path)
+            File.open(path, File::RDONLY | File::NOFOLLOW) do |file|
+              stat = file.stat
+              unless stat.file? && stat.uid.zero? && (stat.mode & 0o022).zero?
+                raise RuntimeUnavailableError, "installed artifact descriptor ownership is unsafe"
+              end
+              bytes = file.read(limit + 1)
+              raise RuntimeUnavailableError, "installed artifact is oversized" if bytes.bytesize > limit
+              bytes
+            end
+          end
+
+          def activation_routes(paths, service_unit)
+            routes = []
+            visited = 0
+            pending = paths.map { |path| [path, 0] }
+            until pending.empty?
+              directory, depth = pending.shift
+              begin
+                ProtectedSocket.root_path!(directory, directory: true)
+              rescue RuntimeUnavailableError
+                if !File.exist?(directory) && !File.symlink?(directory)
+                  ancestor = File.dirname(directory)
+                  ancestor = File.dirname(ancestor) until File.exist?(ancestor) || ancestor == "/"
+                  ProtectedSocket.root_path!(ancestor, directory: true)
+                  next
+                end
+                raise
+              end
+              Dir.children(directory).sort.each do |name|
+                visited += 1
+                raise RuntimeUnavailableError, "installed activation graph is oversized" if visited > 50_000
+                path = File.join(directory, name)
+                stat = File.lstat(path)
+                if stat.symlink?
+                  raise RuntimeUnavailableError, "activation graph link owner differs" unless stat.uid.zero?
+                  target = File.expand_path(File.readlink(path), directory)
+                  if File.basename(target) == service_unit ||
+                      (name == service_unit && directory.match?(/\.(?:wants|requires|upholds)\z/))
+                    routes << path
+                  end
+                elsif stat.directory?
+                  raise RuntimeUnavailableError, "activation graph directory is too deep" if depth >= 8
+                  pending << [path, depth + 1]
+                end
+              end
+            end
+            routes
+          end
+
+          def sha256(path)
+            ProtectedSocket.root_path!(path)
+            File.open(path, File::RDONLY | File::NOFOLLOW) do |file|
+              stat = file.stat
+              unless stat.file? && stat.uid.zero? && (stat.mode & 0o6022).zero? && stat.size <= 268_435_456
+                raise RuntimeUnavailableError, "installed artifact kind/mode/size is unsafe"
+              end
+              digest = Digest::SHA256.new
+              while (chunk = file.read(65_536))
+                digest.update(chunk)
+              end
+              digest.hexdigest
+            end
+          end
+        end
+
+        def initialize(scope:, native:, bootstrap:, worker_executable:, worker_uid:, worker_gid:, files: Files.new)
+          @scope, @native, @bootstrap, @worker_executable, @files = scope, native, bootstrap, worker_executable, files
+          @worker_uid, @worker_gid = worker_uid, worker_gid
+        end
+
+        def verify!(manager:)
+          slot = @scope.fetch("slot_id")
+          unless slot.is_a?(String) && SystemdScopeManager::UNIT.match?(slot)
+            raise RuntimeUnavailableError, "installed slot identity is invalid"
+          end
+          bytes = @files.read("/etc/ace/execution-slots/#{slot}/unit-manifest.json", limit: 65_536)
+          unless Digest::SHA256.hexdigest(bytes) == @scope.fetch("unit_manifest_sha256")
+            raise RuntimeUnavailableError, "unit manifest bytes differ from deployment"
+          end
+          manifest = JSON.parse(bytes)
+          unless manifest.is_a?(Hash) && manifest.keys.sort == %w[artifacts properties schema slot_id] &&
+              manifest["schema"] == SCHEMA && manifest["slot_id"] == slot
+            raise RuntimeUnavailableError, "unit manifest schema/slot differs"
+          end
+          artifacts = verify_artifacts!(manifest.fetch("artifacts"))
+          profile = manager.inspect_profile
