ace-runtime 0.2.0 → 0.3.0

data/lib/ace/runtime/molecules/readiness_runtime.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+require_relative "protected_artifact_set"
+require "rbconfig"
+
+module Ace
+  module Runtime
+    module Molecules
+      # The private hook installs this guard before loading its ACE dependencies.
+      # Every executable file is verified before require can evaluate it.
+      class ReadinessRuntime
+        BUILTINS = %w[enumerator.so thread.rb fiber.so rational.so complex.so ruby2_keywords.rb].freeze
+
+        def initialize(configuration:, artifacts: ProtectedArtifactSet.new)
+          @runtime, @artifacts = configuration.fetch("runtime"), artifacts
+          @references = @runtime.fetch("dependencies").to_h { |ref| [ref.fetch("path"), ref] }.freeze
+        end
+
+        def activate!(features: $LOADED_FEATURES, load_paths: $LOAD_PATH)
+          verify_loaded!(features)
+          @runtime.fetch("load_paths").each do |path|
+            ProtectedSocket.root_path!(path, directory: true)
+          end
+          load_paths.replace(@runtime.fetch("load_paths"))
+          @initialized_builtins ||= BUILTINS.select { |feature| features.include?(feature) }.freeze
+          owner = self
+          guard = Module.new do
+            define_method(:require) do |feature|
+              return false if owner.builtin_loaded?(feature)
+              path = owner.resolve!(feature)
+              owner.verify_file!(path)
+              super(path)
+            end
+            define_method(:require_relative) do |feature|
+              caller_file = caller_locations(1, 1).first.absolute_path
+              path = owner.resolve!(File.expand_path(feature, File.dirname(caller_file)))
+              owner.verify_file!(path)
+              require(path)
+            end
+            private :require, :require_relative
+          end
+          Kernel.prepend(guard)
+          true
+        end
+
+        def verify_loaded!(features)
+          features.each do |feature|
+            next if BUILTINS.include?(feature)
+            unless feature.is_a?(String) && feature.start_with?("/") && @references.key?(feature)
+              raise RuntimeUnavailableError, "readiness startup loaded undeclared code"
+            end
+            verify_file!(feature)
+          end
+          true
+        end
+
+        def builtin_loaded?(feature)
+          return false unless feature.is_a?(String) && @initialized_builtins
+          @initialized_builtins.any? do |builtin|
+            feature == builtin || feature == builtin.sub(/\.(?:rb|so)\z/, "")
+          end
+        end
+
+        def resolve!(feature)
+          unless feature.is_a?(String) && !feature.include?("\0")
+            raise RuntimeUnavailableError, "readiness require selection differs"
+          end
+          bases = feature.start_with?("/") ? [feature] : @runtime.fetch("load_paths").map { |path| File.join(path, feature) }
+          extension = "." + RbConfig::CONFIG.fetch("DLEXT")
+          candidates = bases.flat_map do |path|
+            # Ruby maps explicit .so/.o requests to its own platform extension.
+            if path.end_with?(".so", ".o")
+              [path.sub(/\.(?:so|o)\z/, extension)]
+            elsif path.end_with?(".rb", extension)
+              [path]
+            else
+              [path, path + ".rb", path + extension]
+            end
+          end
+          selected = candidates.find { |path| @references.key?(path) }
+          raise RuntimeUnavailableError, "readiness require is outside protected closure" unless selected
+          selected
+        end
+
+        def verify_file!(path)
+          @artifacts.with do |reader|
+            reader.read!(@references.fetch(path))
+            reader.verify_unchanged!
+          end
+          true
+        end
+      end
+    end
+  end
+end

