ace-runtime 0.1.1 → 0.2.0

data/lib/ace/runtime/molecules/systemd_scope_manager.rb

@@ -0,0 +1,323 @@
+# frozen_string_literal: true
+
+require_relative "protected_socket"
+require "json"
+
+module Ace
+  module Runtime
+    module Molecules
+      # Fixed installed system-manager units only. This adapter does not decide
+      # when a generation may start/stop: canonical lifecycle owns admission.
+      class SystemdScopeManager
+        SYSTEMCTL = "/usr/bin/systemctl"
+        BUSCTL = "/usr/bin/busctl"
+        UNIT = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/
+        PROPERTIES = %w[Id LoadState ActiveState SubState InvocationID ControlGroup Job
+          FragmentPath DropInPaths].freeze
+        SERVICE_PROPERTIES = (PROPERTIES + %w[MainPID Slice]).freeze
+        UNIT_GRAPH_SIGNATURES = {
+          "Id" => "s", "Names" => "as", "LoadState" => "s", "FragmentPath" => "s", "DropInPaths" => "as",
+          "UnitFileState" => "s", "NeedDaemonReload" => "b", "StopWhenUnneeded" => "b", "DefaultDependencies" => "b",
+          **%w[Requires Requisite Wants BindsTo PartOf Upholds RequiredBy RequisiteOf WantedBy BoundBy UpheldBy
+            ConsistsOf After Before OnSuccess OnSuccessOf OnFailure OnFailureOf Triggers TriggeredBy
+            PropagatesStopTo StopPropagatedFrom JoinsNamespaceOf RequiresMountsFor WantsMountsFor].to_h { |key| [key, "as"] }
+        }.freeze
+        SERVICE_EXEC_SIGNATURES = {
+          **%w[Type User Group Restart KillMode ProtectSystem RootDirectory RootImage NetworkNamespacePath Slice StandardOutput StandardError WorkingDirectory RuntimeDirectoryPreserve].to_h { |key| [key, "s"] },
+          **%w[SupplementaryGroups ReadWritePaths ReadOnlyPaths Environment PassEnvironment UnsetEnvironment Sockets InaccessiblePaths ExtensionDirectories RuntimeDirectory].to_h { |key| [key, "as"] },
+          **%w[SendSIGKILL Delegate ProtectControlGroups NoNewPrivileges PrivateIPC PrivateDevices DynamicUser RootEphemeral MountAPIVFS].to_h { |key| [key, "b"] },
+          **%w[CapabilityBoundingSet AmbientCapabilities RestrictNamespaces].to_h { |key| [key, "t"] },
+          "RuntimeDirectoryMode" => "u", "UMask" => "u", "RootImageOptions" => "a(ss)", "TemporaryFileSystem" => "a(ss)", "MountImages" => "a(ssba(ss))",
+          "ExtensionImages" => "a(sba(ss))", "EnvironmentFiles" => "a(sb)", "RestartForceExitStatus" => "(aiai)", "RestrictAddressFamilies" => "(bas)",
+          "BindPaths" => "a(ssbt)", "BindReadOnlyPaths" => "a(ssbt)",
+          **%w[ExecConditionEx ExecStartPreEx ExecStartEx ExecStartPostEx ExecReloadEx ExecStopEx ExecStopPostEx].to_h { |key| [key, "a(sasasttttuii)"] }
+        }.freeze
+
+        UNIT_STATE_SIGNATURES = {"Id" => "s", "LoadState" => "s", "ActiveState" => "s", "SubState" => "s", "Job" => "(uo)"}.freeze
+        MOUNT_SIGNATURES = {"Where" => "s"}.freeze
+        ACTIVATION_UNIT_SIGNATURES = UNIT_STATE_SIGNATURES.merge("InvocationID" => "s", "ControlGroup" => "s").freeze
+        ACTIVATION_SERVICE_SIGNATURES = {"MainPID" => "u", "ControlPID" => "u", "Slice" => "s"}.freeze
+
+        class Command
+          LIMIT = 65_536
+
+          def call(argv, timeout:)
+            unless RUBY_PLATFORM.include?("linux") && File.directory?("/run/systemd/system")
+              raise RuntimeUnavailableError, "execution scope requires the Linux system systemd manager"
+            end
+            client = argv.first
+            unless [SYSTEMCTL, BUSCTL].include?(client)
+              raise RuntimeUnavailableError, "system manager client is not fixed"
+            end
+            ProtectedSocket.root_path!(client)
+            unless File.executable?(client) && (File.stat(client).mode & 0o6000).zero?
+              raise RuntimeUnavailableError, "installed system manager client is unsafe"
+            end
+            output_reader, output_writer = IO.pipe
+            error_reader, error_writer = IO.pipe
+            pid = Process.spawn({"PATH" => "/usr/bin:/bin", "LANG" => "C", "LC_ALL" => "C"}, *argv,
+              in: File::NULL, out: output_writer, err: error_writer, unsetenv_others: true, close_others: true)
+            output_writer.close
+            error_writer.close
+            deadline = ProtectedSocket.deadline(timeout)
+            readers = [output_reader, error_reader]
+            bytes = {output_reader => +"", error_reader => +""}
+            until readers.empty?
+              remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+              ready = remaining.positive? && IO.select(readers, nil, nil, remaining)
