ace-runtime 0.2.0 → 0.4.0

data/native/README.md

@@ -2,13 +2,13 @@
 
 The `ace-runtime` gem ships `native/worker_gate.c` and `native/build-worker-gate`.
 This is a Linux executable, not a Ruby interpreter wrapper. Build on the target
-architecture from the installed gem with the system compiler and json-c parser.
+architecture from the installed gem with the system compiler, json-c parser and OpenSSL 3 libcrypto.
 Supported initial architectures are Linux x86_64 and aarch64 with little-endian
 ELF64. A bootstrap built on another architecture fails deployment preflight.
 
 On Debian bookworm install the distribution's `build-essential`, `pkg-config`
-and `libjson-c-dev` build packages. The executable requires the matching system
-`libjson-c5`, libc and ELF loader at runtime. Use the same distribution/architecture
+`libjson-c-dev` and `libssl-dev` build packages. The executable requires the matching system
+`libjson-c5`, OpenSSL 3 `libcrypto.so.3` (`libssl3`), libc and ELF loader at runtime. Use the same distribution/architecture
 for build and deployment; retain package versions, source SHA, compiler version,
 ELF machine, `readelf -d` dependencies and output SHA256 in installer evidence.
 These libraries and their loader search directories must remain root-owned and
@@ -33,8 +33,9 @@ All installation ancestors are root-owned and non-worker-writable. The fixed
 root-owned `/etc/ace/assignment-authorities.json` records `bootstrap` and its exact
 `bootstrap_sha256`. ACE verifies digest, ELF architecture, executable permissions,
 ownership and ancestry before reservation. The native layout uses only this
-absolute executable, installed mapping ID and correlation ticket; payload argv,
-cwd and environment come from the root-controlled mapping after authority release.
+absolute executable, installed mapping ID and correlation ticket; cwd and environment come from the root-controlled mapping after authority release.
+The mandatory closed `worker_entry` pins interpreter and wrapper references; arbitrary
+worker argv and shebang/PATH execution are not admitted.
 The map grants no UID switching and the binary is never privileged.
 
 The root-installed authority, launcher and native server units require:
@@ -55,15 +56,69 @@ mandatory; an empty capability set alone does not stop same-UID injection.
 
 The bootstrap sets non-dumpable before connecting, requires enforced Yama
 `ptrace_scope=2`, requires empty Inh/Prm/Eff/Bnd/Amb capability sets and NoNewPrivs=1, verifies
-worker IDs/groups and exact pinned server birth/parent, authenticates authority
+worker IDs/groups and its retained actual kernel parent birth, authenticates authority
 SO_PEERCRED and protected socket ancestry, and waits at most 30 seconds on one
 stream. It never reconnects or executes after pre-release EOF, malformed input
 or timeout. A committed release whose response is lost remains potentially
 executed; public inspection must retain ownership rather than resend release.
 
+The gate accepts only the maintained `ace.assign.authorities/v2` mapping. It
+captures its actual parent PID and kernel boot/start-tick birth before reading
+the map, checks that same birth before and after parent credentials, and repeats
+the check before authority admission and immediately before exec. The canonical
+`gate_ready` authority owner associates the actual gate peer and its parent with
+the original recorded child/server; the map supplies no `server_identity`.
+Changed parent birth, reparenting, inaccessible credentials or changed policy
+refuses. The original retained mapping supplies `worker_entry={interpreter:REF,wrapper:REF}`
+in the authenticated release, rather than selecting code from the current map.
+Interpreter references are bounded to 32MiB and wrapper references to 1MiB.
+Both root-protected regular held files are hashed and their metadata rechecked.
+The interpreter must be an executable native ELF. The verified wrapper is copied
+into a memfd sealed against writes/growth/shrinkage, reopened read-only, and the
+writable descriptor dropped. Selected held interpreter FD4 and code FD5 survive
+`fexecve(4, ["/proc/self/fd/4", "-I", "-S", "-B", "/proc/self/fd/5", "authority", "worker"], env)`.
+Inherited stdin/stdout/stderr remain untouched; no provider lifetime timeout is added.
+The retained original source owner inside the wrapper separately validates and
+executes the accepted Ruby snapshot and its package closure.
+
+Release is one compact JSON record containing the original ticket/assignment/
+attempt/generation/commit plus `prepared_input`. That closed object pins the
+original registration generation/commit, definition and original binding digest,
+prepared-work reference, original worker entry pair and exact journal bundle reference/length/SHA256. The
+authority verifies the original bundle before durable issue; subsequent prepared
+fetch authenticates the accepted release pin before returning body bytes. The
+gate validates the closed ten-field pin, including the original workspace exclusion,
+digests and unchanged bounds before exec. The exclusion has five closed fields:
+key, authority UID/GID, readonly root resource and original cwd resource. Each
+resource has the existing eight identity fields. The gate checks integer/path/
+filesystem bounds and exact mapping/view/key association; the retained Ruby owner
+verifies the canonical cwd digest and held filesystem identity before acquiring
+the lifetime reader. This metadata does not itself grant filesystem access.