data/lib/ace/runtime/molecules/server_resource_observation.rb

@@ -0,0 +1,183 @@
+# frozen_string_literal: true
+
+require "fiddle"
+require "rbconfig"
+require_relative "linux_mount_info"
+require_relative "../errors"
+
+module Ace
+  module Runtime
+    module Molecules
+      # Observes declared reachable objects in a pinned server root. This does
+      # not enter or modify a namespace and carries no admission authority.
+      class ServerResourceObservation
+        VIEW_PATHS = %w[/proc /proc/sys /sys /sys/fs/cgroup /dev /dev/pts /dev/mqueue /dev/shm /tmp /var/tmp].freeze
+        MOUNT_FIELDS = %w[mount_id parent_id major_minor root mountpoint options filesystem_type].freeze
+        class Files
+          OPENAT2 = 437
+          RESOLVE = 0x10 | 0x04 # IN_ROOT | NO_SYMLINKS; bind mounts are allowed.
+
+          def supported!
+            unless RUBY_PLATFORM.include?("linux") && %w[x86_64 aarch64 arm64].include?(RbConfig::CONFIG.fetch("host_cpu"))
+              raise RuntimeUnavailableError, "contained server-root observation is unsupported"
+            end
+          end
+
+          def namespace(pid, kind = "mnt")
+            File.open("/proc/#{pid}/ns/#{kind}", File::RDONLY) { |file| identity(file.stat) }
+          end
+
+          def observe(pid, entries, authority_socket:)
+            supported!
+            root = File.open("/proc/#{pid}/root", File::RDONLY)
+            namespace = File.open("/proc/#{pid}/ns/mnt", File::RDONLY)
+            network = File.open("/proc/#{pid}/ns/net", File::RDONLY)
+            network_identity = network_identity!(network)
+            ipc = File.open("/proc/#{pid}/ns/ipc", File::RDONLY)
+            hook_ipc = File.open("/proc/self/ns/ipc", File::RDONLY)
+            root_identity, namespace_identity = identity(root.stat), identity(namespace.stat)
+            ipc_identity, hook_ipc_identity = identity(ipc.stat), identity(hook_ipc.stat)
+            table = LinuxMountInfo.new(File.read("/proc/#{pid}/mountinfo", LinuxMountInfo::LIMIT + 1))
+            raise RuntimeUnavailableError, "server mount inventory exceeds bound" if table.records.size > 256
+            topology = []
+            result = entries.map do |entry|
+              handle = open_inside(root, entry.fetch("view_path"))
+              begin
+                stat = handle.stat
+                raise RuntimeUnavailableError, "declared server resource is not a directory" unless stat.directory?
+                rows = File.read("/proc/self/fdinfo/#{handle.fileno}", 16_385).lines.filter_map do |line|
+                  /\Amnt_id:\s+([0-9]+)\s*\z/.match(line)&.[](1)
+                end
+                raise RuntimeUnavailableError, "server resource mount is ambiguous" unless rows.size == 1
+                mount = table.by_id(Integer(rows.first, 10))
+                topology << entry.slice("host_path", "view_path").merge(mount.slice("mountpoint", "root", "major_minor", "options"))
+                entry.slice("host_path", "view_path").merge("device" => stat.dev, "inode" => stat.ino,
+                  "uid" => stat.uid, "gid" => stat.gid, "filesystem_type" => mount.fetch("filesystem_type"),
+                  "mount_id" => mount.fetch("mount_id"))
+              ensure
+                handle.close
+              end
+            end
+            views = VIEW_PATHS.map { |path| pinned_view(root, path, table: table) }
+            socket_identity = pinned_socket(root, authority_socket)
+            ptmx_identity, ptmx_link = pinned_ptmx(root, table: table)
+            repeated = LinuxMountInfo.new(File.read("/proc/#{pid}/mountinfo", LinuxMountInfo::LIMIT + 1))
+            unless namespace_identity == self.namespace(pid) && root_identity == identity(File.stat("/proc/#{pid}/root")) &&
+                network_identity == self.namespace(pid, "net") &&
+                ipc_identity == self.namespace(pid, "ipc") && hook_ipc_identity == self.namespace("self", "ipc") &&
+                table.records == repeated.records &&
+                views == VIEW_PATHS.map { |path| pinned_view(root, path, table: repeated) } &&
+                socket_identity == pinned_socket(root, authority_socket) &&
+                [ptmx_identity, ptmx_link] == pinned_ptmx(root, table: repeated)
+              raise RuntimeUnavailableError, "server root or namespace changed during observation"
+            end
+            {"mount_namespace_identity" => namespace_identity, "network_namespace_identity" => network_identity, "resource_identities" => result, "resource_topology" => topology,
+              "kernel_view_topology" => {"ipc_namespace_identity" => ipc_identity, "hook_ipc_namespace_identity" => hook_ipc_identity,
+                "mounts" => table.records.map { |row| row.slice(*MOUNT_FIELDS) }, "views" => views, "authority_socket_identity" => socket_identity,
+                "ptmx_identity" => ptmx_identity, "ptmx_link" => ptmx_link}}
+          ensure
+            root&.close
+            namespace&.close
+            network&.close
+            ipc&.close
+            hook_ipc&.close
+          end
+
+          private
+
