ace-runtime 0.1.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 69f400097fa32edf5aa93a7628416c5687a1991aa8987aee0a852473e670a0bf
-  data.tar.gz: '0412886bb099e653d49ea3edc8f75d523156c200ffe29ed8f396b3f2261e5b43'
+  metadata.gz: 1a5a447921ab8d6b478e41a38e6b56866977accc8a75250e394c89c6fa0ac658
+  data.tar.gz: efe75a6544cb3284a9bf544deaaa30975b60971a5c821799666502240442ec7f
 SHA512:
-  metadata.gz: 99ef79b7c87d7ed944ed80b3faa1defa7da23bc4b1e0e02b481e7f1f4d1e64c9a00c341d384f974a31e65588eb1037fd5a2ad25c90ed80a9e1f09f850f263620
-  data.tar.gz: ceec3d164c446ebdd7bb5f4b139ce19c0b53df2475299e1c9e1891076165b0312e94224a3a9916af00cee136a96da367b8dc462947b09724a3f84a0d178e1c41
+  metadata.gz: 46343d278d6041fcd7f41c859207ee0303e28811d156b923bc195b88cf73aef852d3f44b50df62a90425f0cec8a942984504ca9a7c52e4cd9152ffc77679d87a
+  data.tar.gz: b61c518fb64562ddb1975be5b6b71242134f013ec80de029bf259c5d92acdd2572b428f60788e4e4578e7f5f2a59abb3e50ec8664eaa462ceb65482ce3b6857e

data/CHANGELOG.md

@@ -6,6 +6,64 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-10-10
+
+- Ship the protected task-context/worker entry and readiness source used by the current consumers; these required modules were absent from published 0.2.0. Ordinary agent execution remains the ace-llm terminal CLI, with no additional Codex service.
+
+
+- Pin and type-check the original native server's network namespace throughout readiness observation; refuse namespace replacement before returning its identity.
+- Verify dedicated Inbox context-service installations with the full existing isolation and activation profile, exact literal HOST-to-same-VIEW references, fixed interpreter commands and a 35-second stop deadline. Require native executable/dependency bytes and IPC resources to be exact members of the same complete installed profile.
+
+- Expose selected staged boundary topology validation for installer source composition while retaining mandatory live authority socket verification for installed units.
+
+### Fixed
+
+- Accept and validate the original workspace exclusion in the compact prepared worker release, keeping the native gate and authority producer closed schemas consistent.
+
+- Verify protected ancestor directory identity and protection without treating unrelated sibling publication timestamps as selected-artifact mutation; regular-file metadata remains fully pinned.
+
+- Return the protected task-context callback result only after unchanged artifact verification, preserving Bundle responses and raw context text while refusing post-callback mutation.
+
+- Decode systemd InvocationID from its actual typed 16-byte D-Bus array, retaining canonical hexadecimal observations. Strictly verify the fixed manager pidfd-to-unit response and explicitly inherit only the held lifetime descriptor for that method.
+
+- Preserve Ruby already-loaded builtin require no-ops only for the allowlisted startup features verified at first guard activation; later activation cannot grow that authority.
+
+- Resolve guarded Ruby native-extension requests using the selected interpreter platform extension, including explicit `.so`/`.o` aliases, while authenticating only exact declared files.
+
+- Reject duplicate JSON keys, invalid UTF-8, comments and excessive nesting in protected socket frames while preserving exact byte boundaries between successive frames.
+
+- Authenticate the boot-selected private devpts backing and exact instance-local ptmx node before API exemption; shared host views refuse even when read-only. Verify the explicit unit projections and pinned contained ptmx link/node observations.
+
+### Added
+
+- Launch the fixed worker through held interpreter and sealed wrapper descriptors, with bounded original artifact hashes and fixed OpenSSL digest initialization. Native execution remains an installed acceptance requirement.
+
+- Resolve current network installation evidence through a fixed protected slot selection while retaining immutable static profile/producer intent and original historical references.
+
+- Expose a scoped authenticated read-only duplicate of a retained artifact for exact inode handoff; verify before and after callbacks and close on every exit.
+
+- Allow trusted installer code to select a bounded artifact count through `ProtectedArtifactSet.new(count_limit:)`; ordinary callers retain the 256-artifact default and both read interfaces enforce the same budget.
+
+- Verify immutable per-boot original host baseline selections and the fixed readiness configuration/runtime load surface. Collect complete bounded server mount/IPC views through contained pinned descriptors and verify exact original backing plus the authenticated read-only authority socket projection. Trusted domain boot-proof production/refresh and installed effectiveness remain separate obligations.
+
+## [0.2.0] - 2026-10-05
+
+### Added
+
+- Authenticate bounded root-produced network profile/report/trace artifacts with closed strict JSON schemas, exact context/check joins and held protected file descriptors. Missing or incomplete evidence refuses; effective network enforcement and immutable publication remain the domain installer’s responsibility.