+The complete encoded release is bounded to16KiB before durable issue and at the gate. It
+does not receive inline work or propagate an input FD to providers. The worker
+uses the existing authenticated original prepared fetch after release.
+
 An ordinary Docker kernel with Yama=0 can verify compilation and fail-closed
 policy rejection. It cannot demonstrate protected launch acceptance. A real
 isolated Linux deployment enforcing the complete policy is required for that
 positive proof; installing this gem does not change host sysctls or install OS
 service/account policy. Downstream gad.8 provisions those requirements and
 consumes this shipped build mechanism.
+
+## Fixed digest initialization and acceptance limits
+
+Before any OpenSSL API call the gate selects `OPENSSL_INIT_NO_LOAD_CONFIG`.
+It creates a private library context, fixes its provider search path to `/dev/null`
+(a non-directory), explicitly loads only `default`, and fetches `SHA256` with
+`provider=default`. Failure refuses execution; no config/engine/module fallback
+is provided. [Initialization semantics](https://docs.openssl.org/3.0/man3/OPENSSL_init_crypto/),
+[provider search path](https://docs.openssl.org/3.0/man3/OSSL_PROVIDER/), and
+[fixed provider property](https://docs.openssl.org/3.0/man7/OSSL_PROVIDER-default/) and
+[libcrypto built-in default provider](https://docs.openssl.org/3.0/man7/crypto/#default-provider)
+are the maintained API basis. The system libcrypto/loader remain in the accepted
+root-controlled OS artifact closure; this does not attest an arbitrary library build.
+
+This source checkpoint does not compile or execute native code. Real ELF,
+OpenSSL linkage/provider availability, memfd seals, retained FD execution and
+Python script/stdlib behavior require installed Linux acceptance. The trusted
+provisioned OS/Python premise remains; no separate Python runtime tree is introduced.

data/native/build-worker-gate

@@ -8,8 +8,10 @@ case "$1" in /*) ;; *) echo 'output must be absolute' >&2; exit 2;; esac
 source_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 build_dir=$(mktemp -d)
 trap 'rm -rf -- "$build_dir"' EXIT HUP INT TERM
-cflags=$(env -i PATH=/usr/bin:/bin /usr/bin/pkg-config --cflags json-c)
-libs=$(env -i PATH=/usr/bin:/bin /usr/bin/pkg-config --libs json-c)
+env -i PATH=/usr/bin:/bin /usr/bin/pkg-config --atleast-version=3.0.0 libcrypto
+env -i PATH=/usr/bin:/bin /usr/bin/pkg-config --atleast-version=0.15 json-c
+cflags=$(env -i PATH=/usr/bin:/bin /usr/bin/pkg-config --cflags json-c libcrypto)
+libs=$(env -i PATH=/usr/bin:/bin /usr/bin/pkg-config --libs json-c libcrypto)
 # pkg-config values come only from the installed system development package.
 # shellcheck disable=SC2086
 env -i PATH=/usr/bin:/bin /usr/bin/cc -std=c11 -O2 -D_FORTIFY_SOURCE=3 \

data/native/worker_gate.c

@@ -3,7 +3,12 @@
 #include <fcntl.h>
 #include <json-c/json.h>
 #include <poll.h>
+#include <openssl/crypto.h>
+#include <openssl/evp.h>
+#include <openssl/provider.h>
+#include <sys/mman.h>
 #include <stdio.h>
+#include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/prctl.h>
@@ -20,6 +25,7 @@ static _Noreturn void deny(const char *why) { fprintf(stderr, "ace-worker-gate:
 static double now(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC,&ts)) deny("clock unavailable"); return ts.tv_sec + ts.tv_nsec / 1e9; }
 static int token(const char *s) {
   if (!s || !*s || strlen(s)>128) return 0;
+  if(!((s[0]>='a'&&s[0]<='z')||(s[0]>='A'&&s[0]<='Z')||(s[0]>='0'&&s[0]<='9')))return 0;
   for (const unsigned char *p=(const unsigned char *)s; *p; p++)
     if (!((*p>='a'&&*p<='z')||(*p>='A'&&*p<='Z')||(*p>='0'&&*p<='9')||*p=='_'||*p=='-'||*p=='.')) return 0;
   return 1;
@@ -29,14 +35,18 @@ static json_object *field(json_object *o,const char *k,enum json_type t) {
