ace-runtime 0.4.0 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 95299eb06854907e2402041c388ca25b234b24e220acf2c13911c746b84f3c6b
-  data.tar.gz: 9e6cf1b53df631d5a2e764b5deff50d5a34b0d2491d3f5be1fc2ec17ff6b30db
+  metadata.gz: 9b9c53bb970a918797a57b7aa00c36587a8da5420944cca83cee41a6f6ae2792
+  data.tar.gz: 4c4486463938f67ce14882472ede27fd96016a95c92a60d38a85fa60e5e87027
 SHA512:
-  metadata.gz: cfe0a30fdcb212c43d6e9633877aaf3ae35ddb115819066ca3c7b6f30205f916bf33f22afdf9087d4395d595a192807fa3c98ce922ddf1f912bf35a3550048f6
-  data.tar.gz: a2e00a11a779cfc017e782617a5823a315ff379f6b3c6f434720df0d252e7dd086b8abf73dd491b4e16dbb7223055773181370def9f5ffcf618f718563e9ec67
+  metadata.gz: 3b02211e6604c9b51ea8e2e294dac5678cad47b52f0b1b1e5fc971888bed07876974a16a3eb0178b5d4551f274b2559aba374e4ec8c578121a99ec6f888b0795
+  data.tar.gz: f36be2a74247d133b118cdfdbe58e24628f8051b262848e171523a6897c4bfd99d503cdac0de5c87f182c4c2179051ca4c01f64ed71a2fda3b310ba83496ca05

data/CHANGELOG.md

@@ -6,6 +6,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [0.4.1] - 2026-10-18
+
+### Changed
+
+- Validate execution-scope unit names with the existing systemd unit shape, `.slice`/`.service` suffix and effective isolation checks only. A unit name that contains a role word such as `overseer` is no longer rejected: a role label is not a security boundary, and the real checks stay unchanged.
+
 ## [0.4.0] - 2026-10-16
 
 ### Added

data/README.md

@@ -1,8 +1,13 @@
 # ace-runtime
 
-Runtime-neutral terminal intent contract for ACE (spec 8wq.t.k86.0). One
+> **State owner:** none. `ace-runtime` is a stateless terminal intent contract;
+> tmux/Herdr adapters own only terminal transport. Task, assignment, and HITL
+> state belong to `.ace-tasks/` and the local stores under `.ace-local/`
+> ([docs/lab-flow.md](../docs/lab-flow.md)).
+
+Runtime-neutral terminal intent contract for ACE. One
 duck-typed intent API that terminal runtimes implement and all consumers
-call — the structural change that makes herdr an equal partner to tmux
+call -- the structural change that makes herdr an equal partner to tmux
 instead of a side gem.
 
 Adapters live INSIDE the existing wrapper gems: `ace-tmux` and `ace-herdr`
@@ -17,22 +22,22 @@ Eleven operations, keyword-arg surfaces mirroring today's consumer calls:
 | Operation | Surface |
 |-----------|---------|
 | Context | `runtime.context` → `{in_runtime:, session:, window:, pane:}` |
-| Ensure window | `runtime.ensure_window(name:, root:, preset: nil)` — idempotent by normalized name; conflicting root/preset raises `WindowConflictError` |
+| Ensure window | `runtime.ensure_window(name:, root:, preset: nil)` -- idempotent by normalized name; conflicting root/preset raises `WindowConflictError` |
 | Process identity | `runtime.process_binding(pane:, caller_pid:)` → verified owner/native binding or nil (unknown); read-only, no authorization |
-| Prepare pane | `runtime.prepare_pane(window:)` — splits when needed; target stays alive after a submitted command exits |
+| Prepare pane | `runtime.prepare_pane(window:)` -- splits when needed; target stays alive after a submitted command exits |
 | Focus | `runtime.focus(window:)` |
-| Send | `runtime.send(pane:, command: nil, items: [])` — ordered `{message: String}` / `{key: String}` entries |
+| Send | `runtime.send(pane:, command: nil, items: [])` -- ordered `{message: String}` / `{key: String}` entries |
 | Capture | `runtime.capture(pane:, lines: 40)` → text |
 | Wait output | `runtime.wait_output(pane:, pattern:, timeout:)` |
 | Wait agent | `runtime.wait_agent(pane:, states:, timeout:)` |
-| Wait lifecycle | `runtime.wait_lifecycle(condition:, target:, timeout:)` — `window-exits`/`window-active`/`pane-exists`/`pane-exited` observations only |
+| Wait lifecycle | `runtime.wait_lifecycle(condition:, target:, timeout:)` -- `window-exits`/`window-active`/`pane-exists`/`pane-exited` observations only |
 | Close | `runtime.close_window(window:)` |
 | List | `runtime.list_windows` / `runtime.list_panes(window:)` |
 
 Convenience shapes: `send_command(pane:, command:)`,
 `send_text(pane:, text:)`, `send_keys(pane:, keys:)`.
 
