ace-runtime 0.3.0 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1a5a447921ab8d6b478e41a38e6b56866977accc8a75250e394c89c6fa0ac658
-  data.tar.gz: efe75a6544cb3284a9bf544deaaa30975b60971a5c821799666502240442ec7f
+  metadata.gz: 9b9c53bb970a918797a57b7aa00c36587a8da5420944cca83cee41a6f6ae2792
+  data.tar.gz: 4c4486463938f67ce14882472ede27fd96016a95c92a60d38a85fa60e5e87027
 SHA512:
-  metadata.gz: 46343d278d6041fcd7f41c859207ee0303e28811d156b923bc195b88cf73aef852d3f44b50df62a90425f0cec8a942984504ca9a7c52e4cd9152ffc77679d87a
-  data.tar.gz: b61c518fb64562ddb1975be5b6b71242134f013ec80de029bf259c5d92acdd2572b428f60788e4e4578e7f5f2a59abb3e50ec8664eaa462ceb65482ce3b6857e
+  metadata.gz: 3b02211e6604c9b51ea8e2e294dac5678cad47b52f0b1b1e5fc971888bed07876974a16a3eb0178b5d4551f274b2559aba374e4ec8c578121a99ec6f888b0795
+  data.tar.gz: f36be2a74247d133b118cdfdbe58e24628f8051b262848e171523a6897c4bfd99d503cdac0de5c87f182c4c2179051ca4c01f64ed71a2fda3b310ba83496ca05

data/CHANGELOG.md

@@ -6,6 +6,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.4.1] - 2026-10-18
+
+### Changed
+
+- Validate execution-scope unit names with the existing systemd unit shape, `.slice`/`.service` suffix and effective isolation checks only. A unit name that contains a role word such as `overseer` is no longer rejected: a role label is not a security boundary, and the real checks stay unchanged.
+
+## [0.4.0] - 2026-10-16
+
+### Added
+
+- Distinguish positively ended process generations from inaccessible observations for explicit coordinator adoption; retain conservative unknown liveness for existing recovery observers.
+
 ## [0.3.0] - 2026-10-10
 
 - Ship the protected task-context/worker entry and readiness source used by the current consumers; these required modules were absent from published 0.2.0. Ordinary agent execution remains the ace-llm terminal CLI, with no additional Codex service.

data/README.md

@@ -1,8 +1,13 @@
 # ace-runtime
 
-Runtime-neutral terminal intent contract for ACE (spec 8wq.t.k86.0). One
+> **State owner:** none. `ace-runtime` is a stateless terminal intent contract;
+> tmux/Herdr adapters own only terminal transport. Task, assignment, and HITL
+> state belong to `.ace-tasks/` and the local stores under `.ace-local/`
+> ([docs/lab-flow.md](../docs/lab-flow.md)).
+
+Runtime-neutral terminal intent contract for ACE. One
 duck-typed intent API that terminal runtimes implement and all consumers
-call — the structural change that makes herdr an equal partner to tmux
+call -- the structural change that makes herdr an equal partner to tmux
 instead of a side gem.
 
 Adapters live INSIDE the existing wrapper gems: `ace-tmux` and `ace-herdr`
@@ -17,22 +22,22 @@ Eleven operations, keyword-arg surfaces mirroring today's consumer calls:
 | Operation | Surface |
 |-----------|---------|
 | Context | `runtime.context` → `{in_runtime:, session:, window:, pane:}` |
-| Ensure window | `runtime.ensure_window(name:, root:, preset: nil)` — idempotent by normalized name; conflicting root/preset raises `WindowConflictError` |
+| Ensure window | `runtime.ensure_window(name:, root:, preset: nil)` -- idempotent by normalized name; conflicting root/preset raises `WindowConflictError` |
 | Process identity | `runtime.process_binding(pane:, caller_pid:)` → verified owner/native binding or nil (unknown); read-only, no authorization |
-| Prepare pane | `runtime.prepare_pane(window:)` — splits when needed; target stays alive after a submitted command exits |
+| Prepare pane | `runtime.prepare_pane(window:)` -- splits when needed; target stays alive after a submitted command exits |
 | Focus | `runtime.focus(window:)` |
-| Send | `runtime.send(pane:, command: nil, items: [])` — ordered `{message: String}` / `{key: String}` entries |
+| Send | `runtime.send(pane:, command: nil, items: [])` -- ordered `{message: String}` / `{key: String}` entries |
 | Capture | `runtime.capture(pane:, lines: 40)` → text |
 | Wait output | `runtime.wait_output(pane:, pattern:, timeout:)` |
 | Wait agent | `runtime.wait_agent(pane:, states:, timeout:)` |
-| Wait lifecycle | `runtime.wait_lifecycle(condition:, target:, timeout:)` — `window-exits`/`window-active`/`pane-exists`/`pane-exited` observations only |
+| Wait lifecycle | `runtime.wait_lifecycle(condition:, target:, timeout:)` -- `window-exits`/`window-active`/`pane-exists`/`pane-exited` observations only |
 | Close | `runtime.close_window(window:)` |
 | List | `runtime.list_windows` / `runtime.list_panes(window:)` |
 