   if (!o || !json_object_object_get_ex(o,k,&v) || !json_object_is_type(v,t)) deny("invalid protected schema");
   return v;
 }
-static const char *str(json_object *o,const char *k) { return json_object_get_string(field(o,k,json_type_string)); }
+static const char *str(json_object *o,const char *k) {
+  json_object *value=field(o,k,json_type_string);const char *text=json_object_get_string(value);
+  if((size_t)json_object_get_string_len(value)!=strlen(text))deny("embedded NUL in protected string");
+  return text;
+}
 static int number(json_object *o,const char *k) {
   int64_t n=json_object_get_int64(field(o,k,json_type_int));
   if (n<=0 || n>2147483647) deny("invalid principal identity");
   return (int)n;
 }
 static void trusted_path(const char *path,int dir,uid_t owner) {
-  char copy[4096]; size_t n=strlen(path); struct stat st;
+  char copy[4097]; size_t n=strlen(path); struct stat st;
   if (!n || n>=sizeof(copy) || path[0]!='/' || strstr(path,"//") || strstr(path,"/../") || strstr(path,"/./") ||
       !strcmp(path+n-1,"/") || !strcmp(path+n-(n>=3?3:n),"/..")) deny("invalid protected path");
   memcpy(copy,path,n+1);
@@ -87,19 +97,179 @@ static void credentials(pid_t pid,int uid,int gid,json_object *groups) {
   }
   free(s); if(!got_uid||!got_gid||!got_groups||!no_new_privs||caps!=31)deny("kernel credentials unavailable");
 }
-static void lineage(json_object *native) {
-  json_object *server=field(native,"server_identity",json_type_object); int pid=number(server,"pid");
-  if(getppid()!=pid) deny("gate is not the original server child");
+struct parent_identity { pid_t pid; char birth[256]; };
+static void parent_birth(pid_t pid,char birth[256]) {
+  if(pid<=1||getppid()!=pid) deny("original gate parent unavailable");
   char path[64]; snprintf(path,sizeof(path),"/proc/%d/stat",pid); char *s=read_file(path,16384);
   char *end=strrchr(s,')'); if(!end||end[1]!=' ') deny("server birth unavailable");
   char *save=NULL,*word=strtok_r(end+2," ", &save); int i=3; const char *ticks=NULL;
   while(word) { if(i==22){ticks=word;break;} i++;word=strtok_r(NULL," ",&save); }
   if(!ticks||strspn(ticks,"0123456789")!=strlen(ticks))deny("server birth unavailable");
   char *boot=read_file("/proc/sys/kernel/random/boot_id",128); boot[strcspn(boot,"\n")]=0;
-  char birth[256]; snprintf(birth,sizeof(birth),"linux:%s:%s",boot,ticks);
-  if(strcmp(birth,str(server,"started_at")))deny("server incarnation changed");
+  int written=snprintf(birth,256,"linux:%s:%s",boot,ticks);
+  if(written<0||written>=256)deny("parent birth oversized");
   free(boot);free(s);
-  credentials(pid,number(server,"uid"),number(server,"gid"),field(server,"groups",json_type_array));
+  if(getppid()!=pid)deny("original gate parent changed");
+}
+static void same_parent(const struct parent_identity *parent) {
+  char birth[256];parent_birth(parent->pid,birth);
+  if(strcmp(birth,parent->birth))deny("original gate parent incarnation changed");
+}
+static void parent_credentials(const struct parent_identity *parent,json_object *mapping) {
+  same_parent(parent);
+  credentials(parent->pid,number(mapping,"worker_uid"),number(mapping,"worker_gid"),field(mapping,"worker_groups",json_type_array));
+  same_parent(parent);
+}
+static void closed(json_object *object,const char *const *keys,size_t count) {
+  if(!json_object_is_type(object,json_type_object)||(size_t)json_object_object_length(object)!=count)deny("open protected schema");
+  for(size_t i=0;i<count;i++) { json_object *value=NULL;if(!json_object_object_get_ex(object,keys[i],&value))deny("incomplete protected schema"); }
+}
+static void hex_field(json_object *object,const char *key,size_t min,size_t max) {
+  const char *value=str(object,key);size_t length=(size_t)json_object_get_string_len(field(object,key,json_type_string));