+          # NS_GET_NSTYPE is an nsfs ioctl. Pin the original server's object,
+          # require CLONE_NEWNET, and retain it across the repeated path read.
+          def network_identity!(handle)
+            unless handle.ioctl(0xb703) == 0x40000000
+              raise RuntimeUnavailableError, "server object is not a network namespace"
+            end
+            identity(handle.stat)
+          rescue SystemCallError, IOError
+            raise RuntimeUnavailableError, "server network namespace type is unavailable"
+          end
+
+          def identity(stat) = {"device" => stat.dev, "inode" => stat.ino}
+
+          def pinned_view(root, path, table:)
+            handle = open_inside(root, path, flags: 0x200000 | File::NOFOLLOW) # O_PATH, no data access.
+            stat = handle.stat
+            raise RuntimeUnavailableError, "fixed server view is not a directory" unless stat.directory?
+            rows = File.read("/proc/self/fdinfo/#{handle.fileno}", 16_385).lines.filter_map { |line| /\Amnt_id:\s+([0-9]+)\s*\z/.match(line)&.[](1) }
+            raise RuntimeUnavailableError, "fixed view mount is ambiguous" unless rows.size == 1
+            mount = table.by_id(Integer(rows.first, 10))
+            {"path" => path, "mount_id" => mount.fetch("mount_id"), "device" => stat.dev, "inode" => stat.ino, "type" => "directory"}
+          ensure
+            handle&.close
+          end
+
+          def pinned_socket(root, path)
+            handle = open_inside(root, path, flags: 0x200000 | File::NOFOLLOW)
+            stat = handle.stat
+            raise RuntimeUnavailableError, "authority projection is not a socket" unless stat.socket?
+            [stat.dev, stat.ino, stat.uid]
+          ensure
+            handle&.close
+          end
+
+          def pinned_ptmx(root, table:)
+            dev = open_inside(root, "/dev", flags: 0x200000 | File::NOFOLLOW)
+            link = read_ptmx_link(dev)
+            raise RuntimeUnavailableError, "selected ptmx link differs" unless link == "pts/ptmx"
+            node = open_inside(root, "/dev/pts/ptmx", flags: 0x200000 | File::NOFOLLOW)
+            stat = node.stat
+            raise RuntimeUnavailableError, "selected ptmx is not a character device" unless stat.chardev? && stat.rdev_major == 5 && stat.rdev_minor == 2
+            rows = File.read("/proc/self/fdinfo/#{node.fileno}", 16_385).lines.filter_map { |line| /\Amnt_id:\s+([0-9]+)\s*\z/.match(line)&.[](1) }
+            raise RuntimeUnavailableError, "selected ptmx mount is ambiguous" unless rows.size == 1
+            mount = table.by_id(Integer(rows.first, 10))
+            [{"device" => stat.dev, "inode" => stat.ino, "mount_id" => mount.fetch("mount_id"), "type" => "character",
+              "rdev_major" => stat.rdev_major, "rdev_minor" => stat.rdev_minor}, link]
+          ensure
+            dev&.close
+            node&.close
+          end
+
+          def read_ptmx_link(dev)
+            call = Fiddle::Function.new(Fiddle::Handle::DEFAULT["readlinkat"],
+              [Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_VOIDP, Fiddle::TYPE_SIZE_T], Fiddle::TYPE_SSIZE_T)
+            buffer = Fiddle::Pointer.malloc(64)
+            count = call.call(dev.fileno, "ptmx\0", buffer, 64)
+            raise RuntimeUnavailableError, "selected ptmx link cannot be observed" unless count.between?(1, 63)
+            buffer.to_s(count)
+          end
+
+          def open_inside(root, path, flags: File::RDONLY | File::NONBLOCK | File::NOFOLLOW)
+            unless path.is_a?(String) && path.bytesize.between?(1, 4096) && path.start_with?("/") &&
+                !path.include?("\0") && File.expand_path(path) == path
+              raise RuntimeUnavailableError, "server resource path differs"
+            end
+            syscall = Fiddle::Function.new(Fiddle::Handle::DEFAULT["syscall"],
+              [Fiddle::TYPE_LONG, Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_VOIDP, Fiddle::TYPE_SIZE_T],
+              Fiddle::TYPE_LONG)
+            how = [flags, 0, RESOLVE].pack("Q<Q<Q<")
+            descriptor = syscall.call(OPENAT2, root.fileno, path + "\0", how, how.bytesize)
+            raise RuntimeUnavailableError, "contained server resource cannot be opened" if descriptor.negative?
+            IO.for_fd(descriptor, autoclose: true)
+          end
+        end
+
+        def initialize(kernel:, files: Files.new)
+          @kernel, @files = kernel, files
+        end
+
+        def observe!(server:, entries:, authority_socket:)
+          @kernel.live!(server)
+          before = @kernel.capture(server.fetch("pid"))
+          unless @kernel.same?(before, server)
+            raise RuntimeUnavailableError, "server incarnation differs"
+          end
+          result = @files.observe(server.fetch("pid"), entries, authority_socket: authority_socket)
+          @kernel.live!(server)
+          unless @kernel.same?(@kernel.capture(server.fetch("pid")), before)
+            raise RuntimeUnavailableError, "server credentials changed during resource observation"
+          end
+          result
+        end
+      end
+    end
+  end
+end