+
+- Verify fixed execution-unit artifact bytes and typed effective system-manager properties, including retained parent activation hierarchy, service enablement routes and exact native/readiness commands. Installation verification remains separate from live boundary and whole-scope proof.
+
+- Add fixed system-systemd unit operations with bounded noninteractive jobs and descriptor-pinned cgroup-v2 population/membership observation. These primitives do not manufacture canonical scope proof or claim installed boundary acceptance.
+
+- Ship the immutable native worker gate and protected Linux/socket primitives with exact process birth, pidfd exit, enforced Yama 2, empty capability sets and NoNewPrivs checks.
+
+- Add read-only process ownership observation with PID birth identity, OS ancestry, unknown liveness and shared adapter contract coverage.
+
+### Fixed
+
+- Parse genuine typed nsfs mount roots while rejecting them as backing-storage projections, and query activation properties through the correct fixed slice and service interfaces.
+
 ## [0.1.1] - 2026-10-04
 
 ### Fixed

data/README.md

@@ -18,6 +18,7 @@ Eleven operations, keyword-arg surfaces mirroring today's consumer calls:
 |-----------|---------|
 | Context | `runtime.context` → `{in_runtime:, session:, window:, pane:}` |
 | Ensure window | `runtime.ensure_window(name:, root:, preset: nil)` — idempotent by normalized name; conflicting root/preset raises `WindowConflictError` |
+| Process identity | `runtime.process_binding(pane:, caller_pid:)` → verified owner/native binding or nil (unknown); read-only, no authorization |
 | Prepare pane | `runtime.prepare_pane(window:)` — splits when needed; target stays alive after a submitted command exits |
 | Focus | `runtime.focus(window:)` |
 | Send | `runtime.send(pane:, command: nil, items: [])` — ordered `{message: String}` / `{key: String}` entries |
@@ -118,3 +119,11 @@ adapter-authoring walkthrough.
 Note: adapters intentionally define `send` (the intent operation),
 which overrides `Object#send`. Use `__send__` for reflective dispatch
 on adapter objects.
+
+## Recoverable process ownership
+
+`process_binding(pane:, caller_pid:)` identifies a caller's owner below the exact native retained shell. The returned string-keyed object binds `runtime`, `session`, `pane`, `shell_identity` and `process_identity`; each OS identity carries PID, UID, start time and host. Herdr additionally binds durable terminal ID, agent kind and immutable native agent session, and corroborates the owner against foreground process information. No command line arguments are stored.
+
+An absent or non-native caller, retained shell without its owner, inaccessible OS facts, zombie or mismatched process returns nil. Native transport failures keep the standard typed error model. Consumers must compare the complete binding on each recovery observation. A process binding proves liveness only and grants no actor, service, effect or HITL authority. Unknown observation preserves resources; it does not prove all descendants stopped.
+
+Process birth uses Linux boot ID with `/proc` start ticks or Darwin libproc microsecond birth. Whole-second `ps lstart` is never identity evidence. Unsupported/unreadable exact birth facilities return unknown. Capture brackets process metadata with birth reads, and native ownership revalidates the whole ancestor chain before returning it.

data/docs/usage.md

@@ -187,3 +187,126 @@ The reference implementation is `test/support/fake_runtime_adapter.rb`
 in the ace-runtime gem; the in-gem suite
 (`test/contract/adapter_contract_test.rb`) proves the battery against
 it for both send profiles.
+
+## Root-produced network installation evidence
+
+The source-only `Ace::Runtime::Molecules::NetworkInstallationEvidence` consumer
+checks the protected content selected by the installed scope owner:
+
+```ruby
+result = Ace::Runtime::Molecules::NetworkInstallationEvidence.verify!(
+  selection: boundary_manifest.fetch("network_installation"),
+  expected: {
+    "slot_id" => slot_id,
+    "namespace_path" => installed_namespace_path,
+    "boot_id" => current_boot_id,
+    "namespace_identity" => {"device" => pinned_device, "inode" => pinned_inode},
+    "installer_artifact_sha256" => installed_producer_sha256
+  }
+)
+```
+
+`selection` is exactly `{profile,policy_export,report,installer_artifact}`; each
+reference is exactly `{path,sha256,bytes}`. All keys are strings, paths canonical
+and absolute, SHA256 lowercase, and lengths positive integers. There is no
+caller-uploaded evidence or caller-selected trust root. The namespace identity
+above must come from the owner's actual held, authenticated nsfs network object;
+the owner validates its type/current boot and keeps the namespace pinned through
+admission. This verifier reads content artifacts and never opens/substitutes the
+namespace, probes traffic or grants runtime networking privilege.