+              raise RuntimeUnavailableError, "system manager job outcome is unavailable" unless ready
+              ready.first.each do |reader|
+                chunk = reader.read_nonblock(4096, exception: false)
+                next if chunk == :wait_readable
+                if chunk.nil?
+                  readers.delete(reader)
+                else
+                  bytes.fetch(reader) << chunk
+                  if bytes.values.sum(&:bytesize) > LIMIT
+                    raise RuntimeUnavailableError, "system manager response is oversized"
+                  end
+                end
+              end
+            end
+            loop do
+              waited = Process.waitpid(pid, Process::WNOHANG)
+              if waited
+                status = $?
+                pid = nil
+                raise RuntimeUnavailableError, "fixed system manager operation was refused" unless status.success?
+                return bytes.fetch(output_reader)
+              end
+              unless Process.clock_gettime(Process::CLOCK_MONOTONIC) < deadline
+                raise RuntimeUnavailableError, "system manager job outcome is unavailable"
+              end
+              sleep 0.01
+            end
+          rescue SystemCallError, IOError
+            raise RuntimeUnavailableError, "system manager operation is unavailable"
+          ensure
+            [output_reader, output_writer, error_reader, error_writer].compact.each do |stream|
+              stream.close unless stream.closed?
+            end
+            if pid
+              begin
+                Process.kill("KILL", pid)
+              rescue Errno::ESRCH
+                nil
+              ensure
+                begin
+                  Process.waitpid(pid)
+                rescue Errno::ECHILD
+                  nil
+                end
+              end
+            end
+          end
+        end
+
+        def initialize(slice_unit:, service_unit:, command: Command.new)
+          unless slice_unit.is_a?(String) && service_unit.is_a?(String) &&
+              UNIT.match?(slice_unit) && UNIT.match?(service_unit) &&
+              slice_unit.end_with?(".slice") && service_unit.end_with?(".service") &&
+              !%w[system.slice user.slice machine.slice].include?(slice_unit)
+            raise ArgumentError, "execution scope requires fixed dedicated slice/service units"
+          end
+          @slice_unit, @service_unit, @command = slice_unit, service_unit, command
+          @slice_ancestors = []
+          parent = slice_unit
+          loop do
+            stem = parent.delete_suffix(".slice")
+            parent = stem.include?("-") ? stem.rpartition("-").first + ".slice" : "-.slice"
+            @slice_ancestors << parent
+            break if parent == "-.slice"
+          end
+        end
+
+        def inspect_units
+          slice = show(@slice_unit)
+          service = show(@service_unit, properties: SERVICE_PROPERTIES)
+          unless slice["LoadState"] == "loaded" && service["LoadState"] == "loaded" &&
+              service["Slice"] == @slice_unit
+            raise RuntimeUnavailableError, "fixed execution units are missing or their placement changed"
+          end
+          {"slice" => slice, "service" => service}
+        end
+
+        def start_slice
+          operate("start", @slice_unit)
+        end
+
+        def inspect_activation
+          inspect_units
+          slice = typed_properties(unit: @slice_unit, interface: "Unit", signatures: ACTIVATION_UNIT_SIGNATURES)
+          service = typed_properties(unit: @service_unit, interface: "Unit", signatures: ACTIVATION_UNIT_SIGNATURES)
+          service.merge!(typed_properties(unit: @service_unit, interface: "Service", signatures: ACTIVATION_SERVICE_SIGNATURES))
+          unless slice.fetch("Id") == @slice_unit && service.fetch("Id") == @service_unit &&
+              slice.fetch("LoadState") == "loaded" && service.fetch("LoadState") == "loaded" && service.fetch("Slice") == @slice_unit
+            raise RuntimeUnavailableError, "fixed activation escaped its parent slice"
+          end
+          {"slice" => slice, "service" => service}
+        end
+
+        def inspect_profile
+          # `show` loads installed metadata before typed reads; it starts no unit.
+          inspect_units
+          slice = typed_properties(unit: @slice_unit, interface: "Unit", signatures: UNIT_GRAPH_SIGNATURES)
+          service = typed_properties(unit: @service_unit, interface: "Unit", signatures: UNIT_GRAPH_SIGNATURES).merge(