data/lib/ace/runtime/molecules/systemd_scope_manager.rb

@@ -23,25 +23,31 @@ module Ace
             PropagatesStopTo StopPropagatedFrom JoinsNamespaceOf RequiresMountsFor WantsMountsFor].to_h { |key| [key, "as"] }
         }.freeze
         SERVICE_EXEC_SIGNATURES = {
-          **%w[Type User Group Restart KillMode ProtectSystem RootDirectory RootImage NetworkNamespacePath Slice StandardOutput StandardError WorkingDirectory RuntimeDirectoryPreserve].to_h { |key| [key, "s"] },
+          **%w[Type User Group Restart KillMode ProtectSystem RootDirectory RootImage NetworkNamespacePath Slice StandardInput TTYPath StandardOutput StandardError WorkingDirectory RuntimeDirectoryPreserve DevicePolicy PAMName].to_h { |key| [key, "s"] },
           **%w[SupplementaryGroups ReadWritePaths ReadOnlyPaths Environment PassEnvironment UnsetEnvironment Sockets InaccessiblePaths ExtensionDirectories RuntimeDirectory].to_h { |key| [key, "as"] },
-          **%w[SendSIGKILL Delegate ProtectControlGroups NoNewPrivileges PrivateIPC PrivateDevices DynamicUser RootEphemeral MountAPIVFS].to_h { |key| [key, "b"] },
+          **%w[SendSIGKILL Delegate ProtectControlGroups NoNewPrivileges PrivateIPC PrivateDevices DynamicUser RootEphemeral MountAPIVFS PrivateTmp ProtectKernelTunables BindLogSockets].to_h { |key| [key, "b"] },
           **%w[CapabilityBoundingSet AmbientCapabilities RestrictNamespaces].to_h { |key| [key, "t"] },
           "RuntimeDirectoryMode" => "u", "UMask" => "u", "RootImageOptions" => "a(ss)", "TemporaryFileSystem" => "a(ss)", "MountImages" => "a(ssba(ss))",
           "ExtensionImages" => "a(sba(ss))", "EnvironmentFiles" => "a(sb)", "RestartForceExitStatus" => "(aiai)", "RestrictAddressFamilies" => "(bas)",
-          "BindPaths" => "a(ssbt)", "BindReadOnlyPaths" => "a(ssbt)",
+          "DeviceAllow" => "a(ss)", "BindPaths" => "a(ssbt)", "BindReadOnlyPaths" => "a(ssbt)",
           **%w[ExecConditionEx ExecStartPreEx ExecStartEx ExecStartPostEx ExecReloadEx ExecStopEx ExecStopPostEx].to_h { |key| [key, "a(sasasttttuii)"] }
         }.freeze
 
         UNIT_STATE_SIGNATURES = {"Id" => "s", "LoadState" => "s", "ActiveState" => "s", "SubState" => "s", "Job" => "(uo)"}.freeze
         MOUNT_SIGNATURES = {"Where" => "s"}.freeze
-        ACTIVATION_UNIT_SIGNATURES = UNIT_STATE_SIGNATURES.merge("InvocationID" => "s", "ControlGroup" => "s").freeze
+        ACTIVATION_UNIT_SIGNATURES = UNIT_STATE_SIGNATURES.merge("InvocationID" => "ay", "ControlGroup" => "s").freeze
         ACTIVATION_SERVICE_SIGNATURES = {"MainPID" => "u", "ControlPID" => "u", "Slice" => "s"}.freeze
+        INBOX_CONTEXT_SIGNATURES = {"TimeoutStopUSec" => "t"}.freeze
+
+        PIDFD_ARGV = [BUSCTL, "--system", "--no-pager", "--json=short", "--auto-start=no",
+          "--allow-interactive-authorization=no", "--timeout=5", "call", "org.freedesktop.systemd1",
+          "/org/freedesktop/systemd1", "org.freedesktop.systemd1.Manager", "GetUnitByPIDFD", "h", "3"].freeze
 