+
+Successful output contains exactly `report_id`, `boot_id`, `slot_id`,
+`namespace_path`, `namespace_identity`, `profile_sha256`, `policy_export_sha256`,
+`report_sha256` and `installer_artifact_sha256`, deeply frozen. It authenticates
+installation content, not actual enforcement from a summary boolean. Missing,
+unreadable, malformed, conflicting, oversized or context-mismatched evidence
+raises `Ace::Runtime::RuntimeUnavailableError`; the authority boundary exposes
+that refusal as `evidence_unavailable` and retains public `invalid_input`
+classification for malformed public selectors. No absent-evidence fallback.
+
+The reader pins regular-file and directory descriptors for the complete graph,
+checks exact lengths/digests and revalidates original objects/modes at completion.
+It uses root ownership and no group/other write on supported Linux POSIX local
+filesystems (`ext2`, `ext3`, `ext4`, `xfs`, `btrfs`, `tmpfs`): group mode bits
+represent the access ACL mask, so named non-root ACL users/groups cannot obtain
+write through it. Unknown filesystem models refuse. All ancestors are checked;
+no symlink, untrusted writable ancestor or mutable worker artifact qualifies.
+Content bounds are 1MiB per artifact, 16MiB aggregate and 256 distinct artifacts.
+Trusted installer code verifying a larger explicitly selected source closure can
+construct `ProtectedArtifactSet.new(count_limit: 4096)`; the value must be a
+positive integer supplied by trusted code, never copied from an artifact or
+request. Existing `file_limit:` and `total_limit:` budgets still apply. Mixed
+`read!`/`read_path!` calls share the count; repeating a retained reference spends
+no additional entry, and the first new artifact beyond the limit refuses.
+Trusted source installers can use `with_readonly_handle!(reference)` inside an
+active `ProtectedArtifactSet#with` callback to hand off the authenticated retained
+regular file. It yields a read-only duplicate without reopening the selected
+pathname, verifies the held set before and after the callback, and closes the
+duplicate on success or error. No descriptor or maintenance authority survives
+the callback. Existing reference/budget/root protection rules still apply.
+
+Network evidence verifiers retain their default budgets. Held descriptors also
+require sufficient process file-descriptor capacity in the installer environment.
+The profile's 256-entry bound counts its four outer collections only; nested
+ranges, ports and helper/configuration refs are bounded by the profile bytes and
+separate artifact graph limits. Strict JSON parsing requires the declared
+`json >= 2.20, < 3` dependency to reject duplicate keys and comments explicitly.
+
+The trusted domain installer owns complete effective policy/topology comparison,
+independent correlated flow checks, immutable digest-bearing evidence filenames
+and publication that preserves historical artifacts. The generic reference
+schema specifies no basename grammar: this consumer checks selected content and
+protection, and cannot establish publication history. Raw policy/topology/setup
+and correlated observations remain required; unsupported or incomplete domain
+checks must never produce a passing report. Domain source/installed review proves
+those obligations. For each loopback tool, the fixed domain procedure inspects
+the actual selected executable against its profile `artifact_sha256` and retains
+the observation in the exact tool-target trace. The schema provides no executable
+path/ref: generic ACE authenticates the trace/raw refs and digest format; it does
+not compare a tool executable digest with observation bytes or invent a ref.
+Domain acceptance must exercise tool-executable mismatch refusal.
+
+Root installation lifetime, private admission CAS, stage joins,
+namespace containment and maintenance ordering belong to their respective
+installed owners; this verifier does not implement them or supply native,
+packet-filter or installed acceptance by itself.
+
+### Original boot proof and fixed live readiness views
+
+`ExecutionBootBaseline#select!(expected:)` authenticates the fixed protected
+per-slot publication pointer at provisioning and returns its immutable proof
+reference. `#verify!(selection:, expected:)` reads only that original reference,
+joining whole-file bytes, slot, original boot, mapping digest, root PID1 birth
+context and exact original network installer artifact. It never discovers an old
+namespace or substitutes a current pointer. Proof JSON is closed and at most
+16KiB. Trusted host capture, per-boot refresh and cold-start admission inhibition
+remain domain gad.8/gad.b producer obligations.
+
+`ServerResourceObservation` uses the same-UID native server's pinned root and
+namespace descriptors without entering or changing a namespace. It reports the
+complete mount table (at most256 rows), fixed API/tmp view mount IDs obtained from
+contained O_PATH descriptors, server/hook IPC identities and the exact authority
+socket identity. It also holds the original server’s `/proc/<pid>/ns/net` object,
+requires the nsfs network-namespace type and rechecks its identity after collection.