 Convenience shapes: `send_command(pane:, command:)`,
 `send_text(pane:, text:)`, `send_keys(pane:, keys:)`.
 
-Target identity is opaque adapter-owned handles at every boundary — the
+Target identity is opaque adapter-owned handles at every boundary -- the
 contract never predicts or formats pane ids (tmux `%id` and herdr
 `w1:p1` stay adapter-internal). Window operations take the (sanitized)
 window name; pane operations take the handle returned by the adapter.
@@ -52,30 +57,33 @@ CLI/runtime selection precedence (highest wins):
 
 1. explicit name (`ace-runtime send --runtime herdr`)
 2. `ACE_RUNTIME` environment (consumer forks set this plus target context)
-3. configured runtime — `.ace/runtime/config.yml` key `runtime`
+3. configured runtime -- `.ace/runtime/config.yml` key `runtime`
 4. auto-detection from the environment (`TMUX` / `ACE_TMUX_SESSION`, or
    `HERDR_SESSION` + `HERDR_PANE`). When both are live, tmux wins
    (existing default). Only assign auto launch mode selects headless
    outside any runtime; that decision lives above this contract.
 
 An explicitly selected runtime that turns out unknown or unavailable
-fails closed — never a silent switch or headless downgrade.
+fails closed -- never a silent switch or headless downgrade.
 
 ## Send matrix
 
 `send` is the only submission primitive; the granular ops are shapes of
-it. `items` is an ORDERED list — the only shape that preserves
+it. `items` is an ORDERED list -- the only shape that preserves
 message/key interleaving. When `command` is present, `items` holds
 exclusively post-command keys; leading keys are a usage error before any
 transport call (the CLI enforces `--cmd` before every `--key`).
 
 - **Plain-pane adapters** (`send_profile == :plain_pane`, e.g. tmux):
+
   messages are raw text (no implicit submission), keys are keystrokes,
   each Enter submits pending text; `command` submits once, then trailing
   keys deliver.
+
 - **Agent-aware adapters** (`send_profile == :agent_aware`, e.g. herdr):
+
   `command` or the concatenated messages become ONE prompt that submits
-  itself (message-only input DOES submit once on agent panes — intended
+  itself (message-only input DOES submit once on agent panes -- intended
   divergence); at most one trailing Enter is dropped and reported via
   the result; keys-only sequences go to agent keys; every other
   interleaving is rejected before any transport call.
@@ -87,16 +95,18 @@ profiles.
 
 All failures subclass `Ace::Runtime::Error`:
 
-- `UnknownRuntimeError` — with the sorted available list
-- `RuntimeUnavailableError` — known runtime, unusable right now
-- `TargetNotFoundError` — window/pane target does not exist
-- `WindowConflictError` — same normalized name, incompatible root/preset
-- `SendRejectedError` — pre-send rejection; terminal, no transport call
-- `SendStalledError` — submission accepted but the target never started
+- `UnknownRuntimeError` -- with the sorted available list
+- `RuntimeUnavailableError` -- known runtime, unusable right now
+- `TargetNotFoundError` -- window/pane target does not exist
+- `WindowConflictError` -- same normalized name, incompatible root/preset
+- `SendRejectedError` -- pre-send rejection; terminal, no transport call
+- `SendStalledError` -- submission accepted but the target never started
+
   processing; OUTCOME UNCERTAIN, callers must not auto-resend
-- `WaitTimeoutError` — a wait exceeded its deadline (seconds context)
 
-`pane-exited` is a runtime observation only — never assignment success,
+- `WaitTimeoutError` -- a wait exceeded its deadline (seconds context)
+
+`pane-exited` is a runtime observation only -- never assignment success,
 receipt confirmation, or prune authorization.
 
