ace-runtime 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a1da4bd15724f798d3cf8a885c8f992035904e8bc6d95fb7d3c6a87df2ee729a
-  data.tar.gz: 18d24a182510e477b565a5a1ee91d7bc2367fcb4f017f67843335c5d27b2a266
+  metadata.gz: 1a5a447921ab8d6b478e41a38e6b56866977accc8a75250e394c89c6fa0ac658
+  data.tar.gz: efe75a6544cb3284a9bf544deaaa30975b60971a5c821799666502240442ec7f
 SHA512:
-  metadata.gz: 3b09aa5a8962e7dedaabb1e0da2b0f9079e5b8d9d61015a72408ca66fff68b900fc75f458007ded17a41218a5148f1d0a0bf59c494f11f4784f2333b9bc079a7
-  data.tar.gz: eedb9d9395625b1f0c788586f345e296f2c05e141b5935b25bd02af08cddf975dbf15853830b3b42977e309a05c60f852a798ed2c0e846b00e711b5d6c2f2cba
+  metadata.gz: 46343d278d6041fcd7f41c859207ee0303e28811d156b923bc195b88cf73aef852d3f44b50df62a90425f0cec8a942984504ca9a7c52e4cd9152ffc77679d87a
+  data.tar.gz: b61c518fb64562ddb1975be5b6b71242134f013ec80de029bf259c5d92acdd2572b428f60788e4e4578e7f5f2a59abb3e50ec8664eaa462ceb65482ce3b6857e

data/CHANGELOG.md

@@ -6,6 +6,46 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-10-10
+
+- Ship the protected task-context/worker entry and readiness source used by the current consumers; these required modules were absent from published 0.2.0. Ordinary agent execution remains the ace-llm terminal CLI, with no additional Codex service.
+
+
+- Pin and type-check the original native server's network namespace throughout readiness observation; refuse namespace replacement before returning its identity.
+- Verify dedicated Inbox context-service installations with the full existing isolation and activation profile, exact literal HOST-to-same-VIEW references, fixed interpreter commands and a 35-second stop deadline. Require native executable/dependency bytes and IPC resources to be exact members of the same complete installed profile.
+
+- Expose selected staged boundary topology validation for installer source composition while retaining mandatory live authority socket verification for installed units.
+
+### Fixed
+
+- Accept and validate the original workspace exclusion in the compact prepared worker release, keeping the native gate and authority producer closed schemas consistent.
+
+- Verify protected ancestor directory identity and protection without treating unrelated sibling publication timestamps as selected-artifact mutation; regular-file metadata remains fully pinned.
+
+- Return the protected task-context callback result only after unchanged artifact verification, preserving Bundle responses and raw context text while refusing post-callback mutation.
+
+- Decode systemd InvocationID from its actual typed 16-byte D-Bus array, retaining canonical hexadecimal observations. Strictly verify the fixed manager pidfd-to-unit response and explicitly inherit only the held lifetime descriptor for that method.
+
+- Preserve Ruby already-loaded builtin require no-ops only for the allowlisted startup features verified at first guard activation; later activation cannot grow that authority.
+
+- Resolve guarded Ruby native-extension requests using the selected interpreter platform extension, including explicit `.so`/`.o` aliases, while authenticating only exact declared files.
+
+- Reject duplicate JSON keys, invalid UTF-8, comments and excessive nesting in protected socket frames while preserving exact byte boundaries between successive frames.
+
+- Authenticate the boot-selected private devpts backing and exact instance-local ptmx node before API exemption; shared host views refuse even when read-only. Verify the explicit unit projections and pinned contained ptmx link/node observations.
+
+### Added
+
+- Launch the fixed worker through held interpreter and sealed wrapper descriptors, with bounded original artifact hashes and fixed OpenSSL digest initialization. Native execution remains an installed acceptance requirement.
+
+- Resolve current network installation evidence through a fixed protected slot selection while retaining immutable static profile/producer intent and original historical references.
+
+- Expose a scoped authenticated read-only duplicate of a retained artifact for exact inode handoff; verify before and after callbacks and close on every exit.