+  if(length!=strlen(value)||(length!=min&&length!=max)||strspn(value,"0123456789abcdef")!=length)deny("invalid protected digest");
+}
+static void bounded_integer(json_object *object,const char *key,int64_t max) {
+  int64_t value=json_object_get_int64(field(object,key,json_type_int));
+  if(value<1||value>max)deny("invalid prepared bound");
+}
+static void entry_reference(json_object *reference,int64_t limit) {
+  static const char *const keys[]={"path","bytes","sha256"};
+  closed(reference,keys,3);bounded_integer(reference,"bytes",limit);hex_field(reference,"sha256",64,64);
+  const char *path=str(reference,"path");size_t n=strlen(path);
+  if(n<2||n>4096||path[0]!='/'||path[n-1]=='/'||strstr(path,"//")||strstr(path,"/./")||strstr(path,"/../")||
+     !strcmp(path+n-2,"/.")||(n>=3&&!strcmp(path+n-3,"/..")))deny("invalid worker reference path");
+}
+static void worker_entry(json_object *entry) {
+  static const char *const keys[]={"interpreter","wrapper"};closed(entry,keys,2);
+  entry_reference(field(entry,"interpreter",json_type_object),33554432);
+  entry_reference(field(entry,"wrapper",json_type_object),1048576);
+}
+static void workspace_resource(json_object *resource) {
+  static const char *const keys[]={"device","filesystem_type","gid","host_path","inode","mount_id","uid","view_path"};
+  closed(resource,keys,8);
+  const char *numbers[]={"device","inode","uid","gid"};
+  for(size_t i=0;i<4;i++)if(json_object_get_int64(field(resource,numbers[i],json_type_int))<0)deny("invalid workspace identity");
+  bounded_integer(resource,"mount_id",INT64_MAX);
+  const char *fs=str(resource,"filesystem_type");
+  if(strcmp(fs,"ext4")&&strcmp(fs,"xfs")&&strcmp(fs,"btrfs")&&strcmp(fs,"tmpfs"))deny("invalid workspace filesystem");
+  const char *paths[]={"host_path","view_path"};
+  for(size_t i=0;i<2;i++) {
+    const char *path=str(resource,paths[i]);size_t n=strlen(path);
+    if(!n||n>4096||path[0]!='/'||(n>1&&path[n-1]=='/')||strstr(path,"//")||strstr(path,"/./")||strstr(path,"/../")||
+       (n>=2&&!strcmp(path+n-2,"/."))||(n>=3&&!strcmp(path+n-3,"/..")))deny("invalid workspace path");
+  }
+}
+static void workspace_exclusion(json_object *projection,const char *mapping_id) {
+  static const char *const keys[]={"authority_gid","authority_uid","key","root_resource","worker_cwd_resource"};
+  closed(projection,keys,5);number(projection,"authority_uid");number(projection,"authority_gid");
+  json_object *root=field(projection,"root_resource",json_type_object);
+  workspace_resource(root);workspace_resource(field(projection,"worker_cwd_resource",json_type_object));
+  char view[256],prefix[256];
+  int v=snprintf(view,sizeof(view),"/run/ace/lifecycle-exclusion/%s",mapping_id);
+  int p=snprintf(prefix,sizeof(prefix),"workspace:%s:",mapping_id);
+  const char *key=str(projection,"key");size_t n=strlen(key);
+  if(v<0||(size_t)v>=sizeof(view)||p<0||(size_t)p>=sizeof(prefix)||strcmp(view,str(root,"view_path"))||
+     n!=(size_t)p+64||strncmp(key,prefix,(size_t)p))deny("workspace mapping differs");
+  for(size_t i=(size_t)p;i<n;i++)if(!((key[i]>='0'&&key[i]<='9')||(key[i]>='a'&&key[i]<='f')))deny("invalid workspace digest");
+  char suffix[256];int s=snprintf(suffix,sizeof(suffix),"/workspaces/%s/%s",mapping_id,key+p);
+  const char *host=str(root,"host_path");size_t h=strlen(host);
+  if(s<0||(size_t)s>=sizeof(suffix)||h<(size_t)s||strcmp(host+h-s,suffix)||
+     json_object_get_int64(field(root,"uid",json_type_int))!=number(projection,"authority_uid")||
+     json_object_get_int64(field(root,"gid",json_type_int))!=number(projection,"authority_gid"))deny("workspace owner differs");
+  /* The original Ruby owner verifies the canonical cwd digest and held inode.