 ## Adapter contract
@@ -110,12 +120,16 @@ Ace::Runtime.register(:<name>, -> { Ace::Tmux::RuntimeAdapter.new })
 ```
 
 The contract resolves an unregistered known name by attempting to load
-that entrypoint lazily — no gem dependency in either direction.
+that entrypoint lazily -- no gem dependency in either direction.
 
 The packaged shared suite `Ace::Runtime::Testing::AdapterContract` is
 the acceptance bar for ANY adapter. See `docs/usage.md` for the
 adapter-authoring walkthrough.
 
+> **Planned (L2):** retirement or redesign of the legacy native bootstrap
+> artifacts under `native/` -- not available yet. They are not required by the
+> file-based flow.
+
 Note: adapters intentionally define `send` (the intent operation),
 which overrides `Object#send`. Use `__send__` for reflective dispatch
 on adapter objects.

data/docs/usage.md

@@ -30,15 +30,22 @@ ace-runtime send --pane %1 --cmd 'vim .' --key C-w
 Rules enforced before any transport call:
 
 - `--pane` is required; at least one of `--cmd`, `--msg`, `--key` is
+
   required (none = usage error).
-- `--key` before `--cmd` is a usage error — `--cmd` must be declared
+
+- `--key` before `--cmd` is a usage error -- `--cmd` must be declared
+
   before every key. Keys declared after `--cmd` are post-submission
   keystrokes.
+
 - The CLI builds direct-API items as all supplied messages followed by
+
   all supplied keys. Direct Ruby callers use `send(items:)` when they
   need arbitrary interleaving (for example `msg, key, msg` on plain
   panes).
+
 - On agent panes (`:agent_aware` profile) the callback shapes submit
+
   exactly once: `--msg ... --key Enter` becomes one self-submitting
   prompt with the trailing Enter dropped and reported; interleaved
   items, multiple Enters, `--cmd` with messages, and `--cmd` with
@@ -87,7 +94,7 @@ name)`; an existing window with an incompatible root or preset raises
 `WindowConflictError` instead of silently reusing the wrong worktree.
 
 `wait_lifecycle` accepts only `window-exists`, `window-active`,
-`pane-exists`, `pane-exited`. It reports the condition only — never
+`pane-exists`, `pane-exited`. It reports the condition only -- never
 authorizes completion, receipts, or pruning. `pane-exited` in
 particular is an observation, not assignment success or safe prune
 evidence.
@@ -105,14 +112,14 @@ evidence.
 
 Explicit selections never downgrade: unknown names fail closed with
 the available list (`UnknownRuntimeError`); a selected-but-unavailable
-runtime raises `RuntimeUnavailableError` — no headless fallback, no
+runtime raises `RuntimeUnavailableError` -- no headless fallback, no
 silent switch. The assign auto launch mode is the only consumer that
 selects headless outside any runtime, and it does so above this
 contract.
 
 ## Adapter authoring
 
-Adapters are duck-typed — no base class (ace-hitl provider-registry
+Adapters are duck-typed -- no base class (ace-hitl provider-registry
 pattern). An adapter package:
 
 1. declares a dependency on `ace-runtime` (never the reverse),
@@ -140,11 +147,16 @@ Non-negotiables enforced by the contract suite:
 
 - target handles stay opaque at every public boundary,
 - `prepare_pane` yields a writable live shell/agent target retained
+
   after a submitted command exits (bare command panes do not satisfy
   preparation),
+
 - `detect` and adapter availability checks are side-effect-free; an
+
   unavailable explicit runtime never becomes headless,
+
 - installed tests must verify both runtimes; never assert untested
+
   behavior.
 
 ### The acceptance bar
@@ -170,7 +182,7 @@ class TmuxAdapterContractTest < AceTestCase
 end
 ```
 
-The suite drives your adapter over `ScriptedRuntime` — an in-memory
+The suite drives your adapter over `ScriptedRuntime` -- an in-memory
 terminal (windows, panes, raw text writes, named keys, capture, agent
 state) that records every mutation op so the suite can assert delivery
 ordering and rejection-before-transport. Wire your adapter's native
@@ -188,125 +200,10 @@ in the ace-runtime gem; the in-gem suite
 (`test/contract/adapter_contract_test.rb`) proves the battery against
 it for both send profiles.
 