         class Command
           LIMIT = 65_536
 
-          def call(argv, timeout:)
+          def call(argv, timeout:, pidfd: nil)
+            inherited = inherited_descriptor_options(argv, pidfd)
             unless RUBY_PLATFORM.include?("linux") && File.directory?("/run/systemd/system")
               raise RuntimeUnavailableError, "execution scope requires the Linux system systemd manager"
             end
@@ -56,7 +62,7 @@ module Ace
             output_reader, output_writer = IO.pipe
             error_reader, error_writer = IO.pipe
             pid = Process.spawn({"PATH" => "/usr/bin:/bin", "LANG" => "C", "LC_ALL" => "C"}, *argv,
-              in: File::NULL, out: output_writer, err: error_writer, unsetenv_others: true, close_others: true)
+              in: File::NULL, out: output_writer, err: error_writer, unsetenv_others: true, close_others: true, **inherited)
             output_writer.close
             error_writer.close
             deadline = ProtectedSocket.deadline(timeout)
@@ -112,6 +118,15 @@ module Ace
               end
             end
           end
+          private
+
+          def inherited_descriptor_options(argv, pidfd)
+            return {} unless pidfd || argv == PIDFD_ARGV
+            unless argv == PIDFD_ARGV && pidfd.is_a?(IO) && !pidfd.closed? && pidfd.fileno >= 3
+              raise ArgumentError, "pidfd transport requires the fixed manager method and held IO"
+            end
+            {3 => pidfd}
+          end
         end
 
         def initialize(slice_unit:, service_unit:, command: Command.new)
@@ -132,6 +147,25 @@ module Ace
           end
         end
 
+        # The root identity owner supplies its already policy-checked pinned
+        # lifetime. A wire descriptor number never selects this capability.
+        def unit_for_pidfd(handle:, timeout: 5)
+          unless handle.is_a?(IO) && !handle.closed?
+            raise ArgumentError, "manager identity requires a held process lifetime"
+          end
+          bytes = @command.call(PIDFD_ARGV, timeout: bounded_timeout(timeout), pidfd: handle)
+          value = strict_typed_json(bytes)
+          data = value["data"]
+          unless value.keys.sort == %w[data type] && value["type"] == "osay" &&
+              data.is_a?(Array) && data.size == 3 && data[0] == unit_object(@service_unit) &&
+              data[1] == @service_unit && invocation_bytes?(data[2]) && data[2].any?(&:positive?)
+            raise RuntimeUnavailableError, "manager lifetime belongs to another unit or invocation"
+          end
+          {"unit" => @service_unit, "invocation_id" => data[2].pack("C*").unpack1("H*")}.freeze
+        rescue JSON::ParserError, KeyError, TypeError
+          raise RuntimeUnavailableError, "typed manager lifetime response is malformed"
+        end
+
         def inspect_units
           slice = show(@slice_unit)
           service = show(@service_unit, properties: SERVICE_PROPERTIES)
@@ -168,7 +202,34 @@ module Ace
             show(unit)
             [unit, typed_properties(unit: unit, interface: "Unit", signatures: UNIT_GRAPH_SIGNATURES)]
           end
-          {"slice" => slice, "service" => service, "ancestors" => ancestors, "unit_paths" => unit_paths, "prerequisites" => inspect_prerequisites(service)}
+          {"slice" => slice, "service" => service, "ancestors" => ancestors, "unit_paths" => unit_paths,
+            "manager_environment" => manager_environment, "prerequisites" => inspect_prerequisites(service)}
+        end
+
+        def inspect_inbox_context_profile
+          profile = inspect_profile
+          profile.fetch("service").merge!(typed_properties(unit: @service_unit, interface: "Service",
+            signatures: INBOX_CONTEXT_SIGNATURES))
+          profile
+        end
+
+        def manager_environment(timeout: 5)
+          bytes = @command.call([BUSCTL, "--system", "--no-pager", "--json=short", "--auto-start=no",
+            "--allow-interactive-authorization=no", "get-property", "org.freedesktop.systemd1",
+            "/org/freedesktop/systemd1", "org.freedesktop.systemd1.Manager", "Environment"], timeout: bounded_timeout(timeout))
+          unless bytes.is_a?(String) && bytes.bytesize.between?(1, 65_536) && bytes.lines.size == 1
+            raise RuntimeUnavailableError, "effective manager environment is unavailable"
+          end
+          value = JSON.parse(bytes, create_additions: false, allow_duplicate_key: false, allow_comments: false, max_nesting: 4)
+          unless value.is_a?(Hash) && value.keys.sort == %w[data type] && value["type"] == "as" &&
+              value["data"].is_a?(Array) && value["data"].size <= 256 &&
+              value["data"].all? { |entry| entry.is_a?(String) && entry.bytesize.between?(1, 4096) && !entry.include?("\0") && entry.match?(/\A[A-Za-z_][A-Za-z_0-9]*=.*\z/) } &&
+              value["data"].map { |entry| entry.split("=", 2).first }.uniq.size == value["data"].size
+            raise RuntimeUnavailableError, "effective manager environment differs"
+          end
+          value.fetch("data")
+        rescue JSON::ParserError, ArgumentError
+          raise RuntimeUnavailableError, "effective manager environment is malformed"
         end
 