+The report includes that observed `network_namespace_identity`; it never substitutes
+the hook’s namespace or a configured namespace identity. The private report shares
+a65,536-byte ceiling. Mount path
+prefixes, typed isolation flags and filesystem names alone do not prove live
+isolation. `KernelViewTopology` verifies the fixed supported profile, read-only
+API views, private IPC host difference and exact writable original backing;
+unknown writable aliases and even declared writable API descendants refuse.
+
+The fixed unit exposes only the selected read-only source-equals-view authority
+socket and has `BindLogSockets=false`. Protected endpoint type/owner/incarnation,
+contained view identity and authenticated peer remain separate required joins.
+These observations supply admission evidence, not terminality or installed
+effectiveness.
+The supported devpts profile additionally requires an authenticated per-slot
+`newinstance` backing, distinct from original host devpts. The trusted boot
+baseline pins original host and selected instance identities plus the exact host
+`pts/ptmx` link. The unit binds the selected root at `/dev/pts` and its read-only
+ptmx node at `/dev/pts/ptmx`; the contained observer verifies the unchanged link,
+character device and actual mount identity. `PrivateDevices` alone cannot prove
+this isolation. Shared host RO/RW views and another slot's backing refuse.
+gad.8 provisioning and gad.b refresh must deliver the selected source before
+activation; controlled tests do not establish installed effectiveness.

data/lib/ace/runtime/molecules/cgroup_observation.rb

@@ -0,0 +1,148 @@
+# frozen_string_literal: true
+
+require_relative "../errors"
+require_relative "linux_mount_info"
+
+module Ace
+  module Runtime
+    module Molecules
+      # A live descriptor pins the parent object, never the reusable pathname.
+      # Population is an observation only: canonical admission seal and verified
+      # resource boundaries remain the authority owner's responsibility.
+      class CgroupObservation
+        ROOT = "/sys/fs/cgroup"
+        IDENTITY_FIELDS = %w[path mount_id filesystem_type device inode].freeze
+
+        class KernelFiles
+          def open_directory(path)
+            File.open(path, File::RDONLY | File::NOFOLLOW)
+          end
+
+          def read(path, limit:)
+            File.open(path, File::RDONLY | File::NOFOLLOW) do |file|
+              bytes = file.read(limit + 1)
+              raise RuntimeUnavailableError, "kernel scope observation is oversized" if bytes.bytesize > limit
+              bytes
+            end
+          end
+
+          def mount_identity(handle)
+            info = read("/proc/self/fdinfo/#{handle.fileno}", limit: 4096)
+            matches = info.lines.filter_map { |line| /\Amnt_id:\s+([0-9]+)\s*\z/.match(line)&.[](1) }
+            raise RuntimeUnavailableError, "scope mount identity is unavailable" unless matches.size == 1
+            mount_id = Integer(matches.first, 10)
+            mount = LinuxMountInfo.new(read("/proc/self/mountinfo", limit: LinuxMountInfo::LIMIT)).by_id(mount_id)
+            mount.slice("mount_id", "filesystem_type", "root", "mountpoint")
+          end
+        end
+
+        def initialize(files: KernelFiles.new)
+          @files = files
+        end
+
+        def pin(path, expected: nil)
+          validate_path!(path)
+          handle = @files.open_directory(path)
+          identity = identity_for(handle, path)
+          unless expected.nil? || valid_identity?(expected) && identity == expected
+            raise RuntimeUnavailableError, "retained scope object was replaced"
+          end
+          verify_path!(handle, identity)
+          {handle: handle, identity: identity.freeze}
+        rescue SystemCallError, IOError
+          handle&.close
+          raise RuntimeUnavailableError, "exact scope object cannot be pinned"
+        rescue Exception
+          handle&.close
+          raise
+        end
+
+        def observe(pinned)
+          handle, identity = pinned.values_at(:handle, :identity)
+          unless handle && !handle.closed? && valid_identity?(identity) && identity_for(handle, identity.fetch("path")) == identity
+            raise RuntimeUnavailableError, "pinned scope identity changed"
+          end
+          verify_path!(handle, identity)
+          bytes = @files.read("/proc/self/fd/#{handle.fileno}/cgroup.events", limit: 4096)
+          fields = parse_events(bytes)
+          verify_path!(handle, identity)
+          {"cgroup_identity" => identity.dup, "populated" => fields.fetch("populated")}
+        rescue SystemCallError, IOError, KeyError
+          raise RuntimeUnavailableError, "retained scope cannot be observed"
+        end
+
+        # Membership checks use the caller's independently pinned birth policy.
+        # A namespace-relative cgroup value must agree with the host parent;
+        # unresolved membership refuses rather than following another mount.