+
+- Allow trusted installer code to select a bounded artifact count through `ProtectedArtifactSet.new(count_limit:)`; ordinary callers retain the 256-artifact default and both read interfaces enforce the same budget.
+
+- Verify immutable per-boot original host baseline selections and the fixed readiness configuration/runtime load surface. Collect complete bounded server mount/IPC views through contained pinned descriptors and verify exact original backing plus the authenticated read-only authority socket projection. Trusted domain boot-proof production/refresh and installed effectiveness remain separate obligations.
+
 ## [0.2.0] - 2026-10-05
 
 ### Added

data/docs/usage.md

@@ -232,6 +232,21 @@ represent the access ACL mask, so named non-root ACL users/groups cannot obtain
 write through it. Unknown filesystem models refuse. All ancestors are checked;
 no symlink, untrusted writable ancestor or mutable worker artifact qualifies.
 Content bounds are 1MiB per artifact, 16MiB aggregate and 256 distinct artifacts.
+Trusted installer code verifying a larger explicitly selected source closure can
+construct `ProtectedArtifactSet.new(count_limit: 4096)`; the value must be a
+positive integer supplied by trusted code, never copied from an artifact or
+request. Existing `file_limit:` and `total_limit:` budgets still apply. Mixed
+`read!`/`read_path!` calls share the count; repeating a retained reference spends
+no additional entry, and the first new artifact beyond the limit refuses.
+Trusted source installers can use `with_readonly_handle!(reference)` inside an
+active `ProtectedArtifactSet#with` callback to hand off the authenticated retained
+regular file. It yields a read-only duplicate without reopening the selected
+pathname, verifies the held set before and after the callback, and closes the
+duplicate on success or error. No descriptor or maintenance authority survives
+the callback. Existing reference/budget/root protection rules still apply.
+
+Network evidence verifiers retain their default budgets. Held descriptors also
+require sufficient process file-descriptor capacity in the installer environment.
 The profile's 256-entry bound counts its four outer collections only; nested
 ranges, ports and helper/configuration refs are bounded by the profile bytes and
 separate artifact graph limits. Strict JSON parsing requires the declared
@@ -255,3 +270,43 @@ Root installation lifetime, private admission CAS, stage joins,
 namespace containment and maintenance ordering belong to their respective
 installed owners; this verifier does not implement them or supply native,
 packet-filter or installed acceptance by itself.
+
+### Original boot proof and fixed live readiness views
+
+`ExecutionBootBaseline#select!(expected:)` authenticates the fixed protected
+per-slot publication pointer at provisioning and returns its immutable proof
+reference. `#verify!(selection:, expected:)` reads only that original reference,
+joining whole-file bytes, slot, original boot, mapping digest, root PID1 birth
+context and exact original network installer artifact. It never discovers an old
+namespace or substitutes a current pointer. Proof JSON is closed and at most
+16KiB. Trusted host capture, per-boot refresh and cold-start admission inhibition
+remain domain gad.8/gad.b producer obligations.
+
+`ServerResourceObservation` uses the same-UID native server's pinned root and
+namespace descriptors without entering or changing a namespace. It reports the
+complete mount table (at most256 rows), fixed API/tmp view mount IDs obtained from
+contained O_PATH descriptors, server/hook IPC identities and the exact authority
+socket identity. It also holds the original server’s `/proc/<pid>/ns/net` object,
+requires the nsfs network-namespace type and rechecks its identity after collection.
+The report includes that observed `network_namespace_identity`; it never substitutes
+the hook’s namespace or a configured namespace identity. The private report shares
+a65,536-byte ceiling. Mount path
+prefixes, typed isolation flags and filesystem names alone do not prove live
+isolation. `KernelViewTopology` verifies the fixed supported profile, read-only
+API views, private IPC host difference and exact writable original backing;
+unknown writable aliases and even declared writable API descendants refuse.
+
+The fixed unit exposes only the selected read-only source-equals-view authority
+socket and has `BindLogSockets=false`. Protected endpoint type/owner/incarnation,
+contained view identity and authenticated peer remain separate required joins.
+These observations supply admission evidence, not terminality or installed
+effectiveness.