-## Root-produced network installation evidence
-
-The source-only `Ace::Runtime::Molecules::NetworkInstallationEvidence` consumer
-checks the protected content selected by the installed scope owner:
-
-```ruby
-result = Ace::Runtime::Molecules::NetworkInstallationEvidence.verify!(
-  selection: boundary_manifest.fetch("network_installation"),
-  expected: {
-    "slot_id" => slot_id,
-    "namespace_path" => installed_namespace_path,
-    "boot_id" => current_boot_id,
-    "namespace_identity" => {"device" => pinned_device, "inode" => pinned_inode},
-    "installer_artifact_sha256" => installed_producer_sha256
-  }
-)
-```
+## Native bootstrap and network evidence (legacy)
 
-`selection` is exactly `{profile,policy_export,report,installer_artifact}`; each
-reference is exactly `{path,sha256,bytes}`. All keys are strings, paths canonical
-and absolute, SHA256 lowercase, and lengths positive integers. There is no
-caller-uploaded evidence or caller-selected trust root. The namespace identity
-above must come from the owner's actual held, authenticated nsfs network object;
-the owner validates its type/current boot and keeps the namespace pinned through
-admission. This verifier reads content artifacts and never opens/substitutes the
-namespace, probes traffic or grants runtime networking privilege.
-
-Successful output contains exactly `report_id`, `boot_id`, `slot_id`,
-`namespace_path`, `namespace_identity`, `profile_sha256`, `policy_export_sha256`,
-`report_sha256` and `installer_artifact_sha256`, deeply frozen. It authenticates
-installation content, not actual enforcement from a summary boolean. Missing,
-unreadable, malformed, conflicting, oversized or context-mismatched evidence
-raises `Ace::Runtime::RuntimeUnavailableError`; the authority boundary exposes
-that refusal as `evidence_unavailable` and retains public `invalid_input`
-classification for malformed public selectors. No absent-evidence fallback.
-
-The reader pins regular-file and directory descriptors for the complete graph,
-checks exact lengths/digests and revalidates original objects/modes at completion.
-It uses root ownership and no group/other write on supported Linux POSIX local
-filesystems (`ext2`, `ext3`, `ext4`, `xfs`, `btrfs`, `tmpfs`): group mode bits
-represent the access ACL mask, so named non-root ACL users/groups cannot obtain
-write through it. Unknown filesystem models refuse. All ancestors are checked;
-no symlink, untrusted writable ancestor or mutable worker artifact qualifies.
-Content bounds are 1MiB per artifact, 16MiB aggregate and 256 distinct artifacts.
-Trusted installer code verifying a larger explicitly selected source closure can
-construct `ProtectedArtifactSet.new(count_limit: 4096)`; the value must be a
-positive integer supplied by trusted code, never copied from an artifact or
-request. Existing `file_limit:` and `total_limit:` budgets still apply. Mixed
-`read!`/`read_path!` calls share the count; repeating a retained reference spends
-no additional entry, and the first new artifact beyond the limit refuses.
-Trusted source installers can use `with_readonly_handle!(reference)` inside an
-active `ProtectedArtifactSet#with` callback to hand off the authenticated retained
-regular file. It yields a read-only duplicate without reopening the selected
-pathname, verifies the held set before and after the callback, and closes the
-duplicate on success or error. No descriptor or maintenance authority survives
-the callback. Existing reference/budget/root protection rules still apply.
-
-Network evidence verifiers retain their default budgets. Held descriptors also
-require sufficient process file-descriptor capacity in the installer environment.
-The profile's 256-entry bound counts its four outer collections only; nested
-ranges, ports and helper/configuration refs are bounded by the profile bytes and
-separate artifact graph limits. Strict JSON parsing requires the declared
-`json >= 2.20, < 3` dependency to reject duplicate keys and comments explicitly.
-
-The trusted domain installer owns complete effective policy/topology comparison,
-independent correlated flow checks, immutable digest-bearing evidence filenames
-and publication that preserves historical artifacts. The generic reference