+        def member!(identity, pinned:, kernel:)
+          kernel.live!(identity)
+          observe(pinned)
+          bytes = @files.read("/proc/#{identity.fetch('pid')}/cgroup", limit: 4096)
+          paths = bytes.lines.filter_map { |line| /\A0::(\/[^\n]*)\n?\z/.match(line)&.[](1) }
+          parent = pinned.fetch(:identity).fetch("path").delete_prefix(ROOT)
+          unless paths.size == 1 && (paths.first == parent || paths.first.start_with?(parent + "/"))
+            raise RuntimeUnavailableError, "process is outside the exact execution scope"
+          end
+          kernel.live!(identity)
+          observe(pinned)
+          true
+        end
+
+        def parse_events(bytes)
+          unless bytes.is_a?(String) && bytes.bytesize.between?(1, 4096)
+            raise RuntimeUnavailableError, "cgroup population is unavailable"
+          end
+          fields = {}
+          bytes.each_line do |line|
+            match = /\A([a-z_]+) ([0-9]+)\n?\z/.match(line)
+            unless match && !fields.key?(match[1])
+              raise RuntimeUnavailableError, "cgroup events are malformed"
+            end
+            fields[match[1]] = Integer(match[2], 10)
+          end
+          unless [0, 1].include?(fields["populated"])
+            raise RuntimeUnavailableError, "cgroup population is not a positive kernel observation"
+          end
+          fields
+        end
+
+        private
+
+        def valid_identity?(value)
+          value.is_a?(Hash) && value.keys.sort == IDENTITY_FIELDS.sort &&
+            value["path"].is_a?(String) && value["filesystem_type"] == "cgroup2" && %w[mount_id device inode].all? do |key|
+              value[key].is_a?(Integer) && value[key] >= 0
+            end
+        end
+
+        def validate_path!(path)
+          unless path.is_a?(String) && path.bytesize <= 4096 && !path.include?("\0") &&
+              path.start_with?(ROOT + "/") && File.expand_path(path) == path && path != ROOT
+            raise RuntimeUnavailableError, "scope must be an exact parent below the unified cgroup root"
+          end
+        end
+
+        def identity_for(handle, path)
+          stat = handle.stat
+          mount = @files.mount_identity(handle)
+          unless stat.directory? && mount["filesystem_type"] == "cgroup2" &&
+              mount["mountpoint"] == ROOT && mount["root"] == "/"
+            raise RuntimeUnavailableError, "scope requires the host unified cgroup-v2 mount"
+          end
+          {"path" => path, "mount_id" => mount.fetch("mount_id"), "filesystem_type" => "cgroup2",
+           "device" => stat.dev, "inode" => stat.ino}
+        end
+
+        def verify_path!(handle, identity)
+          current = @files.open_directory(identity.fetch("path"))
+          unless identity_for(current, identity.fetch("path")) == identity && handle.stat.ino == current.stat.ino
+            raise RuntimeUnavailableError, "scope pathname no longer names its pinned object"
+          end
+          true
+        ensure
+          current&.close
+        end
+      end
+    end
+  end
+end

data/lib/ace/runtime/molecules/codex_runtime_installation.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+module Ace
+  module Runtime
+    module Molecules
+      # Private specialization of the SAME immutable/effective installation owner.
+      class ExecutionUnitInstallation
+        CODEX_TOKEN = /\A[A-Za-z0-9][A-Za-z0-9._-]{0,127}\z/.freeze
+        CODEX_INTENT_FIELDS = %w[codex credentials cwd dependencies environment home inbox_context_id native_mapping_id project_id schema socket_gid socket_path thread_configuration unit_name].freeze
+
+        private
+
+        def initialize_codex_runtime(service, reference, mapping, mapping_id, authority, files)
+          unless service.is_a?(Hash) && service.keys.sort == %w[boundary_manifest execution_scope unit_manifest] &&
+              mapping.is_a?(Hash) && mapping_id.is_a?(String) && SystemdScopeManager::UNIT.match?(mapping_id)
+            raise RuntimeUnavailableError, "Codex service selection differs"
+          end
+          [reference, *service.values_at("unit_manifest", "boundary_manifest")].each { |ref| codex_reference!(ref, 65_536) }
+          bytes = files.read(reference.fetch("path"), limit: reference.fetch("bytes"))
+          unless bytes.bytesize == reference.fetch("bytes") && Digest::SHA256.hexdigest(bytes) == reference.fetch("sha256")
+            raise RuntimeUnavailableError, "Codex intent bytes differ"
+          end
+          intent = JSON.parse(bytes, create_additions: false, max_nesting: 32, allow_duplicate_key: false, allow_comments: false)
+          unless intent.is_a?(Hash) && intent.keys.sort == CODEX_INTENT_FIELDS.sort &&
+              intent["schema"] == "lab.codex-runtime-intent/v1" &&