+            typed_properties(unit: @service_unit, interface: "Service", signatures: SERVICE_EXEC_SIGNATURES))
+          ancestors = @slice_ancestors.to_h do |unit|
+            show(unit)
+            [unit, typed_properties(unit: unit, interface: "Unit", signatures: UNIT_GRAPH_SIGNATURES)]
+          end
+          {"slice" => slice, "service" => service, "ancestors" => ancestors, "unit_paths" => unit_paths, "prerequisites" => inspect_prerequisites(service)}
+        end
+
+        def unit_paths
+          bytes = @command.call([BUSCTL, "--system", "--no-pager", "--json=short", "--auto-start=no",
+            "--allow-interactive-authorization=no", "get-property", "org.freedesktop.systemd1",
+            "/org/freedesktop/systemd1", "org.freedesktop.systemd1.Manager", "UnitPath"], timeout: 5)
+          unless bytes.is_a?(String) && bytes.bytesize.between?(1, Command::LIMIT) && bytes.lines.size == 1
+            raise RuntimeUnavailableError, "system manager lookup paths are unavailable"
+          end
+          value = JSON.parse(bytes)
+          unless value.is_a?(Hash) && value.keys.sort == %w[data type] && value["type"] == "as" &&
+              value["data"].is_a?(Array) && value["data"].size.between?(1, 64) &&
+              value["data"].all? { |path| path.is_a?(String) && path.start_with?("/") && !path.include?("\0") && File.expand_path(path) == path }
+            raise RuntimeUnavailableError, "system manager lookup paths differ"
+          end
+          value.fetch("data")
+        rescue JSON::ParserError, KeyError
+          raise RuntimeUnavailableError, "system manager lookup paths are malformed"
+        end
+
+        # Typed reads only, against the existing system manager. Property sets
+        # and unit identities are owner-selected, never request-controlled.
+        def typed_properties(unit:, interface:, signatures:)
+          unless [@slice_unit, @service_unit, *@slice_ancestors, *@prerequisite_units.to_a].include?(unit) &&
+              %w[Unit Service Mount].include?(interface) && (interface == "Unit" || interface == "Service" && unit == @service_unit || interface == "Mount" && @prerequisite_units.to_a.include?(unit) && unit.end_with?(".mount")) && signatures.is_a?(Hash) &&
+              signatures.all? { |key, value|
+                allowed = case interface
+                when "Unit" then UNIT_GRAPH_SIGNATURES.merge(ACTIVATION_UNIT_SIGNATURES)
+                when "Service" then SERVICE_EXEC_SIGNATURES.merge(ACTIVATION_SERVICE_SIGNATURES)
+                when "Mount" then MOUNT_SIGNATURES
+                end
+                allowed[key] == value
+              } && !signatures.empty?
+            raise ArgumentError, "typed inspection requires fixed unit properties"
+          end
+          object = "/org/freedesktop/systemd1/unit/" + unit.bytes.map { |byte|
+            ((byte >= 65 && byte <= 90) || (byte >= 97 && byte <= 122) || (byte >= 48 && byte <= 57)) ? byte.chr : "_%02x" % byte
+          }.join
+          bytes = @command.call([BUSCTL, "--system", "--no-pager", "--json=short", "--auto-start=no",
+            "--allow-interactive-authorization=no", "get-property", "org.freedesktop.systemd1", object,
+            "org.freedesktop.systemd1.#{interface}", *signatures.keys], timeout: 5)
+          unless bytes.is_a?(String) && bytes.bytesize.between?(1, Command::LIMIT)
+            raise RuntimeUnavailableError, "typed manager properties are unavailable"
+          end
+          lines = bytes.lines
+          unless lines.size == signatures.size
+            raise RuntimeUnavailableError, "typed manager property set is incomplete"
+          end
+          signatures.to_a.zip(lines).to_h do |(key, signature), line|
+            value = JSON.parse(line)
+            unless value.is_a?(Hash) && value.keys.sort == %w[data type] && value["type"] == signature && typed_value?(signature, value["data"])
+              raise RuntimeUnavailableError, "typed manager property signature differs"
+            end
+            [key, value.fetch("data")]
+          end
+        rescue JSON::ParserError, KeyError
+          raise RuntimeUnavailableError, "typed manager properties are malformed"
+        end
+
+        def start_service
+          operate("start", @service_unit, timeout: 45)
+        end
+
+        def stop_slice
+          operate("stop", @slice_unit)
+        end
+
+        def stop_service
+          operate("stop", @service_unit)
+        end
+
+        private
+
+        def inspect_prerequisites(service)