-schema specifies no basename grammar: this consumer checks selected content and
-protection, and cannot establish publication history. Raw policy/topology/setup
-and correlated observations remain required; unsupported or incomplete domain
-checks must never produce a passing report. Domain source/installed review proves
-those obligations. For each loopback tool, the fixed domain procedure inspects
-the actual selected executable against its profile `artifact_sha256` and retains
-the observation in the exact tool-target trace. The schema provides no executable
-path/ref: generic ACE authenticates the trace/raw refs and digest format; it does
-not compare a tool executable digest with observation bytes or invent a ref.
-Domain acceptance must exercise tool-executable mismatch refusal.
-
-Root installation lifetime, private admission CAS, stage joins,
-namespace containment and maintenance ordering belong to their respective
-installed owners; this verifier does not implement them or supply native,
-packet-filter or installed acceptance by itself.
-
-### Original boot proof and fixed live readiness views
-
-`ExecutionBootBaseline#select!(expected:)` authenticates the fixed protected
-per-slot publication pointer at provisioning and returns its immutable proof
-reference. `#verify!(selection:, expected:)` reads only that original reference,
-joining whole-file bytes, slot, original boot, mapping digest, root PID1 birth
-context and exact original network installer artifact. It never discovers an old
-namespace or substitutes a current pointer. Proof JSON is closed and at most
-16KiB. Trusted host capture, per-boot refresh and cold-start admission inhibition
-remain domain gad.8/gad.b producer obligations.
-
-`ServerResourceObservation` uses the same-UID native server's pinned root and
-namespace descriptors without entering or changing a namespace. It reports the
-complete mount table (at most256 rows), fixed API/tmp view mount IDs obtained from
-contained O_PATH descriptors, server/hook IPC identities and the exact authority
-socket identity. It also holds the original server’s `/proc/<pid>/ns/net` object,
-requires the nsfs network-namespace type and rechecks its identity after collection.
-The report includes that observed `network_namespace_identity`; it never substitutes
-the hook’s namespace or a configured namespace identity. The private report shares
-a65,536-byte ceiling. Mount path
-prefixes, typed isolation flags and filesystem names alone do not prove live
-isolation. `KernelViewTopology` verifies the fixed supported profile, read-only
-API views, private IPC host difference and exact writable original backing;
-unknown writable aliases and even declared writable API descendants refuse.
-
-The fixed unit exposes only the selected read-only source-equals-view authority
-socket and has `BindLogSockets=false`. Protected endpoint type/owner/incarnation,
-contained view identity and authenticated peer remain separate required joins.
-These observations supply admission evidence, not terminality or installed
-effectiveness.
-The supported devpts profile additionally requires an authenticated per-slot
-`newinstance` backing, distinct from original host devpts. The trusted boot
-baseline pins original host and selected instance identities plus the exact host
-`pts/ptmx` link. The unit binds the selected root at `/dev/pts` and its read-only
-ptmx node at `/dev/pts/ptmx`; the contained observer verifies the unchanged link,
-character device and actual mount identity. `PrivateDevices` alone cannot prove
-this isolation. Shared host RO/RW views and another slot's backing refuse.
-gad.8 provisioning and gad.b refresh must deliver the selected source before
-activation; controlled tests do not establish installed effectiveness.
+> The native Linux worker bootstrap, the root-produced network installation
+> evidence, the boot baseline and the kernel view topology readers belong to the
+> replaced protected model. They are not part of the file-based flow and no
+> command, task, or assignment requires them. Their removal/redesign is tracked
+> in L1/L2; treat this package's runtime contract above as the supported surface.