+              intent.values_at("project_id", "native_mapping_id", "cwd") == [mapping.fetch("project_id"), mapping_id, mapping.fetch("worker_cwd")] &&
+              intent["unit_name"].is_a?(String) && SystemdScopeManager::UNIT.match?(intent["unit_name"]) && intent["unit_name"].end_with?(".service") &&
+              intent["credentials"] == {"uid" => mapping.fetch("worker_uid"), "gid" => mapping.fetch("worker_gid"), "groups" => mapping.fetch("worker_groups")}
+            raise RuntimeUnavailableError, "Codex intent original mapping differs"
+          end
+          credentials = intent.fetch("credentials")
+          unless credentials.values_at("uid", "gid").all? { |id| id.is_a?(Integer) && id.positive? && id <= (1 << 32) - 2 } &&
+              credentials["groups"].is_a?(Array) && credentials["groups"].size <= 64 &&
+              credentials["groups"] == credentials["groups"].sort.uniq &&
+              credentials["groups"].all? { |id| id.is_a?(Integer) && id.between?(0, (1 << 32) - 2) }
+            raise RuntimeUnavailableError, "Codex original native credentials differ"
+          end
+          original = mapping.fetch("execution_scope")
+          scope = service.fetch("execution_scope")
+          changes = %w[service_unit unit_manifest_sha256]
+          unless scope.is_a?(Hash) && scope.keys.sort == %w[backend boundary_manifest_sha256 network_namespace_path root_directory runtime_directory service_unit slice_unit slot_id unit_manifest_sha256] &&
+              scope["backend"] == "linux_systemd_cgroup_v2" && scope.keys.sort == original.keys.sort &&
+              scope.reject { |key, _| changes.include?(key) } == original.reject { |key, _| changes.include?(key) } &&
+              scope["service_unit"] == intent.fetch("unit_name") && scope["service_unit"] != original.fetch("service_unit") &&
+              scope["unit_manifest_sha256"] == service.fetch("unit_manifest").fetch("sha256") &&
+              scope["boundary_manifest_sha256"] == service.fetch("boundary_manifest").fetch("sha256")
+            raise RuntimeUnavailableError, "Codex service expands original containment"
+          end
+          codex_reference!(intent.fetch("codex"), 268_435_456)
+          dependencies = intent.fetch("dependencies")
+          unless dependencies.is_a?(Array) && dependencies.size <= 506 && ([intent.fetch("codex")] + dependencies).map { |ref| ref.fetch("path") }.uniq.size == dependencies.size + 1
+            raise RuntimeUnavailableError, "Codex selected dependency inventory differs"
+          end
+          dependencies.each { |ref| codex_reference!(ref, 268_435_456) }
+          unless ([intent.fetch("codex")] + dependencies).sum { |ref| ref.fetch("bytes") } <= 268_435_456 &&
+              path?(intent["cwd"]) && path?(intent["home"]) && path?(intent["socket_path"]) &&
+              intent["socket_path"].encoding == Encoding::UTF_8 && intent["socket_path"].valid_encoding? && intent["socket_path"].bytesize <= 107 &&
+              intent["socket_gid"].is_a?(Integer) && intent["socket_gid"].between?(1, (1 << 32) - 2) &&
+              intent["inbox_context_id"].is_a?(String) && CODEX_TOKEN.match?(intent["inbox_context_id"]) &&
+              intent["thread_configuration"].is_a?(Hash) && intent["thread_configuration"].keys.sort == %w[approval_policy model sandbox] &&
+              intent["thread_configuration"].values_at("approval_policy", "sandbox") == ["never", "danger-full-access"] &&
+              intent["thread_configuration"]["model"].is_a?(String) && CODEX_TOKEN.match?(intent["thread_configuration"]["model"])
+            raise RuntimeUnavailableError, "Codex runtime input bounds differ"
+          end
+          environment = intent.fetch("environment")
+          unless environment.is_a?(Hash) && environment.size <= 32 && environment.all? { |key, value|
+            NATIVE_ENVIRONMENT.include?(key) && value.is_a?(String) && value.encoding == Encoding::UTF_8 &&
+              value.valid_encoding? && value.bytesize <= 4096 && !value.include?("\0") } &&
+              (!environment.key?("HOME") || environment["HOME"] == intent.fetch("home"))
+            raise RuntimeUnavailableError, "Codex runtime environment differs"
+          end
+          @codex_service, @codex_intent = immutable_selection(service), immutable_selection(intent)
+          @codex_intent_reference, @codex_authority = immutable_selection(reference), immutable_selection(authority)
+          @scope, @files = immutable_selection(scope), files
+          @worker_uid, @worker_gid, @codex_groups = credentials.values_at("uid", "gid", "groups")
+          @codex_groups = immutable_selection(@codex_groups)
+        rescue KeyError, TypeError, NoMethodError, ArgumentError, JSON::ParserError
+          raise RuntimeUnavailableError, "Codex installation selection is incomplete"