         def unit_paths
@@ -191,25 +252,23 @@ module Ace
 
         # Typed reads only, against the existing system manager. Property sets
         # and unit identities are owner-selected, never request-controlled.
-        def typed_properties(unit:, interface:, signatures:)
+        def typed_properties(unit:, interface:, signatures:, timeout: 5)
           unless [@slice_unit, @service_unit, *@slice_ancestors, *@prerequisite_units.to_a].include?(unit) &&
               %w[Unit Service Mount].include?(interface) && (interface == "Unit" || interface == "Service" && unit == @service_unit || interface == "Mount" && @prerequisite_units.to_a.include?(unit) && unit.end_with?(".mount")) && signatures.is_a?(Hash) &&
               signatures.all? { |key, value|
                 allowed = case interface
                 when "Unit" then UNIT_GRAPH_SIGNATURES.merge(ACTIVATION_UNIT_SIGNATURES)
-                when "Service" then SERVICE_EXEC_SIGNATURES.merge(ACTIVATION_SERVICE_SIGNATURES)
+                when "Service" then SERVICE_EXEC_SIGNATURES.merge(ACTIVATION_SERVICE_SIGNATURES).merge(INBOX_CONTEXT_SIGNATURES)
                 when "Mount" then MOUNT_SIGNATURES
                 end
                 allowed[key] == value
               } && !signatures.empty?
             raise ArgumentError, "typed inspection requires fixed unit properties"
           end
-          object = "/org/freedesktop/systemd1/unit/" + unit.bytes.map { |byte|
-            ((byte >= 65 && byte <= 90) || (byte >= 97 && byte <= 122) || (byte >= 48 && byte <= 57)) ? byte.chr : "_%02x" % byte
-          }.join
+          object = unit_object(unit)
           bytes = @command.call([BUSCTL, "--system", "--no-pager", "--json=short", "--auto-start=no",
             "--allow-interactive-authorization=no", "get-property", "org.freedesktop.systemd1", object,
-            "org.freedesktop.systemd1.#{interface}", *signatures.keys], timeout: 5)
+            "org.freedesktop.systemd1.#{interface}", *signatures.keys], timeout: bounded_timeout(timeout))
           unless bytes.is_a?(String) && bytes.bytesize.between?(1, Command::LIMIT)
             raise RuntimeUnavailableError, "typed manager properties are unavailable"
           end
@@ -218,11 +277,11 @@ module Ace
             raise RuntimeUnavailableError, "typed manager property set is incomplete"
           end
           signatures.to_a.zip(lines).to_h do |(key, signature), line|
-            value = JSON.parse(line)
+            value = strict_typed_json(line)
             unless value.is_a?(Hash) && value.keys.sort == %w[data type] && value["type"] == signature && typed_value?(signature, value["data"])
               raise RuntimeUnavailableError, "typed manager property signature differs"
             end
-            [key, value.fetch("data")]
+            [key, key == "InvocationID" ? value.fetch("data").pack("C*").unpack1("H*") : value.fetch("data")]
           end
         rescue JSON::ParserError, KeyError
           raise RuntimeUnavailableError, "typed manager properties are malformed"
@@ -255,12 +314,41 @@ module Ace
           end
         end
 
+        def bounded_timeout(value)
+          unless value.is_a?(Numeric) && value.finite? && value.positive? && value <= 5
+            raise ArgumentError, "manager observation deadline exceeds its fixed budget"
+          end
+          value
+        end
+
+        def unit_object(unit)
+          "/org/freedesktop/systemd1/unit/" + unit.bytes.map { |byte|
+            ((byte >= 65 && byte <= 90) || (byte >= 97 && byte <= 122) || (byte >= 48 && byte <= 57)) ? byte.chr : "_%02x" % byte
+          }.join
+        end
+
+        def strict_typed_json(bytes)
+          unless bytes.is_a?(String) && bytes.bytesize.between?(1, Command::LIMIT) &&
+              bytes.dup.force_encoding(Encoding::UTF_8).valid_encoding?
+            raise RuntimeUnavailableError, "typed manager response is unavailable"
+          end
+          value = JSON.parse(bytes, create_additions: false, max_nesting: 32,
+            allow_duplicate_key: false, allow_comments: false)
+          raise RuntimeUnavailableError, "typed manager response is malformed" unless value.is_a?(Hash)
+          value
+        end
+
+        def invocation_bytes?(value)
+          value.is_a?(Array) && value.size == 16 && value.all? { |byte| byte.is_a?(Integer) && byte.between?(0, 255) }
+        end
+
         def typed_value?(signature, value)
           string = ->(item) { item.is_a?(String) && !item.include?("\0") }
           unsigned = ->(item, bits) { item.is_a?(Integer) && item >= 0 && item < (1 << bits) }
           signed = ->(item) { item.is_a?(Integer) && item >= -(1 << 31) && item < (1 << 31) }
           strings = ->(items) { items.is_a?(Array) && items.all? { |item| string.call(item) } }
           case signature
+          when "ay" then invocation_bytes?(value)
           when "s" then string.call(value)
           when "(uo)" then value.is_a?(Array) && value.size == 2 && unsigned.call(value.first, 32) && string.call(value.last) && value.last.start_with?("/")
           when "a(ss)"