+          verify_profile!(profile, manifest.fetch("properties"), artifacts)
+          manifest
+        rescue SystemCallError, IOError, JSON::ParserError, KeyError, TypeError, NoMethodError
+          raise RuntimeUnavailableError, "installed execution units cannot be verified"
+        end
+
+        private
+
+        def verify_artifacts!(artifacts)
+          unless artifacts.is_a?(Array) && artifacts.size.between?(7, 512) &&
+              artifacts.all? { |a| a.is_a?(Hash) && a.keys.sort == %w[host_path role sha256 view_path] } &&
+              artifacts.map { |a| a["host_path"] }.uniq.size == artifacts.size
+            raise RuntimeUnavailableError, "installed unit artifact declarations differ"
+          end
+          roles = artifacts.group_by { |a| a.fetch("role") }
+          unless REQUIRED_ROLES.all? { |role| roles.key?(role) } && (roles.keys - ROLES).empty? &&
+              %w[slice_fragment service_fragment native_executable native_configuration readiness_executable bootstrap worker_executable].all? { |role| roles[role].size == 1 }
+            raise RuntimeUnavailableError, "installed unit artifacts are incomplete or ambiguous"
+          end
+          artifacts.each do |artifact|
+            path, digest = artifact.values_at("host_path", "sha256")
+            unless path?(path) && path?(artifact["view_path"]) && digest.is_a?(String) && digest.match?(/\A[0-9a-f]{64}\z/) && @files.sha256(path) == digest
+              raise RuntimeUnavailableError, "installed unit artifact identity changed"
+            end
+          end
+          expected = {"native_executable" => @native.fetch("executable"), "bootstrap" => @bootstrap,
+            "worker_executable" => @worker_executable}
+          unless expected.all? { |role, path| roles.fetch(role).first.fetch("view_path") == path } &&
+              roles.fetch("native_executable").first.fetch("sha256") == @native.fetch("executable_sha256")
+            raise RuntimeUnavailableError, "installed executable declarations differ from deployment"
+          end
+          roles
+        end
+
+        def verify_profile!(profile, expected, artifacts)
+          unless expected.is_a?(Hash) && expected.keys.sort == %w[service slice]
+            raise RuntimeUnavailableError, "unit profile declarations differ"
+          end
+          {"slice" => SystemdScopeManager::UNIT_GRAPH_SIGNATURES.keys,
+           "service" => (SystemdScopeManager::UNIT_GRAPH_SIGNATURES.keys + SystemdScopeManager::SERVICE_EXEC_SIGNATURES.keys).uniq}.each do |kind, keys|
+            wanted, actual = expected.fetch(kind), profile.fetch(kind)
+            projected = actual.dup
+            %w[ExecStartEx ExecStartPostEx].each do |key|
+              projected[key] = actual.fetch(key).map { |command| command.first(3) } if kind == "service"
+            end
+            unless wanted.is_a?(Hash) && wanted.keys.sort == keys.sort && projected == wanted &&
+                actual["Id"] == @scope.fetch("#{kind}_unit") && actual["Names"] == [actual["Id"]] &&
+                actual["LoadState"] == "loaded" && actual["NeedDaemonReload"] == false
+              raise RuntimeUnavailableError, "effective installed unit properties differ"
+            end
+            fragment = artifacts.fetch("#{kind}_fragment").first.fetch("host_path")
+            unless actual["FragmentPath"] == fragment && File.basename(fragment) == @scope.fetch("#{kind}_unit")
+              raise RuntimeUnavailableError, "system manager loaded another unit fragment"
+            end
+            unless actual.fetch("DropInPaths").is_a?(Array) && actual.fetch("DropInPaths").all? { |path|
+              artifacts.fetch("unit_dropin", []).any? { |artifact| artifact["host_path"] == path }
+            }
+              raise RuntimeUnavailableError, "system manager loaded an unverified drop-in"
+            end
+          end
+          slice, service = profile.values_at("slice", "service")
+          verify_graph!(slice, service, profile.fetch("ancestors"), profile.fetch("prerequisites"))
+          unless @files.activation_routes(profile.fetch("unit_paths"), @scope.fetch("service_unit")).empty?