+The supported devpts profile additionally requires an authenticated per-slot
+`newinstance` backing, distinct from original host devpts. The trusted boot
+baseline pins original host and selected instance identities plus the exact host
+`pts/ptmx` link. The unit binds the selected root at `/dev/pts` and its read-only
+ptmx node at `/dev/pts/ptmx`; the contained observer verifies the unchanged link,
+character device and actual mount identity. `PrivateDevices` alone cannot prove
+this isolation. Shared host RO/RW views and another slot's backing refuse.
+gad.8 provisioning and gad.b refresh must deliver the selected source before
+activation; controlled tests do not establish installed effectiveness.

data/lib/ace/runtime/molecules/codex_runtime_installation.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+module Ace
+  module Runtime
+    module Molecules
+      # Private specialization of the SAME immutable/effective installation owner.
+      class ExecutionUnitInstallation
+        CODEX_TOKEN = /\A[A-Za-z0-9][A-Za-z0-9._-]{0,127}\z/.freeze
+        CODEX_INTENT_FIELDS = %w[codex credentials cwd dependencies environment home inbox_context_id native_mapping_id project_id schema socket_gid socket_path thread_configuration unit_name].freeze
+
+        private
+
+        def initialize_codex_runtime(service, reference, mapping, mapping_id, authority, files)
+          unless service.is_a?(Hash) && service.keys.sort == %w[boundary_manifest execution_scope unit_manifest] &&
+              mapping.is_a?(Hash) && mapping_id.is_a?(String) && SystemdScopeManager::UNIT.match?(mapping_id)
+            raise RuntimeUnavailableError, "Codex service selection differs"
+          end
+          [reference, *service.values_at("unit_manifest", "boundary_manifest")].each { |ref| codex_reference!(ref, 65_536) }
+          bytes = files.read(reference.fetch("path"), limit: reference.fetch("bytes"))
+          unless bytes.bytesize == reference.fetch("bytes") && Digest::SHA256.hexdigest(bytes) == reference.fetch("sha256")
+            raise RuntimeUnavailableError, "Codex intent bytes differ"
+          end
+          intent = JSON.parse(bytes, create_additions: false, max_nesting: 32, allow_duplicate_key: false, allow_comments: false)
+          unless intent.is_a?(Hash) && intent.keys.sort == CODEX_INTENT_FIELDS.sort &&
+              intent["schema"] == "lab.codex-runtime-intent/v1" &&
+              intent.values_at("project_id", "native_mapping_id", "cwd") == [mapping.fetch("project_id"), mapping_id, mapping.fetch("worker_cwd")] &&
+              intent["unit_name"].is_a?(String) && SystemdScopeManager::UNIT.match?(intent["unit_name"]) && intent["unit_name"].end_with?(".service") &&
+              intent["credentials"] == {"uid" => mapping.fetch("worker_uid"), "gid" => mapping.fetch("worker_gid"), "groups" => mapping.fetch("worker_groups")}
+            raise RuntimeUnavailableError, "Codex intent original mapping differs"
+          end
+          credentials = intent.fetch("credentials")
+          unless credentials.values_at("uid", "gid").all? { |id| id.is_a?(Integer) && id.positive? && id <= (1 << 32) - 2 } &&
+              credentials["groups"].is_a?(Array) && credentials["groups"].size <= 64 &&
+              credentials["groups"] == credentials["groups"].sort.uniq &&
+              credentials["groups"].all? { |id| id.is_a?(Integer) && id.between?(0, (1 << 32) - 2) }
+            raise RuntimeUnavailableError, "Codex original native credentials differ"
+          end
+          original = mapping.fetch("execution_scope")
+          scope = service.fetch("execution_scope")
+          changes = %w[service_unit unit_manifest_sha256]
+          unless scope.is_a?(Hash) && scope.keys.sort == %w[backend boundary_manifest_sha256 network_namespace_path root_directory runtime_directory service_unit slice_unit slot_id unit_manifest_sha256] &&
+              scope["backend"] == "linux_systemd_cgroup_v2" && scope.keys.sort == original.keys.sort &&
+              scope.reject { |key, _| changes.include?(key) } == original.reject { |key, _| changes.include?(key) } &&