+          @prerequisite_units = service.values_at("Requires", "Wants", "After").flatten.uniq - [@slice_unit]
+          unless @prerequisite_units.all? { |unit| unit == "systemd-journald.socket" ||
+              unit.is_a?(String) && unit.bytesize.between?(7, 255) && unit.end_with?(".mount") && !unit.match?(/[\s\/\0]/) }
+            raise RuntimeUnavailableError, "execution service has an unverified implicit prerequisite"
+          end
+          @prerequisite_units.to_h do |unit|
+            value = typed_properties(unit: unit, interface: "Unit", signatures: UNIT_STATE_SIGNATURES)
+            value.merge!(typed_properties(unit: unit, interface: "Mount", signatures: MOUNT_SIGNATURES)) if unit.end_with?(".mount")
+            [unit, value]
+          end
+        end
+
+        def typed_value?(signature, value)
+          string = ->(item) { item.is_a?(String) && !item.include?("\0") }
+          unsigned = ->(item, bits) { item.is_a?(Integer) && item >= 0 && item < (1 << bits) }
+          signed = ->(item) { item.is_a?(Integer) && item >= -(1 << 31) && item < (1 << 31) }
+          strings = ->(items) { items.is_a?(Array) && items.all? { |item| string.call(item) } }
+          case signature
+          when "s" then string.call(value)
+          when "(uo)" then value.is_a?(Array) && value.size == 2 && unsigned.call(value.first, 32) && string.call(value.last) && value.last.start_with?("/")
+          when "a(ss)"
+            value.is_a?(Array) && value.all? { |item| item.is_a?(Array) && item.size == 2 && item.all? { |part| string.call(part) } }
+          when "a(ssba(ss))", "a(sba(ss))"
+            strings_count = signature == "a(ssba(ss))" ? 2 : 1
+            value.is_a?(Array) && value.all? { |item| item.is_a?(Array) && item.size == strings_count + 2 &&
+              item.first(strings_count).all? { |part| string.call(part) } && [true, false].include?(item[strings_count]) &&
+              typed_value?("a(ss)", item.last) }
+          when "b" then value == true || value == false
+          when "t" then unsigned.call(value, 64)
+          when "u" then unsigned.call(value, 32)
+          when "as" then strings.call(value)
+          when "(aiai)"
+            value.is_a?(Array) && value.size == 2 && value.all? { |items| items.is_a?(Array) && items.all? { |item| signed.call(item) } }
+          when "(bas)"
+            value.is_a?(Array) && value.size == 2 && [true, false].include?(value.first) && strings.call(value.last)
+          when "a(sb)"
+            value.is_a?(Array) && value.all? { |item| item.is_a?(Array) && item.size == 2 && string.call(item.first) && [true, false].include?(item.last) }
+          when "a(ssbt)"
+            value.is_a?(Array) && value.all? { |item| item.is_a?(Array) && item.size == 4 &&
+              string.call(item[0]) && string.call(item[1]) && [true, false].include?(item[2]) && unsigned.call(item[3], 64) }
+          when "a(sasasttttuii)"
+            value.is_a?(Array) && value.all? { |item| item.is_a?(Array) && item.size == 10 &&
+              string.call(item[0]) && strings.call(item[1]) && strings.call(item[2]) &&
+              item[3..6].all? { |number| unsigned.call(number, 64) } && unsigned.call(item[7], 32) &&
+              signed.call(item[8]) && signed.call(item[9]) }
+          else false
+          end
+        end
+
+        def operate(verb, unit, timeout: 30)
+          @command.call([SYSTEMCTL, "--system", "--no-pager", "--no-ask-password", verb, "--", unit], timeout: timeout)
+          true
+        end
+
+        def show(unit, properties: PROPERTIES)
+          bytes = @command.call([SYSTEMCTL, "--system", "--no-pager", "--no-ask-password", "show",
+            "--all", "--property=#{properties.join(',')}", "--", unit], timeout: 5)
+          unless bytes.is_a?(String) && bytes.bytesize.between?(1, Command::LIMIT)
+            raise RuntimeUnavailableError, "fixed unit properties are unavailable"
+          end
+          expected = properties
+          properties = {}
+          bytes.each_line do |line|
+            key, value = line.chomp.split("=", 2)
+            unless expected.include?(key) && value && !properties.key?(key) && !value.include?("\0")
+              raise RuntimeUnavailableError, "fixed unit property response is malformed"
+            end
+            properties[key] = value
+          end
+          unless properties.keys.sort == expected.sort && properties["Id"] == unit
+            raise RuntimeUnavailableError, "fixed system manager unit identity differs"
+          end
+          properties
+        end
+      end
+    end
+  end
+end