-Target identity is opaque adapter-owned handles at every boundary — the
+Target identity is opaque adapter-owned handles at every boundary -- the
 contract never predicts or formats pane ids (tmux `%id` and herdr
 `w1:p1` stay adapter-internal). Window operations take the (sanitized)
 window name; pane operations take the handle returned by the adapter.
@@ -52,30 +57,33 @@ CLI/runtime selection precedence (highest wins):
 
 1. explicit name (`ace-runtime send --runtime herdr`)
 2. `ACE_RUNTIME` environment (consumer forks set this plus target context)
-3. configured runtime — `.ace/runtime/config.yml` key `runtime`
+3. configured runtime -- `.ace/runtime/config.yml` key `runtime`
 4. auto-detection from the environment (`TMUX` / `ACE_TMUX_SESSION`, or
    `HERDR_SESSION` + `HERDR_PANE`). When both are live, tmux wins
    (existing default). Only assign auto launch mode selects headless
    outside any runtime; that decision lives above this contract.
 
 An explicitly selected runtime that turns out unknown or unavailable
-fails closed — never a silent switch or headless downgrade.
+fails closed -- never a silent switch or headless downgrade.
 
 ## Send matrix
 
 `send` is the only submission primitive; the granular ops are shapes of
-it. `items` is an ORDERED list — the only shape that preserves
+it. `items` is an ORDERED list -- the only shape that preserves
 message/key interleaving. When `command` is present, `items` holds
 exclusively post-command keys; leading keys are a usage error before any
 transport call (the CLI enforces `--cmd` before every `--key`).
 
 - **Plain-pane adapters** (`send_profile == :plain_pane`, e.g. tmux):
+
   messages are raw text (no implicit submission), keys are keystrokes,
   each Enter submits pending text; `command` submits once, then trailing
   keys deliver.
+
 - **Agent-aware adapters** (`send_profile == :agent_aware`, e.g. herdr):
+
   `command` or the concatenated messages become ONE prompt that submits
-  itself (message-only input DOES submit once on agent panes — intended
+  itself (message-only input DOES submit once on agent panes -- intended
   divergence); at most one trailing Enter is dropped and reported via
   the result; keys-only sequences go to agent keys; every other
   interleaving is rejected before any transport call.
@@ -87,16 +95,18 @@ profiles.
 
 All failures subclass `Ace::Runtime::Error`:
 
-- `UnknownRuntimeError` — with the sorted available list
-- `RuntimeUnavailableError` — known runtime, unusable right now
-- `TargetNotFoundError` — window/pane target does not exist
-- `WindowConflictError` — same normalized name, incompatible root/preset
-- `SendRejectedError` — pre-send rejection; terminal, no transport call
-- `SendStalledError` — submission accepted but the target never started
+- `UnknownRuntimeError` -- with the sorted available list
+- `RuntimeUnavailableError` -- known runtime, unusable right now
+- `TargetNotFoundError` -- window/pane target does not exist
+- `WindowConflictError` -- same normalized name, incompatible root/preset
+- `SendRejectedError` -- pre-send rejection; terminal, no transport call
+- `SendStalledError` -- submission accepted but the target never started
+
   processing; OUTCOME UNCERTAIN, callers must not auto-resend
-- `WaitTimeoutError` — a wait exceeded its deadline (seconds context)
 
-`pane-exited` is a runtime observation only — never assignment success,
+- `WaitTimeoutError` -- a wait exceeded its deadline (seconds context)
+
+`pane-exited` is a runtime observation only -- never assignment success,
 receipt confirmation, or prune authorization.
 