+              scope["service_unit"] == intent.fetch("unit_name") && scope["service_unit"] != original.fetch("service_unit") &&
+              scope["unit_manifest_sha256"] == service.fetch("unit_manifest").fetch("sha256") &&
+              scope["boundary_manifest_sha256"] == service.fetch("boundary_manifest").fetch("sha256")
+            raise RuntimeUnavailableError, "Codex service expands original containment"
+          end
+          codex_reference!(intent.fetch("codex"), 268_435_456)
+          dependencies = intent.fetch("dependencies")
+          unless dependencies.is_a?(Array) && dependencies.size <= 506 && ([intent.fetch("codex")] + dependencies).map { |ref| ref.fetch("path") }.uniq.size == dependencies.size + 1
+            raise RuntimeUnavailableError, "Codex selected dependency inventory differs"
+          end
+          dependencies.each { |ref| codex_reference!(ref, 268_435_456) }
+          unless ([intent.fetch("codex")] + dependencies).sum { |ref| ref.fetch("bytes") } <= 268_435_456 &&
+              path?(intent["cwd"]) && path?(intent["home"]) && path?(intent["socket_path"]) &&
+              intent["socket_path"].encoding == Encoding::UTF_8 && intent["socket_path"].valid_encoding? && intent["socket_path"].bytesize <= 107 &&
+              intent["socket_gid"].is_a?(Integer) && intent["socket_gid"].between?(1, (1 << 32) - 2) &&
+              intent["inbox_context_id"].is_a?(String) && CODEX_TOKEN.match?(intent["inbox_context_id"]) &&
+              intent["thread_configuration"].is_a?(Hash) && intent["thread_configuration"].keys.sort == %w[approval_policy model sandbox] &&
+              intent["thread_configuration"].values_at("approval_policy", "sandbox") == ["never", "danger-full-access"] &&
+              intent["thread_configuration"]["model"].is_a?(String) && CODEX_TOKEN.match?(intent["thread_configuration"]["model"])
+            raise RuntimeUnavailableError, "Codex runtime input bounds differ"
+          end
+          environment = intent.fetch("environment")
+          unless environment.is_a?(Hash) && environment.size <= 32 && environment.all? { |key, value|
+            NATIVE_ENVIRONMENT.include?(key) && value.is_a?(String) && value.encoding == Encoding::UTF_8 &&
+              value.valid_encoding? && value.bytesize <= 4096 && !value.include?("\0") } &&
+              (!environment.key?("HOME") || environment["HOME"] == intent.fetch("home"))
+            raise RuntimeUnavailableError, "Codex runtime environment differs"
+          end
+          @codex_service, @codex_intent = immutable_selection(service), immutable_selection(intent)
+          @codex_intent_reference, @codex_authority = immutable_selection(reference), immutable_selection(authority)
+          @scope, @files = immutable_selection(scope), files
+          @worker_uid, @worker_gid, @codex_groups = credentials.values_at("uid", "gid", "groups")
+          @codex_groups = immutable_selection(@codex_groups)
+        rescue KeyError, TypeError, NoMethodError, ArgumentError, JSON::ParserError
+          raise RuntimeUnavailableError, "Codex installation selection is incomplete"
+        end
+
+        def codex_reference!(ref, limit)
+          unless ref.is_a?(Hash) && ref.keys.sort == %w[bytes path sha256] && path?(ref["path"]) &&
+              ref["bytes"].is_a?(Integer) && ref["bytes"].between?(1, limit) &&
+              ref["sha256"].is_a?(String) && ref["sha256"].match?(/\A[0-9a-f]{64}\z/)
+            raise RuntimeUnavailableError, "Codex immutable reference differs"
+          end
+        end
+
+        def codex_reference_bytes!(ref)
+          bytes = @files.read(ref.fetch("path"), limit: ref.fetch("bytes"))
+          unless bytes.bytesize == ref.fetch("bytes") && Digest::SHA256.hexdigest(bytes) == ref.fetch("sha256")
+            raise RuntimeUnavailableError, "Codex selected artifact bytes differ"
+          end
+          bytes
+        end
+
+        def verify_codex_artifacts!(roles)
+          {"native_executable" => @codex_intent.fetch("codex"), "native_configuration" => @codex_intent_reference,
+            "boundary_manifest" => @codex_service.fetch("boundary_manifest")}.each do |role, ref|