data/lib/ace/runtime/molecules/execution_unit_installation.rb

@@ -299,7 +299,7 @@ module Ace
               %w[root_directory runtime_directory network_namespace_path].all? { |key| path?(scope[key]) } &&
               scope.fetch("runtime_directory").start_with?("/run/") && !overlaps?(scope.fetch("root_directory"), scope.fetch("runtime_directory")) &&
               {"slice_unit" => ".slice", "service_unit" => ".service"}.all? { |key, suffix|
-                scope[key].is_a?(String) && SystemdScopeManager::UNIT.match?(scope[key]) && scope[key].end_with?(suffix) && !scope[key].downcase.include?("overseer")
+                scope[key].is_a?(String) && SystemdScopeManager::UNIT.match?(scope[key]) && scope[key].end_with?(suffix)
               } &&
               scope["unit_manifest_sha256"] == service.fetch("unit_manifest").fetch("sha256") &&
               scope["boundary_manifest_sha256"] == service.fetch("boundary_manifest").fetch("sha256") &&

data/lib/ace/runtime/molecules/owned_child_scope.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require "fiddle"
+
+module Ace
+  module Runtime
+    module Molecules
+      # One ephemeral single-thread helper owns every child in this scope.
+      # Linux reparents detached orphans to this subreaper, not container PID1.
+      # Unreaped direct children pin their PIDs until this owner reaps them.
+      class OwnedChildScope
+        class CleanupUncertain < StandardError; end
+
+        def initialize
+          unless RUBY_PLATFORM.include?("linux") && Thread.list.count(&:alive?) == 1
+            raise CleanupUncertain, "child scope requires a sole Linux helper thread"
+          end
+          @owner = Process.pid
+          raise CleanupUncertain, "child scope has preexisting children" unless children.empty?
+          # An inherited ignore/custom reaper could discard a child's wait
+          # status and unpin its PID. This sole ephemeral helper owns the
+          # disposition; establish it while the verified child set is empty.
+          Signal.trap("CHLD", "DEFAULT")
+          prctl = Fiddle::Function.new(Fiddle::Handle::DEFAULT["prctl"],
+            [Fiddle::TYPE_INT, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG], Fiddle::TYPE_INT)
+          raise CleanupUncertain, "cannot establish child subreaper" unless prctl.call(36, 1, 0, 0, 0).zero?
+        end
+
+        # Preserve the leader's wait status for the executor. Kill/reap only
+        # kernel-owned direct children; adoption closes setsid/double-fork escape.
+        def cleanup!(leader:, timeout: 5)
+          unless Process.pid == @owner && Thread.list.count(&:alive?) == 1 &&
+              timeout.is_a?(Numeric) && timeout.finite? && timeout.positive? && timeout <= 5
+            raise CleanupUncertain, "child scope ownership is unavailable"
+          end
+          deadline = monotonic + timeout
+          owned = children
+          raise CleanupUncertain, "original child is no longer owned" unless owned.include?(leader)
+          signal("TERM", -leader)
+          loop do
+            owned = children
+            raise CleanupUncertain, "original child was reaped outside its scope" unless owned.include?(leader)
+            owned.each do |pid|
+              signal("KILL", pid)
+              Process.waitpid(pid, Process::WNOHANG) unless pid == leader
+            end
+            remaining = children
+            return if remaining == [leader] && zombie?(leader)
+            raise CleanupUncertain, "owned child cleanup deadline elapsed" if monotonic >= deadline
+            IO.select(nil, nil, nil, 0.01)
+          end
+        rescue Errno::ECHILD, Errno::ENOENT, IOError
+          raise CleanupUncertain, "owned child cleanup cannot be confirmed"
+        end
+
+        private
+
+        def children
+          File.open("/proc/self/task/#{@owner}/children", "r") do |file|
+            bytes = file.read(65_537) || ""
+            raise CleanupUncertain, "owned child inventory exceeds bound" if bytes.bytesize > 65_536
+            values = bytes.split.map { |value| Integer(value, 10) }
+            unless values.uniq == values && values.all?(&:positive?)
+              raise CleanupUncertain, "owned child inventory is invalid"
+            end
+            values.sort
+          end
+        end
+
+        def signal(name, pid)
+          Process.kill(name, pid)
+        rescue Errno::ESRCH
+          nil
+        end
+
+        def zombie?(pid) = File.read("/proc/#{pid}/stat").rpartition(")").last.split.first == "Z"
+        def monotonic = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      end
+    end
+  end
+end

data/lib/ace/runtime/molecules/process_identity.rb

@@ -3,6 +3,7 @@
 require "open3"
 require "socket"
 require "fiddle"
+require "time"
 
 module Ace
   module Runtime
@@ -117,6 +118,33 @@ module Ace
             {"liveness" => "unknown", "observed_at" => at, "reason" => "process identity no longer observable"}
           end
         end
+
+        # Positive evidence that this exact historical generation ended. A
+        # failed capture alone says nothing: EPERM/inaccessible probes remain
+        # unknown. PID reuse is conclusive only when the exact birth differs.
+        def generation_status(identity, process: Process)
+          at = Time.now.utc.iso8601
+          unknown = {"liveness" => "unknown", "observed_at" => at}
+          unless identity.is_a?(Hash) && identity.keys.sort == %w[host pid started_at uid] &&
+              identity["host"] == @hostname && identity["pid"].is_a?(Integer) && identity["pid"].positive? &&
+              identity["uid"].is_a?(Integer) && identity["uid"] >= 0 &&
+              identity["started_at"].is_a?(String) && !identity["started_at"].empty?
+            return unknown.merge("reason" => "verified process generation unavailable")
+          end
+          current = capture(identity.fetch("pid"))
+          return {"liveness" => "live", "observed_at" => at, "identity" => current} if current == identity
+          if current && current.fetch("started_at") != identity.fetch("started_at")
+            return {"liveness" => "ended", "observed_at" => at, "reason" => "pid generation replaced", "identity" => current}
+          end
+          begin
+            process.kill(0, identity.fetch("pid"))
+            unknown.merge("reason" => "process address exists but generation is unobservable")
+          rescue Errno::ESRCH
+            {"liveness" => "ended", "observed_at" => at, "reason" => "kernel reports no process at address"}
+          rescue SystemCallError
+            unknown.merge("reason" => "kernel process presence is unavailable")
+          end
+        end
       end
     end
   end