+            raise RuntimeUnavailableError, "service has installed outside enablement or alias routes"
+          end
+          unless slice["StopWhenUnneeded"] == false && service["Sockets"] == [] &&
+              service["RootDirectory"] == @scope.fetch("root_directory") &&
+              service["NetworkNamespacePath"] == @scope.fetch("network_namespace_path") &&
+              credential_id(service.fetch("User"), :uid) == @worker_uid &&
+              credential_id(service.fetch("Group"), :gid) == @worker_gid &&
+              SERVICE_REQUIRED.all? { |key, value| service[key] == value } &&
+              service["SupplementaryGroups"] == [] &&
+              service["RestrictAddressFamilies"] == [true, %w[AF_INET AF_INET6 AF_UNIX]] &&
+              EMPTY_EXEC.all? { |key| service[key] == [] }
+            raise RuntimeUnavailableError, "execution unit lacks the required retained isolation profile"
+          end
+          verify_command!(service.fetch("ExecStartEx"), artifacts.fetch("native_executable").first.fetch("view_path"))
+          verify_command!(service.fetch("ExecStartPostEx"), artifacts.fetch("readiness_executable").first.fetch("view_path"))
+          unless service.fetch("ExecStartEx").first[1] == [@native.fetch("executable"), "server"] &&
+              service.fetch("ExecStartPostEx").first[1] == [artifacts.fetch("readiness_executable").first.fetch("view_path"), @scope.fetch("slot_id")]
+            raise RuntimeUnavailableError, "unit commands differ from the fixed native/readiness protocol"
+          end
+          environment = service.fetch("Environment")
+          unless environment.is_a?(Array) && environment.all? { |entry| entry.is_a?(String) && !entry.include?("\0") } &&
+              environment.all? { |entry| key, value = entry.split("=", 2); NATIVE_ENVIRONMENT.include?(key) && value && !value.empty? } &&
+              environment.map { |entry| entry.split("=", 2).first }.uniq.size == environment.size &&
+              environment.include?("HERDR_CONFIG_PATH=#{artifacts.fetch('native_configuration').first.fetch('view_path')}")
+            raise RuntimeUnavailableError, "native configuration is not the exact immutable input"
+          end
+          verify_artifact_projection!(service, artifacts)
+        end
+
+        def verify_graph!(slice, service, ancestors, prerequisites)
+          unless ancestors.is_a?(Hash) && !ancestors.empty?
+            raise RuntimeUnavailableError, "parent activation graph is incomplete"
+          end
+          parents = [slice, *ancestors.values]
+          parents.each_with_index do |unit, index|
+            parent = parents[index + 1]
+            permitted = parent ? [parent.fetch("Id")] : []
+            unless unit["LoadState"] == "loaded" && unit["NeedDaemonReload"] == false &&
+                unit["Requires"] == permitted && unit["Wants"] == [] &&
+                (EMPTY_ACTIVATION + %w[RequiresMountsFor WantsMountsFor]).all? { |key| unit[key] == [] }
+              raise RuntimeUnavailableError, "parent activation graph could start outside its retained hierarchy"
+            end
+          end
+          permitted_paths = [@scope.fetch("root_directory"), *service.fetch("RuntimeDirectory").map { |path| "/run/#{path}" }]
+          unless prerequisites.is_a?(Hash) && prerequisites.all? { |unit, value|
+            value["Id"] == unit && value["LoadState"] == "loaded" && value["ActiveState"] == "active" && value["Job"] == [0, "/"] &&
+              (unit == "systemd-journald.socket" && value["SubState"] == "listening" ||
+                unit.end_with?(".mount") && value["SubState"] == "mounted" && (value["Where"] == "/" || path?(value["Where"])) &&
+                permitted_paths.any? { |path| covers?(value["Where"], path) })
+          } && (service.values_at("Requires", "Wants", "After").flatten.uniq - [slice["Id"]]).sort == prerequisites.keys.sort &&
+              service.values_at("Requires", "Wants").flatten.none? { |unit| unit == "systemd-journald.socket" }
+            raise RuntimeUnavailableError, "implicit backing mounts/logging are not active exact prerequisites"