data/lib/ace/runtime/testing/adapter_contract.rb

@@ -43,6 +43,15 @@ module Ace
 
         # --- identity and context ---
 
+        def test_unknown_process_identity_never_grants_a_binding_or_mutates_runtime
+          pane = prepare_target!
+          before = fixture.calls.dup
+          [nil, -1, "123"].each do |pid|
+            assert_nil adapter.process_binding(pane: pane, caller_pid: pid)
+          end
+          assert_equal before, fixture.calls
+        end
+
         def test_context_reports_scripted_environment
           fixture.set_context(in_runtime: true, session: "main", window: "work", pane: "%1")
 

data/lib/ace/runtime/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Runtime
-    VERSION = "0.1.1"
+    VERSION = "0.2.0"
   end
 end

data/lib/ace/runtime.rb

@@ -11,6 +11,8 @@ require_relative "runtime/atoms/name_sanitizer"
 require_relative "runtime/atoms/send_contract"
 require_relative "runtime/registry"
 require_relative "runtime/molecules/runtime_selector"
+require_relative "runtime/molecules/process_identity"
+require_relative "runtime/molecules/network_installation_evidence"
 
 module Ace
   module Runtime

data/native/README.md

@@ -0,0 +1,69 @@
+# Protected Linux worker bootstrap
+
+The `ace-runtime` gem ships `native/worker_gate.c` and `native/build-worker-gate`.
+This is a Linux executable, not a Ruby interpreter wrapper. Build on the target
+architecture from the installed gem with the system compiler and json-c parser.
+Supported initial architectures are Linux x86_64 and aarch64 with little-endian
+ELF64. A bootstrap built on another architecture fails deployment preflight.
+
+On Debian bookworm install the distribution's `build-essential`, `pkg-config`
+and `libjson-c-dev` build packages. The executable requires the matching system
+`libjson-c5`, libc and ELF loader at runtime. Use the same distribution/architecture
+for build and deployment; retain package versions, source SHA, compiler version,
+ELF machine, `readelf -d` dependencies and output SHA256 in installer evidence.
+These libraries and their loader search directories must remain root-owned and
+non-worker-writable. The pinned Herdr service starts with a clean root-controlled
+environment, so no worker loader/preload environment reaches bootstrap startup.
+
+From the installed gem directory, in a private unprivileged build directory:
+
+```sh
+native/build-worker-gate /absolute/private/build/ace-worker-gate
+sha256sum /absolute/private/build/ace-worker-gate
+readelf -h -d /absolute/private/build/ace-worker-gate
+```
+
+The administrator installs this exact artifact, without setuid/setgid bits:
+
+```sh
+install -o root -g root -m 0755 /absolute/private/build/ace-worker-gate /usr/libexec/ace-worker-gate
+```
+
+All installation ancestors are root-owned and non-worker-writable. The fixed
+root-owned `/etc/ace/assignment-authorities.json` records `bootstrap` and its exact
+`bootstrap_sha256`. ACE verifies digest, ELF architecture, executable permissions,
+ownership and ancestry before reservation. The native layout uses only this
+absolute executable, installed mapping ID and correlation ticket; payload argv,
+cwd and environment come from the root-controlled mapping after authority release.
+The map grants no UID switching and the binary is never privileged.
+
+The root-installed authority, launcher and native server units require:
+
+```ini
+User=<their distinct mapped account>
+NoNewPrivileges=yes
+CapabilityBoundingSet=
+AmbientCapabilities=
+```
+
+Worker children inherit the server's empty bounds and no-new-privileges policy.
+ACE checks all real/effective/saved/filesystem IDs, supplementary groups, every
+capability set and `NoNewPrivs` from kernel status for all mapped participants,
+including the pinned server. CAP_DAC_OVERRIDE/CAP_SETUID are refused, as is an
+exec context that could gain capabilities or setuid privilege. Yama=2 remains
+mandatory; an empty capability set alone does not stop same-UID injection.
+
+The bootstrap sets non-dumpable before connecting, requires enforced Yama
+`ptrace_scope=2`, requires empty Inh/Prm/Eff/Bnd/Amb capability sets and NoNewPrivs=1, verifies
+worker IDs/groups and exact pinned server birth/parent, authenticates authority
+SO_PEERCRED and protected socket ancestry, and waits at most 30 seconds on one
+stream. It never reconnects or executes after pre-release EOF, malformed input
+or timeout. A committed release whose response is lost remains potentially
+executed; public inspection must retain ownership rather than resend release.
+
+An ordinary Docker kernel with Yama=0 can verify compilation and fail-closed
+policy rejection. It cannot demonstrate protected launch acceptance. A real
+isolated Linux deployment enforcing the complete policy is required for that
+positive proof; installing this gem does not change host sysctls or install OS
+service/account policy. Downstream gad.8 provisions those requirements and
+consumes this shipped build mechanism.

data/native/build-worker-gate

@@ -0,0 +1,18 @@
+#!/bin/sh
+# Build the shipped immutable Linux bootstrap. Installation is a separate root operation.
+set -eu
+umask 077
+[ "$#" -eq 1 ] || { echo 'usage: build-worker-gate /absolute/private/output' >&2; exit 2; }
+[ "$(uname -s)" = Linux ] || { echo 'worker gate requires Linux' >&2; exit 2; }
+case "$1" in /*) ;; *) echo 'output must be absolute' >&2; exit 2;; esac
+source_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+build_dir=$(mktemp -d)
+trap 'rm -rf -- "$build_dir"' EXIT HUP INT TERM
+cflags=$(env -i PATH=/usr/bin:/bin /usr/bin/pkg-config --cflags json-c)
+libs=$(env -i PATH=/usr/bin:/bin /usr/bin/pkg-config --libs json-c)
+# pkg-config values come only from the installed system development package.
+# shellcheck disable=SC2086
+env -i PATH=/usr/bin:/bin /usr/bin/cc -std=c11 -O2 -D_FORTIFY_SOURCE=3 \
+  -fstack-protector-strong -fPIE -pie -Wl,-z,relro,-z,now \
+  -Wall -Wextra -Werror $cflags "$source_dir/worker_gate.c" $libs -o "$build_dir/ace-worker-gate"
+install -m 0755 "$build_dir/ace-worker-gate" "$1"