+            artifact = roles.fetch(role).first
+            unless artifact.values_at("host_path", "view_path", "sha256") == ref.values_at("path", "path", "sha256") &&
+                codex_reference_bytes!(ref).bytesize == ref.fetch("bytes")
+              raise RuntimeUnavailableError, "Codex artifact differs from original selection"
+            end
+          end
+          unless roles.fetch("runtime_dependency", []).size == @codex_intent.fetch("dependencies").size
+            raise RuntimeUnavailableError, "Codex installed dependency inventory differs"
+          end
+          @codex_intent.fetch("dependencies").each do |ref|
+            selected = roles.fetch("runtime_dependency", []).select { |artifact| artifact.values_at("host_path", "view_path", "sha256") == ref.values_at("path", "path", "sha256") }
+            unless selected.one? && codex_reference_bytes!(ref).bytesize == ref.fetch("bytes")
+              raise RuntimeUnavailableError, "Codex selected dependency is not installed"
+            end
+          end
+          roles
+        end
+
+        def verify_codex_protocol!(service, artifacts)
+          executable = @codex_intent.fetch("codex").fetch("path")
+          verify_command!(service.fetch("ExecStartEx"), executable)
+          expected = @codex_intent.fetch("environment").merge("HOME" => @codex_intent.fetch("home")).map { |key, value| "#{key}=#{value}" }.sort
+          unless service.fetch("ExecStartEx").first[1] == [executable, "app-server", "--listen", "unix://" + @codex_intent.fetch("socket_path")] &&
+              service.fetch("ExecStartPostEx") == [] && service.fetch("Environment").sort == expected
+            raise RuntimeUnavailableError, "Codex unit commands differ from fixed startup protocol"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/runtime/molecules/execution_boot_baseline.rb

@@ -0,0 +1,134 @@
+# frozen_string_literal: true
+require "json"
+require_relative "protected_artifact_set"
+
+module Ace
+  module Runtime
+    module Molecules
+      # Content authentication over the existing trusted host installer proof.
+      # Actual original-host capture and boot refresh belong to gad.8/gad.b.
+      class ExecutionBootBaseline
+        LIMIT = 16_384
+        ID = /\A[A-Za-z0-9][A-Za-z0-9._-]{0,127}\z/
+        SHA = /\A[0-9a-f]{64}\z/
+        BOOT = /\A[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z/
+        EXPECTED = %w[boot_id deployment_digest installer_artifact slot_id].freeze
+        FIELDS = %w[boot_id deployment_digest host_devpts_identity host_ipc_namespace_identity host_ptmx_link original_host_context producer_artifact schema selected_devpts slot_id].freeze
+
+        def initialize(artifacts: ProtectedArtifactSet.new)
+          @artifacts = artifacts
+        end
+
+        # Fresh provisioning only. Never called for historical authentication.
+        def select!(expected:)
+          expected!(expected)
+          @artifacts.with do
+            path = "/etc/ace/execution-slots/#{expected.fetch('slot_id')}/boot-baseline-selection.json"
+            bytes, = @artifacts.read_path!(path, limit: LIMIT)
+            pointer = json!(bytes)
+            object!(pointer, %w[baseline schema slot_id])
+            refuse! unless pointer["schema"] == "ace.execution-boot-selection/v1" && pointer["slot_id"] == expected.fetch("slot_id")
+            selected = pointer.fetch("baseline")
+            baseline = authenticate!(selected, expected)
+            @artifacts.verify_unchanged!
+            immutable({"selection" => selected, "baseline" => baseline})
+          end
+        rescue KeyError, TypeError, NoMethodError, ArgumentError, IOError, SystemCallError, JSON::ParserError
+          refuse!
+        end
+
+        # Pure original-ref reader: expected boot comes from canonical lineage,
+        # not current discovery. Runtime owners separately check current boot.
+        def verify!(selection:, expected:)
+          expected!(expected)
+          @artifacts.with do
+            value = authenticate!(selection, expected)
+            @artifacts.verify_unchanged!