+        end
+
+        def codex_reference!(ref, limit)
+          unless ref.is_a?(Hash) && ref.keys.sort == %w[bytes path sha256] && path?(ref["path"]) &&
+              ref["bytes"].is_a?(Integer) && ref["bytes"].between?(1, limit) &&
+              ref["sha256"].is_a?(String) && ref["sha256"].match?(/\A[0-9a-f]{64}\z/)
+            raise RuntimeUnavailableError, "Codex immutable reference differs"
+          end
+        end
+
+        def codex_reference_bytes!(ref)
+          bytes = @files.read(ref.fetch("path"), limit: ref.fetch("bytes"))
+          unless bytes.bytesize == ref.fetch("bytes") && Digest::SHA256.hexdigest(bytes) == ref.fetch("sha256")
+            raise RuntimeUnavailableError, "Codex selected artifact bytes differ"
+          end
+          bytes
+        end
+
+        def verify_codex_artifacts!(roles)
+          {"native_executable" => @codex_intent.fetch("codex"), "native_configuration" => @codex_intent_reference,
+            "boundary_manifest" => @codex_service.fetch("boundary_manifest")}.each do |role, ref|
+            artifact = roles.fetch(role).first
+            unless artifact.values_at("host_path", "view_path", "sha256") == ref.values_at("path", "path", "sha256") &&
+                codex_reference_bytes!(ref).bytesize == ref.fetch("bytes")
+              raise RuntimeUnavailableError, "Codex artifact differs from original selection"
+            end
+          end
+          unless roles.fetch("runtime_dependency", []).size == @codex_intent.fetch("dependencies").size
+            raise RuntimeUnavailableError, "Codex installed dependency inventory differs"
+          end
+          @codex_intent.fetch("dependencies").each do |ref|
+            selected = roles.fetch("runtime_dependency", []).select { |artifact| artifact.values_at("host_path", "view_path", "sha256") == ref.values_at("path", "path", "sha256") }
+            unless selected.one? && codex_reference_bytes!(ref).bytesize == ref.fetch("bytes")
+              raise RuntimeUnavailableError, "Codex selected dependency is not installed"
+            end
+          end
+          roles
+        end
+
+        def verify_codex_protocol!(service, artifacts)
+          executable = @codex_intent.fetch("codex").fetch("path")
+          verify_command!(service.fetch("ExecStartEx"), executable)
+          expected = @codex_intent.fetch("environment").merge("HOME" => @codex_intent.fetch("home")).map { |key, value| "#{key}=#{value}" }.sort
+          unless service.fetch("ExecStartEx").first[1] == [executable, "app-server", "--listen", "unix://" + @codex_intent.fetch("socket_path")] &&
+              service.fetch("ExecStartPostEx") == [] && service.fetch("Environment").sort == expected
+            raise RuntimeUnavailableError, "Codex unit commands differ from fixed startup protocol"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/runtime/molecules/execution_boot_baseline.rb

@@ -0,0 +1,134 @@
+# frozen_string_literal: true
+require "json"
+require_relative "protected_artifact_set"
+
+module Ace
+  module Runtime
+    module Molecules
+      # Content authentication over the existing trusted host installer proof.
+      # Actual original-host capture and boot refresh belong to gad.8/gad.b.
+      class ExecutionBootBaseline
+        LIMIT = 16_384
+        ID = /\A[A-Za-z0-9][A-Za-z0-9._-]{0,127}\z/
+        SHA = /\A[0-9a-f]{64}\z/
+        BOOT = /\A[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z/
+        EXPECTED = %w[boot_id deployment_digest installer_artifact slot_id].freeze
+        FIELDS = %w[boot_id deployment_digest host_devpts_identity host_ipc_namespace_identity host_ptmx_link original_host_context producer_artifact schema selected_devpts slot_id].freeze
+
+        def initialize(artifacts: ProtectedArtifactSet.new)
+          @artifacts = artifacts
+        end
+
+        # Fresh provisioning only. Never called for historical authentication.
+        def select!(expected:)
+          expected!(expected)
+          @artifacts.with do
+            path = "/etc/ace/execution-slots/#{expected.fetch('slot_id')}/boot-baseline-selection.json"
+            bytes, = @artifacts.read_path!(path, limit: LIMIT)
+            pointer = json!(bytes)
+            object!(pointer, %w[baseline schema slot_id])
+            refuse! unless pointer["schema"] == "ace.execution-boot-selection/v1" && pointer["slot_id"] == expected.fetch("slot_id")
+            selected = pointer.fetch("baseline")
+            baseline = authenticate!(selected, expected)
+            @artifacts.verify_unchanged!
+            immutable({"selection" => selected, "baseline" => baseline})
+          end
+        rescue KeyError, TypeError, NoMethodError, ArgumentError, IOError, SystemCallError, JSON::ParserError
+          refuse!