data/native/worker_gate.c

@@ -0,0 +1,199 @@
+#define _GNU_SOURCE
+#include <errno.h>
+#include <fcntl.h>
+#include <json-c/json.h>
+#include <poll.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/prctl.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/un.h>
+#include <time.h>
+#include <unistd.h>
+#include <grp.h>
+
+#define MAP_PATH "/etc/ace/assignment-authorities.json"
+#define LIMIT 65536
+static _Noreturn void deny(const char *why) { fprintf(stderr, "ace-worker-gate: %s\n", why); exit(125); }
+static double now(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC,&ts)) deny("clock unavailable"); return ts.tv_sec + ts.tv_nsec / 1e9; }
+static int token(const char *s) {
+  if (!s || !*s || strlen(s)>128) return 0;
+  for (const unsigned char *p=(const unsigned char *)s; *p; p++)
+    if (!((*p>='a'&&*p<='z')||(*p>='A'&&*p<='Z')||(*p>='0'&&*p<='9')||*p=='_'||*p=='-'||*p=='.')) return 0;
+  return 1;
+}
+static json_object *field(json_object *o,const char *k,enum json_type t) {
+  json_object *v=NULL;
+  if (!o || !json_object_object_get_ex(o,k,&v) || !json_object_is_type(v,t)) deny("invalid protected schema");
+  return v;
+}
+static const char *str(json_object *o,const char *k) { return json_object_get_string(field(o,k,json_type_string)); }
+static int number(json_object *o,const char *k) {
+  int64_t n=json_object_get_int64(field(o,k,json_type_int));
+  if (n<=0 || n>2147483647) deny("invalid principal identity");
+  return (int)n;
+}
+static void trusted_path(const char *path,int dir,uid_t owner) {
+  char copy[4096]; size_t n=strlen(path); struct stat st;
+  if (!n || n>=sizeof(copy) || path[0]!='/' || strstr(path,"//") || strstr(path,"/../") || strstr(path,"/./") ||
+      !strcmp(path+n-1,"/") || !strcmp(path+n-(n>=3?3:n),"/..")) deny("invalid protected path");
+  memcpy(copy,path,n+1);
+  for (size_t i=1;i<=n;i++) if (copy[i]=='/' || i==n) {
+    char c=copy[i]; copy[i]=0;
+    if (lstat(copy,&st) || (i==n ? st.st_uid!=owner : (st.st_uid!=0 && st.st_uid!=owner)) || (st.st_mode&022) || S_ISLNK(st.st_mode) ||
+        (i<n&&!S_ISDIR(st.st_mode))) deny("protected path is writable or replaced");
+    copy[i]=c;
+  }
+  if (dir && !S_ISDIR(st.st_mode)) deny("protected directory unavailable");
+  if (!dir && !S_ISREG(st.st_mode)) deny("protected file unavailable");
+}
+static void root_path(const char *path,int dir) { trusted_path(path,dir,0); }
+static char *read_file(const char *path,size_t max) {
+  int fd=open(path,O_RDONLY|O_CLOEXEC|O_NOFOLLOW); if(fd<0) deny("policy file unavailable");
+  char *s=calloc(max+1,1); if(!s) deny("allocation failed"); size_t n=0;
+  while(n<max) { ssize_t r=read(fd,s+n,max-n); if(r<0&&errno==EINTR) continue; if(r<0) deny("policy read failed"); if(!r) break; n+=(size_t)r; }
+  char extra; if(n==max&&read(fd,&extra,1)!=0) deny("policy file oversized"); close(fd); return s;
+}
+static void policy(void) {
+  char *s=read_file("/proc/sys/kernel/yama/ptrace_scope",16);
+  if(strcmp(s,"2\n")&&strcmp(s,"2")) deny("Linux Yama ptrace_scope=2 is required");
+  free(s);
+}
+static void credentials(pid_t pid,int uid,int gid,json_object *groups) {
+  char path[64]; snprintf(path,sizeof(path),"/proc/%d/status",pid); char *s=read_file(path,16384);
+  int got_uid=0,got_gid=0,caps=0,got_groups=0,no_new_privs=0; char *save=NULL;
+  for(char *line=strtok_r(s,"\n",&save);line;line=strtok_r(NULL,"\n",&save)) {
+    unsigned a,b,c,d; unsigned long long cap;
+    if(sscanf(line,"Uid: %u %u %u %u",&a,&b,&c,&d)==4) { if(a!=(unsigned)uid||b!=a||c!=a||d!=a) deny("UID changed"); got_uid=1; }
+    if(sscanf(line,"Gid: %u %u %u %u",&a,&b,&c,&d)==4) { if(a!=(unsigned)gid||b!=a||c!=a||d!=a) deny("GID changed"); got_gid=1; }
+    if(sscanf(line,"NoNewPrivs: %u",&a)==1) { if(a!=1)deny("NoNewPrivs=1 is required"); no_new_privs=1; }
+    const char *names[]={"CapInh:","CapPrm:","CapEff:","CapBnd:","CapAmb:"};
+    for(int i=0;i<5;i++) if(!strncmp(line,names[i],7)) {
+      if(sscanf(line+7,"%llx",&cap)!=1 || cap!=0) deny("all capability sets must be empty");
+      caps|=1<<i;
+    }
+    if(!strncmp(line,"Groups:",7)) {
+      size_t count=json_object_array_length(groups),index=0; char *end=NULL,*p=line+7;
+      while(1) { while(*p==' '||*p=='\t')p++; if(!*p)break; errno=0; long group=strtol(p,&end,10);
+        if(errno||end==p||index>=count||!json_object_is_type(json_object_array_get_idx(groups,index),json_type_int)||
+           group!=json_object_get_int64(json_object_array_get_idx(groups,index))) deny("supplementary groups changed");
+        p=end; index++;
+      }