+     These closed release fields convey no independent filesystem grant. */
+}
+static void prepared_permission(json_object *permission,const char *mapping_id) {
+  static const char *const permission_keys[]={"operation","launch_ticket","attempt_id","assignment_id","generation","journal_commit","prepared_input"};
+  closed(permission,permission_keys,7);hex_field(permission,"journal_commit",40,64);
+  json_object *input=field(permission,"prepared_input",json_type_object);
+  static const char *const input_keys[]={"registration_generation","registration_commit","definition_digest","original_binding_digest","prepared_work","bundle_ref","bundle_bytes","bundle_sha256","worker_entry","workspace_exclusion"};
+  closed(input,input_keys,10);worker_entry(field(input,"worker_entry",json_type_object));bounded_integer(input,"registration_generation",INT64_MAX);
+  workspace_exclusion(field(input,"workspace_exclusion",json_type_object),mapping_id);
+  hex_field(input,"registration_commit",40,64);hex_field(input,"definition_digest",64,64);
+  hex_field(input,"original_binding_digest",64,64);hex_field(input,"bundle_sha256",64,64);
+  bounded_integer(input,"bundle_bytes",64*1024*1024);
+  char expected[256];
+  int written=snprintf(expected,sizeof(expected),"execution/prepared/%s-%s.bundle",str(permission,"assignment_id"),str(input,"bundle_sha256"));
+  if(written<0||(size_t)written>=sizeof(expected)||
+      strcmp(expected,str(input,"bundle_ref"))||json_object_get_string_len(field(input,"bundle_ref",json_type_string))!=(int)strlen(expected))deny("prepared bundle reference differs");
+  json_object *work=field(input,"prepared_work",json_type_object);
+  static const char *const work_keys[]={"version","task_id","scope","prepared_head","prepared_tree","manifest_bytes","manifest_sha256","selection_sha256"};
+  closed(work,work_keys,8);
+  const char *task=str(work,"task_id");size_t task_length=(size_t)json_object_get_string_len(field(work,"task_id",json_type_string));
+  if(json_object_get_int64(field(work,"version",json_type_int))!=1||task_length!=strlen(task)||!task_length||task_length>200||
+      !((task[0]>='a'&&task[0]<='z')||(task[0]>='A'&&task[0]<='Z')||(task[0]>='0'&&task[0]<='9')))deny("invalid prepared selection");
+  for(size_t i=0;i<task_length;i++)if(!((task[i]>='a'&&task[i]<='z')||(task[i]>='A'&&task[i]<='Z')||(task[i]>='0'&&task[i]<='9')||task[i]=='_'||task[i]=='-'||task[i]=='.'))deny("invalid prepared task");
+  const char *scope=str(work,"scope");size_t scope_length=(size_t)json_object_get_string_len(field(work,"scope",json_type_string));
+  if(scope_length!=strlen(scope)||!scope_length)deny("invalid prepared scope");
+  size_t digits=0;
+  for(size_t i=0;i<scope_length;i++) {
+    if(scope[i]>='0'&&scope[i]<='9')digits++;
+    else if(scope[i]=='.'&&digits>0)digits=0;
+    else deny("invalid prepared scope");
+  }
+  if(!digits)deny("invalid prepared scope");
+  hex_field(work,"prepared_head",40,64);hex_field(work,"prepared_tree",40,64);
+  hex_field(work,"manifest_sha256",64,64);hex_field(work,"selection_sha256",64,64);
+  bounded_integer(work,"manifest_bytes",32768);
+}
+/* First OpenSSL call suppresses config; a private context has only the fixed
+   default provider. /dev/null is deliberately not a module directory. */
+static EVP_MD *fixed_sha256(OSSL_LIB_CTX **context,OSSL_PROVIDER **provider) {
+  if(!OPENSSL_init_crypto(OPENSSL_INIT_NO_LOAD_CONFIG,NULL))deny("digest initialization failed");
+  *context=OSSL_LIB_CTX_new();if(!*context||!OSSL_PROVIDER_set_default_search_path(*context,"/dev/null"))deny("digest context failed");
+  *provider=OSSL_PROVIDER_load(*context,"default");if(!*provider)deny("fixed digest provider unavailable");
+  EVP_MD *digest=EVP_MD_fetch(*context,"SHA256","provider=default");if(!digest)deny("fixed digest unavailable");return digest;
+}
+static int same_metadata(const struct stat *a,const struct stat *b) {
+  return a->st_dev==b->st_dev&&a->st_ino==b->st_ino&&a->st_uid==b->st_uid&&a->st_gid==b->st_gid&&
+    a->st_mode==b->st_mode&&a->st_size==b->st_size&&a->st_mtim.tv_sec==b->st_mtim.tv_sec&&