+            immutable(value)
+          end
+        rescue KeyError, TypeError, NoMethodError, ArgumentError, IOError, SystemCallError, JSON::ParserError
+          refuse!
+        end
+
+        private
+
+        def authenticate!(selected, expected)
+          reference!(selected, limit: LIMIT)
+          reference!(expected.fetch("installer_artifact"))
+          value = json!(@artifacts.read!(selected))
+          object!(value, FIELDS)
+          reference!(value.fetch("producer_artifact"))
+          unless value["schema"] == "ace.execution-boot-baseline/v1" &&
+              value.values_at("boot_id", "deployment_digest", "slot_id") == expected.values_at("boot_id", "deployment_digest", "slot_id") &&
+              value["producer_artifact"] == expected.fetch("installer_artifact")
+            refuse!
+          end
+          @artifacts.read!(expected.fetch("installer_artifact"))
+          identity = value.fetch("host_ipc_namespace_identity")
+          object!(identity, %w[device inode])
+          refuse! unless identity.values.all? { |number| number.is_a?(Integer) && number.positive? }
+          host = value.fetch("host_devpts_identity")
+          selected = value.fetch("selected_devpts")
+          object!(host, %w[device inode major_minor])
+          object!(selected, %w[device inode major_minor path ptmx_inode])
+          [host, selected].each do |instance|
+            refuse! unless %w[device inode].all? { |key| instance[key].is_a?(Integer) && instance[key].positive? } &&
+              instance["major_minor"].is_a?(String) && instance["major_minor"].match?(/\A(?:0|[1-9][0-9]*):(?:0|[1-9][0-9]*)\z/)
+          end
+          refuse! unless value["host_ptmx_link"] == "pts/ptmx" &&
+            selected["path"] == "/run/ace/execution-slots/#{expected.fetch('slot_id')}/devpts" &&
+            selected["device"] != host["device"] && selected["major_minor"] != host["major_minor"] &&
+            selected["ptmx_inode"].is_a?(Integer) && selected["ptmx_inode"].positive?
+          context = value.fetch("original_host_context")
+          object!(context, %w[gid pid started_at uid])
+          unless context.values_at("pid", "uid", "gid").all? { |number| number.is_a?(Integer) } &&
+              context.values_at("pid", "uid", "gid") == [1, 0, 0] && context["started_at"].is_a?(String) &&
+              context["started_at"].match?(/\Alinux:#{Regexp.escape(expected.fetch('boot_id'))}:(?:0|[1-9][0-9]*)\z/) &&
+              context["started_at"].bytesize <= 128
+            refuse!
+          end
+          value
+        end
+
+        def expected!(value)
+          object!(value, EXPECTED)
+          refuse! unless value["slot_id"].is_a?(String) && ID.match?(value["slot_id"]) &&
+            value["boot_id"].is_a?(String) && BOOT.match?(value["boot_id"]) &&
+            value["deployment_digest"].is_a?(String) && SHA.match?(value["deployment_digest"])
+          reference!(value.fetch("installer_artifact"))
+        end
+
+        def reference!(value, limit: ProtectedArtifactSet::LIMIT)
+          object!(value, %w[bytes path sha256])
+          refuse! unless value["path"].is_a?(String) && value["path"].bytesize.between?(1, 4096) &&
+            value["path"].start_with?("/") && !value["path"].include?("\0") && File.expand_path(value["path"]) == value["path"] &&
+            value["bytes"].is_a?(Integer) && value["bytes"].between?(1, limit) &&
+            value["sha256"].is_a?(String) && SHA.match?(value["sha256"])
+        end
+
+        def json!(bytes)
+          bytes = bytes.dup.force_encoding(Encoding::UTF_8)
+          refuse! unless bytes.bytesize.between?(1, LIMIT) && bytes.valid_encoding?
+          JSON.parse(bytes, create_additions: false, max_nesting: 8, allow_duplicate_key: false, allow_comments: false)
+        end
+
+        def object!(value, keys)
+          refuse! unless value.is_a?(Hash) && value.keys.sort == keys.sort
+        end
+
+        def immutable(value)
+          case value
+          when Hash then value.to_h { |key, item| [key.dup.freeze, immutable(item)] }.freeze
+          when Array then value.map { |item| immutable(item) }.freeze
+          when String then value.dup.freeze
+          else value
+          end
+        end
+
+        def refuse!