 ## Adapter contract
@@ -110,12 +120,16 @@ Ace::Runtime.register(:<name>, -> { Ace::Tmux::RuntimeAdapter.new })
 ```
 
 The contract resolves an unregistered known name by attempting to load
-that entrypoint lazily — no gem dependency in either direction.
+that entrypoint lazily -- no gem dependency in either direction.
 
 The packaged shared suite `Ace::Runtime::Testing::AdapterContract` is
 the acceptance bar for ANY adapter. See `docs/usage.md` for the
 adapter-authoring walkthrough.
 
+> **Planned (L2):** retirement or redesign of the legacy native bootstrap
+> artifacts under `native/` -- not available yet. They are not required by the
+> file-based flow.
+
 Note: adapters intentionally define `send` (the intent operation),
 which overrides `Object#send`. Use `__send__` for reflective dispatch
 on adapter objects.

data/docs/usage.md

@@ -30,15 +30,22 @@ ace-runtime send --pane %1 --cmd 'vim .' --key C-w
 Rules enforced before any transport call:
 
 - `--pane` is required; at least one of `--cmd`, `--msg`, `--key` is
+
   required (none = usage error).
-- `--key` before `--cmd` is a usage error — `--cmd` must be declared
+
+- `--key` before `--cmd` is a usage error -- `--cmd` must be declared
+
   before every key. Keys declared after `--cmd` are post-submission
   keystrokes.
+
 - The CLI builds direct-API items as all supplied messages followed by
+
   all supplied keys. Direct Ruby callers use `send(items:)` when they
   need arbitrary interleaving (for example `msg, key, msg` on plain
   panes).
+
 - On agent panes (`:agent_aware` profile) the callback shapes submit
+
   exactly once: `--msg ... --key Enter` becomes one self-submitting
   prompt with the trailing Enter dropped and reported; interleaved
   items, multiple Enters, `--cmd` with messages, and `--cmd` with
@@ -87,7 +94,7 @@ name)`; an existing window with an incompatible root or preset raises
 `WindowConflictError` instead of silently reusing the wrong worktree.
 
 `wait_lifecycle` accepts only `window-exists`, `window-active`,
-`pane-exists`, `pane-exited`. It reports the condition only — never
+`pane-exists`, `pane-exited`. It reports the condition only -- never
 authorizes completion, receipts, or pruning. `pane-exited` in
 particular is an observation, not assignment success or safe prune
 evidence.
@@ -105,14 +112,14 @@ evidence.
 
 Explicit selections never downgrade: unknown names fail closed with
 the available list (`UnknownRuntimeError`); a selected-but-unavailable
-runtime raises `RuntimeUnavailableError` — no headless fallback, no
+runtime raises `RuntimeUnavailableError` -- no headless fallback, no
 silent switch. The assign auto launch mode is the only consumer that
 selects headless outside any runtime, and it does so above this
 contract.
 
 ## Adapter authoring
 
-Adapters are duck-typed — no base class (ace-hitl provider-registry
+Adapters are duck-typed -- no base class (ace-hitl provider-registry
 pattern). An adapter package:
 
 1. declares a dependency on `ace-runtime` (never the reverse),
@@ -140,11 +147,16 @@ Non-negotiables enforced by the contract suite:
 
 - target handles stay opaque at every public boundary,
 - `prepare_pane` yields a writable live shell/agent target retained
+
   after a submitted command exits (bare command panes do not satisfy
   preparation),
+
 - `detect` and adapter availability checks are side-effect-free; an
+
   unavailable explicit runtime never becomes headless,
+
 - installed tests must verify both runtimes; never assert untested
+
   behavior.
 
 ### The acceptance bar
@@ -170,7 +182,7 @@ class TmuxAdapterContractTest < AceTestCase
 end
 ```
 
-The suite drives your adapter over `ScriptedRuntime` — an in-memory
+The suite drives your adapter over `ScriptedRuntime` -- an in-memory
 terminal (windows, panes, raw text writes, named keys, capture, agent
 state) that records every mutation op so the suite can assert delivery
 ordering and rejection-before-transport. Wire your adapter's native
@@ -188,125 +200,10 @@ in the ace-runtime gem; the in-gem suite
 (`test/contract/adapter_contract_test.rb`) proves the battery against
 it for both send profiles.
 