+    a->st_mtim.tv_nsec==b->st_mtim.tv_nsec&&a->st_ctim.tv_sec==b->st_ctim.tv_sec&&a->st_ctim.tv_nsec==b->st_ctim.tv_nsec;
+}
+static int held_entry(json_object *reference,int executable,const EVP_MD *digest,struct stat *verified) {
+  const char *path=str(reference,"path");root_path(path,0);
+  int fd=open(path,O_RDONLY|O_NONBLOCK|O_NOFOLLOW|O_CLOEXEC);if(fd<0)deny("worker entry unavailable");
+  struct stat before,after;
+  int64_t expected=json_object_get_int64(field(reference,"bytes",json_type_int));
+  if(fstat(fd,&before)||!S_ISREG(before.st_mode)||before.st_uid!=0||(before.st_mode&06022)||before.st_size!=expected||
+     (executable&&!(before.st_mode&0111)))deny("unsafe held worker entry");
+  unsigned char magic[4];
+  if(executable&&(pread(fd,magic,sizeof(magic),0)!=(ssize_t)sizeof(magic)||memcmp(magic,"\177ELF",4)))deny("worker interpreter is not native ELF");
+  int snapshot=-1;if(!executable) {snapshot=memfd_create("ace-worker-source",MFD_CLOEXEC|MFD_ALLOW_SEALING);if(snapshot<0)deny("worker snapshot unavailable");}
+  EVP_MD_CTX *ctx=EVP_MD_CTX_new();if(!ctx||!EVP_DigestInit_ex(ctx,digest,NULL))deny("worker digest unavailable");
+  unsigned char buffer[65536],sum[EVP_MAX_MD_SIZE];size_t total=0;unsigned int sum_size=0;
+  for(;;) {
+    ssize_t n=read(fd,buffer,sizeof(buffer));if(n<0&&errno==EINTR)continue;if(n<0)deny("held worker read failed");if(!n)break;
+    if((int64_t)total+n>expected)deny("held worker entry enlarged");
+    if(!EVP_DigestUpdate(ctx,buffer,(size_t)n))deny("worker digest failed");
+    total+=(size_t)n;
+    if(snapshot>=0) {size_t offset=0;while(offset<(size_t)n) {ssize_t written=write(snapshot,buffer+offset,(size_t)n-offset);
+      if(written<0&&errno==EINTR)continue;
+      if(written<=0)deny("worker snapshot write failed");
+      offset+=(size_t)written;}}
+  }
+  if(total!=(size_t)expected||!EVP_DigestFinal_ex(ctx,sum,&sum_size)||sum_size!=32||fstat(fd,&after)||!same_metadata(&before,&after))deny("held worker entry changed");
+  EVP_MD_CTX_free(ctx);char hex[65];for(unsigned int i=0;i<32;i++)snprintf(hex+i*2,3,"%02x",sum[i]);
+  if(strcmp(hex,str(reference,"sha256")))deny("held worker digest differs");
+  *verified=after;
+  if(executable) {if(lseek(fd,0,SEEK_SET)<0)deny("worker interpreter seek failed");return fd;}
+  close(fd);
+  int seals=F_SEAL_WRITE|F_SEAL_GROW|F_SEAL_SHRINK|F_SEAL_SEAL;
+  if(fcntl(snapshot,F_ADD_SEALS,seals)||fcntl(snapshot,F_GET_SEALS)!=seals)deny("worker snapshot sealing failed");
+  char descriptor[64];snprintf(descriptor,sizeof(descriptor),"/proc/self/fd/%d",snapshot);
+  int readonly=open(descriptor,O_RDONLY|O_CLOEXEC);if(readonly<0)deny("readonly worker snapshot unavailable");
+  struct stat sealed,reopened;
+  if(fstat(snapshot,&sealed)||fstat(readonly,&reopened)||sealed.st_dev!=reopened.st_dev||sealed.st_ino!=reopened.st_ino||
+    reopened.st_size!=expected||fcntl(readonly,F_GET_SEALS)!=seals)deny("worker snapshot identity differs");
+  *verified=reopened;
+  close(snapshot);return readonly;
+}
+static void select_entry_descriptors(int interpreter,int wrapper) {
+  int held_interpreter=fcntl(interpreter,F_DUPFD_CLOEXEC,6),held_wrapper=fcntl(wrapper,F_DUPFD_CLOEXEC,6);
+  if(held_interpreter<0||held_wrapper<0)deny("worker descriptor reservation failed");
+  close(interpreter);close(wrapper);
+  if(dup2(held_interpreter,4)!=4||dup2(held_wrapper,5)!=5||fcntl(4,F_SETFD,0)||fcntl(5,F_SETFD,0))deny("worker descriptor selection failed");
+  close(held_interpreter);close(held_wrapper);
 }
 static void wait_fd(int fd,short events,double deadline) {
   struct pollfd p={.fd=fd,.events=events}; int r;
@@ -125,26 +295,32 @@ static json_object *receive(int fd,double deadline) {
   while(n<LIMIT) { wait_fd(fd,POLLIN,deadline); ssize_t r=recv(fd,s+n,1,0);
     if(r<0&&(errno==EINTR||errno==EAGAIN))continue;
     if(r<=0)deny("authority EOF before permission");
-    if(s[n++]=='\n') { json_tokener *t=json_tokener_new();json_object *o=json_tokener_parse_ex(t,s,(int)n);
+    if(s[n++]=='\n') { json_tokener *t=json_tokener_new();json_tokener_set_flags(t,JSON_TOKENER_VALIDATE_UTF8);json_object *o=json_tokener_parse_ex(t,s,(int)n);