+      if(index!=count) deny("supplementary groups changed");
+      got_groups=1;
+    }
+  }
+  free(s); if(!got_uid||!got_gid||!got_groups||!no_new_privs||caps!=31)deny("kernel credentials unavailable");
+}
+static void lineage(json_object *native) {
+  json_object *server=field(native,"server_identity",json_type_object); int pid=number(server,"pid");
+  if(getppid()!=pid) deny("gate is not the original server child");
+  char path[64]; snprintf(path,sizeof(path),"/proc/%d/stat",pid); char *s=read_file(path,16384);
+  char *end=strrchr(s,')'); if(!end||end[1]!=' ') deny("server birth unavailable");
+  char *save=NULL,*word=strtok_r(end+2," ", &save); int i=3; const char *ticks=NULL;
+  while(word) { if(i==22){ticks=word;break;} i++;word=strtok_r(NULL," ",&save); }
+  if(!ticks||strspn(ticks,"0123456789")!=strlen(ticks))deny("server birth unavailable");
+  char *boot=read_file("/proc/sys/kernel/random/boot_id",128); boot[strcspn(boot,"\n")]=0;
+  char birth[256]; snprintf(birth,sizeof(birth),"linux:%s:%s",boot,ticks);
+  if(strcmp(birth,str(server,"started_at")))deny("server incarnation changed");
+  free(boot);free(s);
+  credentials(pid,number(server,"uid"),number(server,"gid"),field(server,"groups",json_type_array));
+}
+static void wait_fd(int fd,short events,double deadline) {
+  struct pollfd p={.fd=fd,.events=events}; int r;
+  do {
+    double remaining=deadline-now(); if(remaining<=0)deny("authority deadline expired");
+    r=poll(&p,1,(int)(remaining*1000));
+  }while(r<0&&errno==EINTR);
+  if(r<=0 || (p.revents&(POLLERR|POLLNVAL)))deny("authority stream unavailable");
+}
+static void send_frame(int fd,json_object *o,double deadline) {
+  const char *s=json_object_to_json_string_ext(o,JSON_C_TO_STRING_PLAIN); size_t n=strlen(s);
+  if(n+1>LIMIT)deny("request oversized");
+  char *frame=malloc(n+2); if(!frame)deny("allocation failed");
+  memcpy(frame,s,n);frame[n++]='\n';size_t offset=0;
+  while(offset<n) { wait_fd(fd,POLLOUT,deadline); ssize_t r=send(fd,frame+offset,n-offset,MSG_NOSIGNAL);
+    if(r<0&&(errno==EINTR||errno==EAGAIN))continue;
+    if(r<=0)deny("authority write failed");
+    offset+=(size_t)r; }
+  free(frame);
+}
+static json_object *receive(int fd,double deadline) {
+  char *s=calloc(LIMIT+1,1); if(!s)deny("allocation failed"); size_t n=0;
+  while(n<LIMIT) { wait_fd(fd,POLLIN,deadline); ssize_t r=recv(fd,s+n,1,0);
+    if(r<0&&(errno==EINTR||errno==EAGAIN))continue;
+    if(r<=0)deny("authority EOF before permission");
+    if(s[n++]=='\n') { json_tokener *t=json_tokener_new();json_object *o=json_tokener_parse_ex(t,s,(int)n);
+      if(!o||json_tokener_get_error(t)!=json_tokener_success||json_tokener_get_parse_end(t)!=n||!json_object_is_type(o,json_type_object))deny("invalid authority frame");
+      json_tokener_free(t);free(s);return o; }
+  }
+  deny("authority frame oversized"); return NULL;
+}
+int main(int argc,char **argv) {
+  if(prctl(PR_SET_DUMPABLE,0,0,0,0))deny("non-dumpable gate unavailable");
+  if(argc!=3||!token(argv[1])||!token(argv[2]))deny("expected fixed mapping and correlation ticket");
+  policy();root_path(MAP_PATH,0);char *bytes=read_file(MAP_PATH,LIMIT);
+  json_tokener *parser=json_tokener_new();json_object *map=json_tokener_parse_ex(parser,bytes,(int)strlen(bytes));
+  if(!map||json_tokener_get_error(parser)!=json_tokener_success||json_tokener_get_parse_end(parser)!=strlen(bytes))deny("invalid deployment map");
+  json_tokener_free(parser);free(bytes);
+  if(strcmp(str(map,"schema"),"ace.assign.authorities/v1"))deny("unsupported deployment map");
+  json_object *mapping=field(field(map,"launch_mappings",json_type_object),argv[1],json_type_object);
+  json_object *service=field(field(map,"authorities",json_type_object),str(mapping,"authority_id"),json_type_object);
+  int worker=number(mapping,"worker_uid"),launcher=number(mapping,"launcher_uid"),authority=number(service,"uid");
+  if(worker==launcher||worker==authority||authority==launcher)deny("principals are not distinct");
+  credentials(getpid(),worker,number(mapping,"worker_gid"),field(mapping,"worker_groups",json_type_array));
+  lineage(field(mapping,"native",json_type_object));
+  const char *bootstrap=str(mapping,"bootstrap");root_path(bootstrap,0);
+  struct stat installed,self;
+  if(stat(bootstrap,&installed)||stat("/proc/self/exe",&self)||installed.st_dev!=self.st_dev||installed.st_ino!=self.st_ino||
+     (installed.st_mode&06000))deny("gate executable differs from installed bootstrap");
+  const char *path=str(service,"socket_path");char parent[4096];if(strlen(path)>=sizeof(parent))deny("socket path too long");