data/lib/ace/runtime/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Runtime
-    VERSION = "0.3.0"
+    VERSION = "0.4.1"
   end
 end

data/native/README.md

@@ -1,124 +1,13 @@
-# Protected Linux worker bootstrap
-
-The `ace-runtime` gem ships `native/worker_gate.c` and `native/build-worker-gate`.
-This is a Linux executable, not a Ruby interpreter wrapper. Build on the target
-architecture from the installed gem with the system compiler, json-c parser and OpenSSL 3 libcrypto.
-Supported initial architectures are Linux x86_64 and aarch64 with little-endian
-ELF64. A bootstrap built on another architecture fails deployment preflight.
-
-On Debian bookworm install the distribution's `build-essential`, `pkg-config`
-`libjson-c-dev` and `libssl-dev` build packages. The executable requires the matching system
-`libjson-c5`, OpenSSL 3 `libcrypto.so.3` (`libssl3`), libc and ELF loader at runtime. Use the same distribution/architecture
-for build and deployment; retain package versions, source SHA, compiler version,
-ELF machine, `readelf -d` dependencies and output SHA256 in installer evidence.
-These libraries and their loader search directories must remain root-owned and
-non-worker-writable. The pinned Herdr service starts with a clean root-controlled
-environment, so no worker loader/preload environment reaches bootstrap startup.
-
-From the installed gem directory, in a private unprivileged build directory:
-
-```sh
-native/build-worker-gate /absolute/private/build/ace-worker-gate
-sha256sum /absolute/private/build/ace-worker-gate
-readelf -h -d /absolute/private/build/ace-worker-gate
-```
-
-The administrator installs this exact artifact, without setuid/setgid bits:
-
-```sh
-install -o root -g root -m 0755 /absolute/private/build/ace-worker-gate /usr/libexec/ace-worker-gate
-```
-
-All installation ancestors are root-owned and non-worker-writable. The fixed
-root-owned `/etc/ace/assignment-authorities.json` records `bootstrap` and its exact
-`bootstrap_sha256`. ACE verifies digest, ELF architecture, executable permissions,
-ownership and ancestry before reservation. The native layout uses only this
-absolute executable, installed mapping ID and correlation ticket; cwd and environment come from the root-controlled mapping after authority release.
-The mandatory closed `worker_entry` pins interpreter and wrapper references; arbitrary
-worker argv and shebang/PATH execution are not admitted.
-The map grants no UID switching and the binary is never privileged.
-
-The root-installed authority, launcher and native server units require:
-
-```ini
-User=<their distinct mapped account>
-NoNewPrivileges=yes
-CapabilityBoundingSet=
-AmbientCapabilities=
-```
-
-Worker children inherit the server's empty bounds and no-new-privileges policy.
-ACE checks all real/effective/saved/filesystem IDs, supplementary groups, every
-capability set and `NoNewPrivs` from kernel status for all mapped participants,
-including the pinned server. CAP_DAC_OVERRIDE/CAP_SETUID are refused, as is an
-exec context that could gain capabilities or setuid privilege. Yama=2 remains
-mandatory; an empty capability set alone does not stop same-UID injection.
-
-The bootstrap sets non-dumpable before connecting, requires enforced Yama
-`ptrace_scope=2`, requires empty Inh/Prm/Eff/Bnd/Amb capability sets and NoNewPrivs=1, verifies
-worker IDs/groups and its retained actual kernel parent birth, authenticates authority
-SO_PEERCRED and protected socket ancestry, and waits at most 30 seconds on one
-stream. It never reconnects or executes after pre-release EOF, malformed input
-or timeout. A committed release whose response is lost remains potentially
-executed; public inspection must retain ownership rather than resend release.
-
-The gate accepts only the maintained `ace.assign.authorities/v2` mapping. It
-captures its actual parent PID and kernel boot/start-tick birth before reading
-the map, checks that same birth before and after parent credentials, and repeats
-the check before authority admission and immediately before exec. The canonical
-`gate_ready` authority owner associates the actual gate peer and its parent with
-the original recorded child/server; the map supplies no `server_identity`.
-Changed parent birth, reparenting, inaccessible credentials or changed policy
-refuses. The original retained mapping supplies `worker_entry={interpreter:REF,wrapper:REF}`
-in the authenticated release, rather than selecting code from the current map.
-Interpreter references are bounded to 32MiB and wrapper references to 1MiB.
-Both root-protected regular held files are hashed and their metadata rechecked.
-The interpreter must be an executable native ELF. The verified wrapper is copied
-into a memfd sealed against writes/growth/shrinkage, reopened read-only, and the