data/lib/ace/runtime/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Runtime
-    VERSION = "0.2.0"
+    VERSION = "0.3.0"
   end
 end

data/lib/ace/runtime.rb

@@ -13,6 +13,7 @@ require_relative "runtime/registry"
 require_relative "runtime/molecules/runtime_selector"
 require_relative "runtime/molecules/process_identity"
 require_relative "runtime/molecules/network_installation_evidence"
+require_relative "runtime/molecules/execution_network_selection"
 
 module Ace
   module Runtime

data/native/README.md

@@ -2,13 +2,13 @@
 
 The `ace-runtime` gem ships `native/worker_gate.c` and `native/build-worker-gate`.
 This is a Linux executable, not a Ruby interpreter wrapper. Build on the target
-architecture from the installed gem with the system compiler and json-c parser.
+architecture from the installed gem with the system compiler, json-c parser and OpenSSL 3 libcrypto.
 Supported initial architectures are Linux x86_64 and aarch64 with little-endian
 ELF64. A bootstrap built on another architecture fails deployment preflight.
 
 On Debian bookworm install the distribution's `build-essential`, `pkg-config`
-and `libjson-c-dev` build packages. The executable requires the matching system
-`libjson-c5`, libc and ELF loader at runtime. Use the same distribution/architecture
+`libjson-c-dev` and `libssl-dev` build packages. The executable requires the matching system
+`libjson-c5`, OpenSSL 3 `libcrypto.so.3` (`libssl3`), libc and ELF loader at runtime. Use the same distribution/architecture
 for build and deployment; retain package versions, source SHA, compiler version,
 ELF machine, `readelf -d` dependencies and output SHA256 in installer evidence.
 These libraries and their loader search directories must remain root-owned and
@@ -33,8 +33,9 @@ All installation ancestors are root-owned and non-worker-writable. The fixed
 root-owned `/etc/ace/assignment-authorities.json` records `bootstrap` and its exact
 `bootstrap_sha256`. ACE verifies digest, ELF architecture, executable permissions,
 ownership and ancestry before reservation. The native layout uses only this
-absolute executable, installed mapping ID and correlation ticket; payload argv,
-cwd and environment come from the root-controlled mapping after authority release.
+absolute executable, installed mapping ID and correlation ticket; cwd and environment come from the root-controlled mapping after authority release.
+The mandatory closed `worker_entry` pins interpreter and wrapper references; arbitrary
+worker argv and shebang/PATH execution are not admitted.
 The map grants no UID switching and the binary is never privileged.
 
 The root-installed authority, launcher and native server units require:
@@ -55,15 +56,69 @@ mandatory; an empty capability set alone does not stop same-UID injection.
 
 The bootstrap sets non-dumpable before connecting, requires enforced Yama
 `ptrace_scope=2`, requires empty Inh/Prm/Eff/Bnd/Amb capability sets and NoNewPrivs=1, verifies
-worker IDs/groups and exact pinned server birth/parent, authenticates authority
+worker IDs/groups and its retained actual kernel parent birth, authenticates authority
 SO_PEERCRED and protected socket ancestry, and waits at most 30 seconds on one
 stream. It never reconnects or executes after pre-release EOF, malformed input
 or timeout. A committed release whose response is lost remains potentially
 executed; public inspection must retain ownership rather than resend release.
 