+          raise RuntimeUnavailableError, "authenticated original host boot baseline unavailable"
+        end
+      end
+    end
+  end
+end

data/lib/ace/runtime/molecules/execution_network_selection.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+require "json"
+require_relative "protected_artifact_set"
+
+module Ace
+  module Runtime
+    module Molecules
+      # Current selection only. Original canonical bindings retain literal refs
+      # and authenticate through NetworkInstallationEvidence without this pointer.
+      class ExecutionNetworkSelection
+        LIMIT = 65_536
+        FIELDS = %w[installer_artifact policy_export profile report].freeze
+
+        def initialize(artifacts: ProtectedArtifactSet.new)
+          @artifacts = artifacts
+        end
+
+        # Shape validation confers no pointer access or network admission proof.
+        def self.validate_static!(selection, slot_id:)
+          new.send(:static!, selection, slot_id)
+        end
+
+        def select!(static_selection:, slot_id:)
+          static_selection = immutable(static_selection)
+          path = static!(static_selection, slot_id)
+          @artifacts.with do
+            bytes, = @artifacts.read_path!(path, limit: LIMIT)
+            bytes = bytes.dup.force_encoding(Encoding::UTF_8)
+            refuse! unless bytes.valid_encoding? && bytes.bytesize.between?(1, LIMIT)
+            pointer = JSON.parse(bytes, create_additions: false, max_nesting: 16, allow_duplicate_key: false, allow_comments: false)
+            object!(pointer, %w[schema selection slot_id])
+            refuse! unless pointer["schema"] == "ace.network-installation-selection/v1" && pointer["slot_id"] == slot_id
+            selection = pointer.fetch("selection")
+            object!(selection, FIELDS)
+            selection.each_value { |ref| reference!(ref) }
+            refuse! unless %w[profile installer_artifact].all? { |name| selection.fetch(name) == static_selection.fetch(name) }
+            selection.each_value { |ref| @artifacts.read!(ref) }
+            @artifacts.verify_unchanged!
+            immutable(selection)
+          end
+        rescue KeyError, TypeError, NoMethodError, ArgumentError, IOError, SystemCallError, JSON::ParserError, EncodingError
+          refuse!
+        end
+
+        private
+
+        def static!(selection, slot_id)
+          object!(selection, %w[current_selection_path installer_artifact profile])
+          refuse! unless slot_id.is_a?(String) && slot_id.match?(/\A[A-Za-z0-9][A-Za-z0-9._-]{0,127}\z/)
+          path = "/etc/ace/execution-slots/#{slot_id}/network-installation-selection.json"
+          refuse! unless selection.fetch("current_selection_path") == path
+          %w[profile installer_artifact].each { |name| reference!(selection.fetch(name)) }
+          path
+        rescue KeyError, TypeError, NoMethodError, ArgumentError
+          refuse!
+        end
+
+        def reference!(value)
+          object!(value, %w[bytes path sha256])
+          path = value.fetch("path")
+          refuse! unless path.is_a?(String) && path.bytesize.between?(1, 4096) && path.start_with?("/") &&
+            !path.include?("\0") && File.expand_path(path) == path && value["bytes"].is_a?(Integer) &&
+            value["bytes"].between?(1, ProtectedArtifactSet::LIMIT) && value["sha256"].is_a?(String) &&
+            value["sha256"].match?(/\A[0-9a-f]{64}\z/)
+        end
+
+        def object!(value, keys)
+          refuse! unless value.is_a?(Hash) && value.keys.sort == keys.sort
+        end
+
+        def immutable(value)
+          case value
+          when Hash then value.to_h { |key, item| [key.dup.freeze, immutable(item)] }.freeze
+          when String then value.dup.freeze
+          else value
+          end
+        end
+
+        def refuse!
+          raise RuntimeUnavailableError, "protected current network selection unavailable"
+        end
+      end
+    end
+  end
+end