+  strcpy(parent,path);char *slash=strrchr(parent,'/');if(!slash||slash==parent)deny("invalid socket path");*slash=0;
+  /* Only root/the trusted authority may own the non-writable ancestry. */
+  trusted_path(parent,1,(uid_t)authority);
+  struct stat directory,endpoint;if(lstat(parent,&directory)||!S_ISDIR(directory.st_mode)||directory.st_uid!=(uid_t)authority||
+    (directory.st_mode&022)||lstat(path,&endpoint)||!S_ISSOCK(endpoint.st_mode)||endpoint.st_uid!=(uid_t)authority)deny("unsafe authority endpoint");
+  int fd=socket(AF_UNIX,SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,0);if(fd<0)deny("socket unavailable");
+  struct sockaddr_un address={.sun_family=AF_UNIX};if(strlen(path)>=sizeof(address.sun_path))deny("socket path too long");strcpy(address.sun_path,path);
+  double deadline=now()+30;
+  if(connect(fd,(struct sockaddr *)&address,sizeof(address))<0) {
+    if(errno!=EINPROGRESS&&errno!=EAGAIN)deny("authority connection failed");
+    wait_fd(fd,POLLOUT,deadline);
+    int error=0;socklen_t length=sizeof(error);if(getsockopt(fd,SOL_SOCKET,SO_ERROR,&error,&length)||error)deny("authority connection failed");
+  }
+  struct ucred peer;socklen_t length=sizeof(peer);
+  if(getsockopt(fd,SOL_SOCKET,SO_PEERCRED,&peer,&length)||peer.uid!=(uid_t)authority||peer.gid!=(gid_t)number(service,"gid"))deny("authority peer differs");
+  credentials(peer.pid,authority,number(service,"gid"),field(service,"groups",json_type_array));
+  struct stat after;if(lstat(path,&after)||after.st_dev!=endpoint.st_dev||after.st_ino!=endpoint.st_ino||after.st_uid!=endpoint.st_uid)deny("authority endpoint replaced");
+  json_object *request=json_object_new_object(),*params=json_object_new_object();
+  json_object_object_add(request,"version",json_object_new_int(1));json_object_object_add(request,"operation",json_object_new_string("gate_ready"));
+  json_object_object_add(request,"mutation_id",NULL);json_object_object_add(request,"project_id",json_object_new_string(str(mapping,"project_id")));
+  json_object_object_add(params,"mapping_id",json_object_new_string(argv[1]));json_object_object_add(params,"launch_ticket",json_object_new_string(argv[2]));
+  json_object_object_add(request,"params",params);send_frame(fd,request,deadline);json_object_put(request);
+  json_object *ready=receive(fd,deadline);
+  if(strcmp(str(ready,"status"),"ok")||strcmp(str(field(ready,"data",json_type_object),"phase"),"ready"))deny("gate not admitted");
+  json_object_put(ready);
+  json_object *permission=receive(fd,deadline);
+  if(strcmp(str(permission,"operation"),"release")||strcmp(str(permission,"launch_ticket"),argv[2])||
+    !token(str(permission,"attempt_id"))||!token(str(permission,"assignment_id"))||!token(str(permission,"journal_commit")))deny("release permission differs");
+  if(json_object_get_int64(field(permission,"generation",json_type_int))<1)deny("invalid release generation");
+  policy();lineage(field(mapping,"native",json_type_object));credentials(peer.pid,authority,number(service,"gid"),field(service,"groups",json_type_array));
+  json_object *arguments=field(mapping,"worker_argv",json_type_array);size_t count=json_object_array_length(arguments);
+  if(!count||count>64)deny("invalid fixed payload");
+  char **payload=calloc(count+1,sizeof(char *));if(!payload)deny("allocation failed");
+  for(size_t i=0;i<count;i++) {json_object *value=json_object_array_get_idx(arguments,i);if(!json_object_is_type(value,json_type_string))deny("invalid fixed argv");payload[i]=(char *)json_object_get_string(value);}
+  root_path(payload[0],0);struct stat program;if(stat(payload[0],&program)||(program.st_mode&06000)||!(program.st_mode&0111))deny("unsafe payload executable");
+  if(clearenv())deny("environment reset failed");
+  json_object *env=field(mapping,"worker_env",json_type_object);
+  json_object_object_foreach(env,key,value) {
+    if(!json_object_is_type(value,json_type_string)||!strncmp(key,"LD_",3)||!strncmp(key,"DYLD_",5)||!strncmp(key,"RUBY",4)||!strncmp(key,"BUNDLE",6)||!strncmp(key,"PYTHON",6))deny("unsafe fixed environment");
+    if(setenv(key,json_object_get_string(value),1))deny("environment setup failed");
+  }
+  if(setenv("ACE_ASSIGN_ATTEMPT_ID",str(permission,"attempt_id"),1)||setenv("ACE_ASSIGN_ASSIGNMENT_ID",str(permission,"assignment_id"),1)||
+    setenv("ACE_ASSIGN_LAUNCH_MAPPING",argv[1],1))deny("authority context unavailable");
+  if(chdir(str(mapping,"worker_cwd")))deny("fixed worker directory unavailable");
+  close(fd);
+  execv(payload[0],payload);deny("fixed worker execution failed");
+}