+        end
+
+        # Pure original-ref reader: expected boot comes from canonical lineage,
+        # not current discovery. Runtime owners separately check current boot.
+        def verify!(selection:, expected:)
+          expected!(expected)
+          @artifacts.with do
+            value = authenticate!(selection, expected)
+            @artifacts.verify_unchanged!
+            immutable(value)
+          end
+        rescue KeyError, TypeError, NoMethodError, ArgumentError, IOError, SystemCallError, JSON::ParserError
+          refuse!
+        end
+
+        private
+
+        def authenticate!(selected, expected)
+          reference!(selected, limit: LIMIT)
+          reference!(expected.fetch("installer_artifact"))
+          value = json!(@artifacts.read!(selected))
+          object!(value, FIELDS)
+          reference!(value.fetch("producer_artifact"))
+          unless value["schema"] == "ace.execution-boot-baseline/v1" &&
+              value.values_at("boot_id", "deployment_digest", "slot_id") == expected.values_at("boot_id", "deployment_digest", "slot_id") &&
+              value["producer_artifact"] == expected.fetch("installer_artifact")
+            refuse!
+          end
+          @artifacts.read!(expected.fetch("installer_artifact"))
+          identity = value.fetch("host_ipc_namespace_identity")
+          object!(identity, %w[device inode])
+          refuse! unless identity.values.all? { |number| number.is_a?(Integer) && number.positive? }
+          host = value.fetch("host_devpts_identity")
+          selected = value.fetch("selected_devpts")
+          object!(host, %w[device inode major_minor])
+          object!(selected, %w[device inode major_minor path ptmx_inode])
+          [host, selected].each do |instance|
+            refuse! unless %w[device inode].all? { |key| instance[key].is_a?(Integer) && instance[key].positive? } &&
+              instance["major_minor"].is_a?(String) && instance["major_minor"].match?(/\A(?:0|[1-9][0-9]*):(?:0|[1-9][0-9]*)\z/)
+          end
+          refuse! unless value["host_ptmx_link"] == "pts/ptmx" &&
+            selected["path"] == "/run/ace/execution-slots/#{expected.fetch('slot_id')}/devpts" &&
+            selected["device"] != host["device"] && selected["major_minor"] != host["major_minor"] &&
+            selected["ptmx_inode"].is_a?(Integer) && selected["ptmx_inode"].positive?
+          context = value.fetch("original_host_context")
+          object!(context, %w[gid pid started_at uid])
+          unless context.values_at("pid", "uid", "gid").all? { |number| number.is_a?(Integer) } &&
+              context.values_at("pid", "uid", "gid") == [1, 0, 0] && context["started_at"].is_a?(String) &&
+              context["started_at"].match?(/\Alinux:#{Regexp.escape(expected.fetch('boot_id'))}:(?:0|[1-9][0-9]*)\z/) &&
+              context["started_at"].bytesize <= 128
+            refuse!
+          end
+          value
+        end
+
+        def expected!(value)
+          object!(value, EXPECTED)
+          refuse! unless value["slot_id"].is_a?(String) && ID.match?(value["slot_id"]) &&
+            value["boot_id"].is_a?(String) && BOOT.match?(value["boot_id"]) &&
+            value["deployment_digest"].is_a?(String) && SHA.match?(value["deployment_digest"])
+          reference!(value.fetch("installer_artifact"))
+        end
+
+        def reference!(value, limit: ProtectedArtifactSet::LIMIT)
+          object!(value, %w[bytes path sha256])
+          refuse! unless value["path"].is_a?(String) && value["path"].bytesize.between?(1, 4096) &&
+            value["path"].start_with?("/") && !value["path"].include?("\0") && File.expand_path(value["path"]) == value["path"] &&
+            value["bytes"].is_a?(Integer) && value["bytes"].between?(1, limit) &&
+            value["sha256"].is_a?(String) && SHA.match?(value["sha256"])
+        end
+
+        def json!(bytes)
+          bytes = bytes.dup.force_encoding(Encoding::UTF_8)
+          refuse! unless bytes.bytesize.between?(1, LIMIT) && bytes.valid_encoding?
+          JSON.parse(bytes, create_additions: false, max_nesting: 8, allow_duplicate_key: false, allow_comments: false)
+        end
+
+        def object!(value, keys)
+          refuse! unless value.is_a?(Hash) && value.keys.sort == keys.sort
+        end
+
+        def immutable(value)
+          case value
+          when Hash then value.to_h { |key, item| [key.dup.freeze, immutable(item)] }.freeze
+          when Array then value.map { |item| immutable(item) }.freeze
+          when String then value.dup.freeze
+          else value
+          end
+        end
+
+        def refuse!
+          raise RuntimeUnavailableError, "authenticated original host boot baseline unavailable"
+        end
+      end
+    end
+  end
+end