-writable descriptor dropped. Selected held interpreter FD4 and code FD5 survive
-`fexecve(4, ["/proc/self/fd/4", "-I", "-S", "-B", "/proc/self/fd/5", "authority", "worker"], env)`.
-Inherited stdin/stdout/stderr remain untouched; no provider lifetime timeout is added.
-The retained original source owner inside the wrapper separately validates and
-executes the accepted Ruby snapshot and its package closure.
-
-Release is one compact JSON record containing the original ticket/assignment/
-attempt/generation/commit plus `prepared_input`. That closed object pins the
-original registration generation/commit, definition and original binding digest,
-prepared-work reference, original worker entry pair and exact journal bundle reference/length/SHA256. The
-authority verifies the original bundle before durable issue; subsequent prepared
-fetch authenticates the accepted release pin before returning body bytes. The
-gate validates the closed ten-field pin, including the original workspace exclusion,
-digests and unchanged bounds before exec. The exclusion has five closed fields:
-key, authority UID/GID, readonly root resource and original cwd resource. Each
-resource has the existing eight identity fields. The gate checks integer/path/
-filesystem bounds and exact mapping/view/key association; the retained Ruby owner
-verifies the canonical cwd digest and held filesystem identity before acquiring
-the lifetime reader. This metadata does not itself grant filesystem access.
-The complete encoded release is bounded to16KiB before durable issue and at the gate. It
-does not receive inline work or propagate an input FD to providers. The worker
-uses the existing authenticated original prepared fetch after release.
-
-An ordinary Docker kernel with Yama=0 can verify compilation and fail-closed
-policy rejection. It cannot demonstrate protected launch acceptance. A real
-isolated Linux deployment enforcing the complete policy is required for that
-positive proof; installing this gem does not change host sysctls or install OS
-service/account policy. Downstream gad.8 provisions those requirements and
-consumes this shipped build mechanism.
-
-## Fixed digest initialization and acceptance limits
-
-Before any OpenSSL API call the gate selects `OPENSSL_INIT_NO_LOAD_CONFIG`.
-It creates a private library context, fixes its provider search path to `/dev/null`
-(a non-directory), explicitly loads only `default`, and fetches `SHA256` with
-`provider=default`. Failure refuses execution; no config/engine/module fallback
-is provided. [Initialization semantics](https://docs.openssl.org/3.0/man3/OPENSSL_init_crypto/),
-[provider search path](https://docs.openssl.org/3.0/man3/OSSL_PROVIDER/), and
-[fixed provider property](https://docs.openssl.org/3.0/man7/OSSL_PROVIDER-default/) and
-[libcrypto built-in default provider](https://docs.openssl.org/3.0/man7/crypto/#default-provider)
-are the maintained API basis. The system libcrypto/loader remain in the accepted
-root-controlled OS artifact closure; this does not attest an arbitrary library build.
-
-This source checkpoint does not compile or execute native code. Real ELF,
-OpenSSL linkage/provider availability, memfd seals, retained FD execution and
-Python script/stdlib behavior require installed Linux acceptance. The trusted
-provisioned OS/Python premise remains; no separate Python runtime tree is introduced.
+# Native worker bootstrap (retired from the file-based flow)
+
+The `ace-runtime` gem still ships `native/worker_gate.c` and
+`native/build-worker-gate` from the replaced protected model. They are not part
+of the current file-based flow: no command, task, assignment, or local
+documentation requires the native gate, its authority file, or its admission
+checks.
+
+Do not treat this directory as an owner of execution state. The supported
+`ace-runtime` surface is the terminal intent contract described in the
+[README](../README.md) and [usage](../docs/usage.md). Removal or redesign of the
+native bootstrap is tracked with the L1/L2 cleanup; this note keeps the
+historical source discoverable without presenting it as a requirement.

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-runtime
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.1
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-10 00:00:00.000000000 Z
+date: 2026-10-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: fiddle
@@ -208,6 +208,7 @@ files:
 - lib/ace/runtime/molecules/kernel_view_topology.rb
 - lib/ace/runtime/molecules/linux_mount_info.rb
 - lib/ace/runtime/molecules/network_installation_evidence.rb
+- lib/ace/runtime/molecules/owned_child_scope.rb
 - lib/ace/runtime/molecules/process_identity.rb
 - lib/ace/runtime/molecules/protected_artifact_set.rb
 - lib/ace/runtime/molecules/protected_linux.rb