+          end
+          unless parents.last["Id"] == "-.slice" && service["Slice"] == slice["Id"] &&
+              service["Requires"].include?(slice["Id"]) && service["After"].include?(slice["Id"]) &&
+              service["WantsMountsFor"] == [@scope.fetch("root_directory")] &&
+              service.fetch("RuntimeDirectory") == [@scope.fetch("runtime_directory").delete_prefix("/run/")] &&
+              service["RequiresMountsFor"].sort == service.fetch("RuntimeDirectory").map { |path| "/run/#{path}" }.sort &&
+              service["WorkingDirectory"] == "" && service["DefaultDependencies"] == false &&
+              %w[RequiredBy RequisiteOf WantedBy BoundBy UpheldBy ConsistsOf].all? { |key| service[key] == [] } &&
+              %w[disabled static].include?(service["UnitFileState"]) &&
+              EMPTY_ACTIVATION.all? { |key| service[key] == [] }
+            raise RuntimeUnavailableError, "service has outside activation or parent stop propagation"
+          end
+        end
+
+        def verify_artifact_projection!(service, artifacts)
+          writable = service.fetch("BindPaths")
+          readonly = service.fetch("BindReadOnlyPaths")
+          mounts = writable + readonly
+          unless mounts.all? { |mount| path?(mount[0]) && path?(mount[1]) && mount[2] == false && mount[3] == 0 } &&
+              mounts.map { |mount| mount[1] }.uniq.size == mounts.size
+            raise RuntimeUnavailableError, "unit mount projection is ambiguous or optional"
+          end
+          artifacts.each do |role, entries|
+            next if %w[slice_fragment service_fragment unit_dropin].include?(role)
+            entries.each do |artifact|
+              view = artifact.fetch("view_path")
+              if IMPLICIT_NAMESPACE_ROOTS.any? { |root| covers?(root, view) } ||
+                  service.fetch("ReadWritePaths").any? { |root| !path?(root) || covers?(root, view) }
+                raise RuntimeUnavailableError, "immutable artifact is inside an implicit or writable namespace projection"
+              end
+              if writable.any? { |mount| overlaps?(view, mount[1]) }
+                raise RuntimeUnavailableError, "immutable unit artifact has a writable overlay"
+              end
+              selected = readonly.select { |mount| covers?(mount[1], view) }.max_by { |mount| mount[1].length }
+              relative = selected && view.delete_prefix(selected[1]).delete_prefix("/")
+              host = selected ? (relative.empty? ? selected[0] : File.join(selected[0], relative)) : @scope.fetch("root_directory") + view
+              unless artifact.fetch("host_path") == host
+                raise RuntimeUnavailableError, "hashed artifact is shadowed by another effective unit mount"
+              end
+            end
+          end
+        end
+
+        def covers?(root, path) = root == path || root == "/" || path.start_with?(root + "/")
+        def overlaps?(left, right) = covers?(left, right) || covers?(right, left)
+
+        def verify_command!(value, executable)
+          unless value.is_a?(Array) && value.size == 1 && value.first.is_a?(Array) && value.first.size == 10 &&
+              value.first[0] == executable && value.first[1].is_a?(Array) && value.first[1].first == executable &&
+              value.first[1].all? { |arg| arg.is_a?(String) && !arg.include?("\0") } && value.first[2] == [] &&
+              value.first[3..].all? { |number| number.is_a?(Integer) }
+            raise RuntimeUnavailableError, "unit command bypasses fixed unprivileged execution"
+          end
+        end
+
+        def credential_id(value, kind)
+          return Integer(value, 10) if value.match?(/\A[1-9][0-9]*\z/)
+          kind == :uid ? Etc.getpwnam(value).uid : Etc.getgrnam(value).gid
+        rescue ArgumentError
+          raise RuntimeUnavailableError, "installed unit principal is unavailable"
+        end
+
+        def path?(value)
+          value.is_a?(String) && value.bytesize.between?(2, 4096) && value.start_with?("/") &&
+            !value.match?(/[\s\0;]/) && File.expand_path(value) == value
+        end
+      end
+    end
+  end
+end