       if(!o||json_tokener_get_error(t)!=json_tokener_success||json_tokener_get_parse_end(t)!=n||!json_object_is_type(o,json_type_object))deny("invalid authority frame");
+      /* The maintained wire emits one compact JSON record. Round-trip equality
+         refuses duplicate keys, extra whitespace/records and alternate escapes. */
+      const char *canonical=json_object_to_json_string_ext(o,JSON_C_TO_STRING_PLAIN|JSON_C_TO_STRING_NOSLASHESCAPE);
+      if(strlen(canonical)!=n-1||memcmp(canonical,s,n-1))deny("noncanonical authority frame");
       json_tokener_free(t);free(s);return o; }
   }
   deny("authority frame oversized"); return NULL;
 }
 int main(int argc,char **argv) {
+  struct parent_identity original_parent={.pid=getppid()};
+  parent_birth(original_parent.pid,original_parent.birth);same_parent(&original_parent);
   if(prctl(PR_SET_DUMPABLE,0,0,0,0))deny("non-dumpable gate unavailable");
   if(argc!=3||!token(argv[1])||!token(argv[2]))deny("expected fixed mapping and correlation ticket");
   policy();root_path(MAP_PATH,0);char *bytes=read_file(MAP_PATH,LIMIT);
-  json_tokener *parser=json_tokener_new();json_object *map=json_tokener_parse_ex(parser,bytes,(int)strlen(bytes));
+  json_tokener *parser=json_tokener_new();json_tokener_set_flags(parser,JSON_TOKENER_VALIDATE_UTF8);json_object *map=json_tokener_parse_ex(parser,bytes,(int)strlen(bytes));
   if(!map||json_tokener_get_error(parser)!=json_tokener_success||json_tokener_get_parse_end(parser)!=strlen(bytes))deny("invalid deployment map");
   json_tokener_free(parser);free(bytes);
-  if(strcmp(str(map,"schema"),"ace.assign.authorities/v1"))deny("unsupported deployment map");
+  if(strcmp(str(map,"schema"),"ace.assign.authorities/v2"))deny("unsupported deployment map");
   json_object *mapping=field(field(map,"launch_mappings",json_type_object),argv[1],json_type_object);
   json_object *service=field(field(map,"authorities",json_type_object),str(mapping,"authority_id"),json_type_object);
   int worker=number(mapping,"worker_uid"),launcher=number(mapping,"launcher_uid"),authority=number(service,"uid");
   if(worker==launcher||worker==authority||authority==launcher)deny("principals are not distinct");
   credentials(getpid(),worker,number(mapping,"worker_gid"),field(mapping,"worker_groups",json_type_array));
-  lineage(field(mapping,"native",json_type_object));
+  parent_credentials(&original_parent,mapping);
   const char *bootstrap=str(mapping,"bootstrap");root_path(bootstrap,0);
   struct stat installed,self;
   if(stat(bootstrap,&installed)||stat("/proc/self/exe",&self)||installed.st_dev!=self.st_dev||installed.st_ino!=self.st_ino||
@@ -171,7 +347,7 @@ int main(int argc,char **argv) {
   json_object_object_add(request,"version",json_object_new_int(1));json_object_object_add(request,"operation",json_object_new_string("gate_ready"));
   json_object_object_add(request,"mutation_id",NULL);json_object_object_add(request,"project_id",json_object_new_string(str(mapping,"project_id")));
   json_object_object_add(params,"mapping_id",json_object_new_string(argv[1]));json_object_object_add(params,"launch_ticket",json_object_new_string(argv[2]));
-  json_object_object_add(request,"params",params);send_frame(fd,request,deadline);json_object_put(request);
+  json_object_object_add(request,"params",params);parent_credentials(&original_parent,mapping);send_frame(fd,request,deadline);json_object_put(request);
   json_object *ready=receive(fd,deadline);
   if(strcmp(str(ready,"status"),"ok")||strcmp(str(field(ready,"data",json_type_object),"phase"),"ready"))deny("gate not admitted");
   json_object_put(ready);
@@ -179,12 +355,15 @@ int main(int argc,char **argv) {
   if(strcmp(str(permission,"operation"),"release")||strcmp(str(permission,"launch_ticket"),argv[2])||
     !token(str(permission,"attempt_id"))||!token(str(permission,"assignment_id"))||!token(str(permission,"journal_commit")))deny("release permission differs");
   if(json_object_get_int64(field(permission,"generation",json_type_int))<1)deny("invalid release generation");
-  policy();lineage(field(mapping,"native",json_type_object));credentials(peer.pid,authority,number(service,"gid"),field(service,"groups",json_type_array));