+The gate accepts only the maintained `ace.assign.authorities/v2` mapping. It
+captures its actual parent PID and kernel boot/start-tick birth before reading
+the map, checks that same birth before and after parent credentials, and repeats
+the check before authority admission and immediately before exec. The canonical
+`gate_ready` authority owner associates the actual gate peer and its parent with
+the original recorded child/server; the map supplies no `server_identity`.
+Changed parent birth, reparenting, inaccessible credentials or changed policy
+refuses. The original retained mapping supplies `worker_entry={interpreter:REF,wrapper:REF}`
+in the authenticated release, rather than selecting code from the current map.
+Interpreter references are bounded to 32MiB and wrapper references to 1MiB.
+Both root-protected regular held files are hashed and their metadata rechecked.
+The interpreter must be an executable native ELF. The verified wrapper is copied
+into a memfd sealed against writes/growth/shrinkage, reopened read-only, and the
+writable descriptor dropped. Selected held interpreter FD4 and code FD5 survive
+`fexecve(4, ["/proc/self/fd/4", "-I", "-S", "-B", "/proc/self/fd/5", "authority", "worker"], env)`.
+Inherited stdin/stdout/stderr remain untouched; no provider lifetime timeout is added.
+The retained original source owner inside the wrapper separately validates and
+executes the accepted Ruby snapshot and its package closure.
+
+Release is one compact JSON record containing the original ticket/assignment/
+attempt/generation/commit plus `prepared_input`. That closed object pins the
+original registration generation/commit, definition and original binding digest,
+prepared-work reference, original worker entry pair and exact journal bundle reference/length/SHA256. The
+authority verifies the original bundle before durable issue; subsequent prepared
+fetch authenticates the accepted release pin before returning body bytes. The
+gate validates the closed ten-field pin, including the original workspace exclusion,
+digests and unchanged bounds before exec. The exclusion has five closed fields:
+key, authority UID/GID, readonly root resource and original cwd resource. Each
+resource has the existing eight identity fields. The gate checks integer/path/
+filesystem bounds and exact mapping/view/key association; the retained Ruby owner
+verifies the canonical cwd digest and held filesystem identity before acquiring
+the lifetime reader. This metadata does not itself grant filesystem access.
+The complete encoded release is bounded to16KiB before durable issue and at the gate. It
+does not receive inline work or propagate an input FD to providers. The worker
+uses the existing authenticated original prepared fetch after release.
+
 An ordinary Docker kernel with Yama=0 can verify compilation and fail-closed
 policy rejection. It cannot demonstrate protected launch acceptance. A real
 isolated Linux deployment enforcing the complete policy is required for that
 positive proof; installing this gem does not change host sysctls or install OS
 service/account policy. Downstream gad.8 provisions those requirements and
 consumes this shipped build mechanism.
+
+## Fixed digest initialization and acceptance limits
+
+Before any OpenSSL API call the gate selects `OPENSSL_INIT_NO_LOAD_CONFIG`.
+It creates a private library context, fixes its provider search path to `/dev/null`
+(a non-directory), explicitly loads only `default`, and fetches `SHA256` with
+`provider=default`. Failure refuses execution; no config/engine/module fallback
+is provided. [Initialization semantics](https://docs.openssl.org/3.0/man3/OPENSSL_init_crypto/),
+[provider search path](https://docs.openssl.org/3.0/man3/OSSL_PROVIDER/), and
+[fixed provider property](https://docs.openssl.org/3.0/man7/OSSL_PROVIDER-default/) and
+[libcrypto built-in default provider](https://docs.openssl.org/3.0/man7/crypto/#default-provider)
+are the maintained API basis. The system libcrypto/loader remain in the accepted
+root-controlled OS artifact closure; this does not attest an arbitrary library build.
+
+This source checkpoint does not compile or execute native code. Real ELF,
+OpenSSL linkage/provider availability, memfd seals, retained FD execution and
+Python script/stdlib behavior require installed Linux acceptance. The trusted
+provisioned OS/Python premise remains; no separate Python runtime tree is introduced.

data/native/build-worker-gate

@@ -8,8 +8,10 @@ case "$1" in /*) ;; *) echo 'output must be absolute' >&2; exit 2;; esac
 source_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 build_dir=$(mktemp -d)
 trap 'rm -rf -- "$build_dir"' EXIT HUP INT TERM
-cflags=$(env -i PATH=/usr/bin:/bin /usr/bin/pkg-config --cflags json-c)
-libs=$(env -i PATH=/usr/bin:/bin /usr/bin/pkg-config --libs json-c)
+env -i PATH=/usr/bin:/bin /usr/bin/pkg-config --atleast-version=3.0.0 libcrypto
+env -i PATH=/usr/bin:/bin /usr/bin/pkg-config --atleast-version=0.15 json-c
+cflags=$(env -i PATH=/usr/bin:/bin /usr/bin/pkg-config --cflags json-c libcrypto)
+libs=$(env -i PATH=/usr/bin:/bin /usr/bin/pkg-config --libs json-c libcrypto)
 # pkg-config values come only from the installed system development package.
 # shellcheck disable=SC2086
 env -i PATH=/usr/bin:/bin /usr/bin/cc -std=c11 -O2 -D_FORTIFY_SOURCE=3 \