-  json_object *arguments=field(mapping,"worker_argv",json_type_array);size_t count=json_object_array_length(arguments);
-  if(!count||count>64)deny("invalid fixed payload");
-  char **payload=calloc(count+1,sizeof(char *));if(!payload)deny("allocation failed");
-  for(size_t i=0;i<count;i++) {json_object *value=json_object_array_get_idx(arguments,i);if(!json_object_is_type(value,json_type_string))deny("invalid fixed argv");payload[i]=(char *)json_object_get_string(value);}
-  root_path(payload[0],0);struct stat program;if(stat(payload[0],&program)||(program.st_mode&06000)||!(program.st_mode&0111))deny("unsafe payload executable");
+  if(strlen(json_object_to_json_string_ext(permission,JSON_C_TO_STRING_PLAIN|JSON_C_TO_STRING_NOSLASHESCAPE))+1>16384)deny("release envelope oversized");
+  prepared_permission(permission,argv[1]);
+  policy();parent_credentials(&original_parent,mapping);credentials(peer.pid,authority,number(service,"gid"),field(service,"groups",json_type_array));
+  json_object *entry=field(field(permission,"prepared_input",json_type_object),"worker_entry",json_type_object);
+  OSSL_LIB_CTX *digest_context=NULL;OSSL_PROVIDER *digest_provider=NULL;EVP_MD *digest=fixed_sha256(&digest_context,&digest_provider);
+  struct stat interpreter_metadata,wrapper_metadata;
+  int interpreter=held_entry(field(entry,"interpreter",json_type_object),1,digest,&interpreter_metadata);
+  int wrapper=held_entry(field(entry,"wrapper",json_type_object),0,digest,&wrapper_metadata);
+  EVP_MD_free(digest);OSSL_PROVIDER_unload(digest_provider);OSSL_LIB_CTX_free(digest_context);
   if(clearenv())deny("environment reset failed");
   json_object *env=field(mapping,"worker_env",json_type_object);
   json_object_object_foreach(env,key,value) {
@@ -195,5 +374,12 @@ int main(int argc,char **argv) {
     setenv("ACE_ASSIGN_LAUNCH_MAPPING",argv[1],1))deny("authority context unavailable");
   if(chdir(str(mapping,"worker_cwd")))deny("fixed worker directory unavailable");
   close(fd);
-  execv(payload[0],payload);deny("fixed worker execution failed");
+  struct stat final_interpreter,final_wrapper;
+  if(fstat(interpreter,&final_interpreter)||fstat(wrapper,&final_wrapper)||
+     !same_metadata(&interpreter_metadata,&final_interpreter)||!same_metadata(&wrapper_metadata,&final_wrapper))deny("worker entry changed before execution");
+  select_entry_descriptors(interpreter,wrapper);
+  parent_credentials(&original_parent,mapping);
+  char *const payload[]={"/proc/self/fd/4","-I","-S","-B","/proc/self/fd/5","authority","worker",NULL};
+  extern char **environ;
+  fexecve(4,payload,environ);deny("fixed worker execution failed");
 }

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-runtime
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-05 00:00:00.000000000 Z
+date: 2026-10-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: fiddle
@@ -201,14 +201,24 @@ files:
 - lib/ace/runtime/cli/commands/send.rb
 - lib/ace/runtime/errors.rb
 - lib/ace/runtime/molecules/cgroup_observation.rb
+- lib/ace/runtime/molecules/codex_runtime_installation.rb
+- lib/ace/runtime/molecules/execution_boot_baseline.rb
+- lib/ace/runtime/molecules/execution_network_selection.rb
 - lib/ace/runtime/molecules/execution_unit_installation.rb
+- lib/ace/runtime/molecules/kernel_view_topology.rb
 - lib/ace/runtime/molecules/linux_mount_info.rb
 - lib/ace/runtime/molecules/network_installation_evidence.rb
+- lib/ace/runtime/molecules/owned_child_scope.rb
 - lib/ace/runtime/molecules/process_identity.rb
 - lib/ace/runtime/molecules/protected_artifact_set.rb
 - lib/ace/runtime/molecules/protected_linux.rb
 - lib/ace/runtime/molecules/protected_socket.rb
+- lib/ace/runtime/molecules/protected_task_context_entry.rb
+- lib/ace/runtime/molecules/protected_worker_entry.rb
+- lib/ace/runtime/molecules/readiness_configuration.rb
+- lib/ace/runtime/molecules/readiness_runtime.rb
 - lib/ace/runtime/molecules/runtime_selector.rb
+- lib/ace/runtime/molecules/server_resource_observation.rb
 - lib/ace/runtime/molecules/systemd_scope_manager.rb
 - lib/ace/runtime/registry.rb
 - lib/ace/runtime/testing.rb