-## Root-produced network installation evidence
-
-The source-only `Ace::Runtime::Molecules::NetworkInstallationEvidence` consumer
-checks the protected content selected by the installed scope owner:
-
-```ruby
-result = Ace::Runtime::Molecules::NetworkInstallationEvidence.verify!(
-  selection: boundary_manifest.fetch("network_installation"),
-  expected: {
-    "slot_id" => slot_id,
-    "namespace_path" => installed_namespace_path,
-    "boot_id" => current_boot_id,
-    "namespace_identity" => {"device" => pinned_device, "inode" => pinned_inode},
-    "installer_artifact_sha256" => installed_producer_sha256
-  }
-)
-```
+## Native bootstrap and network evidence (legacy)
 
-`selection` is exactly `{profile,policy_export,report,installer_artifact}`; each
-reference is exactly `{path,sha256,bytes}`. All keys are strings, paths canonical
-and absolute, SHA256 lowercase, and lengths positive integers. There is no
-caller-uploaded evidence or caller-selected trust root. The namespace identity
-above must come from the owner's actual held, authenticated nsfs network object;
-the owner validates its type/current boot and keeps the namespace pinned through
-admission. This verifier reads content artifacts and never opens/substitutes the
-namespace, probes traffic or grants runtime networking privilege.
-
-Successful output contains exactly `report_id`, `boot_id`, `slot_id`,
-`namespace_path`, `namespace_identity`, `profile_sha256`, `policy_export_sha256`,
-`report_sha256` and `installer_artifact_sha256`, deeply frozen. It authenticates
-installation content, not actual enforcement from a summary boolean. Missing,
-unreadable, malformed, conflicting, oversized or context-mismatched evidence
-raises `Ace::Runtime::RuntimeUnavailableError`; the authority boundary exposes
-that refusal as `evidence_unavailable` and retains public `invalid_input`
-classification for malformed public selectors. No absent-evidence fallback.
-
-The reader pins regular-file and directory descriptors for the complete graph,
-checks exact lengths/digests and revalidates original objects/modes at completion.
-It uses root ownership and no group/other write on supported Linux POSIX local
-filesystems (`ext2`, `ext3`, `ext4`, `xfs`, `btrfs`, `tmpfs`): group mode bits
-represent the access ACL mask, so named non-root ACL users/groups cannot obtain
-write through it. Unknown filesystem models refuse. All ancestors are checked;
-no symlink, untrusted writable ancestor or mutable worker artifact qualifies.
-Content bounds are 1MiB per artifact, 16MiB aggregate and 256 distinct artifacts.
-Trusted installer code verifying a larger explicitly selected source closure can
-construct `ProtectedArtifactSet.new(count_limit: 4096)`; the value must be a
-positive integer supplied by trusted code, never copied from an artifact or
-request. Existing `file_limit:` and `total_limit:` budgets still apply. Mixed
-`read!`/`read_path!` calls share the count; repeating a retained reference spends
-no additional entry, and the first new artifact beyond the limit refuses.
-Trusted source installers can use `with_readonly_handle!(reference)` inside an
-active `ProtectedArtifactSet#with` callback to hand off the authenticated retained
-regular file. It yields a read-only duplicate without reopening the selected
-pathname, verifies the held set before and after the callback, and closes the
-duplicate on success or error. No descriptor or maintenance authority survives
-the callback. Existing reference/budget/root protection rules still apply.
-
-Network evidence verifiers retain their default budgets. Held descriptors also
-require sufficient process file-descriptor capacity in the installer environment.
-The profile's 256-entry bound counts its four outer collections only; nested
-ranges, ports and helper/configuration refs are bounded by the profile bytes and
-separate artifact graph limits. Strict JSON parsing requires the declared
-`json >= 2.20, < 3` dependency to reject duplicate keys and comments explicitly.
-
-The trusted domain installer owns complete effective policy/topology comparison,
-independent correlated flow checks, immutable digest-bearing evidence filenames
-and publication that preserves historical artifacts. The generic reference
-schema specifies no basename grammar: this consumer checks selected content and
-protection, and cannot establish publication history. Raw policy/topology/setup
-and correlated observations remain required; unsupported or incomplete domain
-checks must never produce a passing report. Domain source/installed review proves
-those obligations. For each loopback tool, the fixed domain procedure inspects
-the actual selected executable against its profile `artifact_sha256` and retains
-the observation in the exact tool-target trace. The schema provides no executable
-path/ref: generic ACE authenticates the trace/raw refs and digest format; it does
-not compare a tool executable digest with observation bytes or invent a ref.
-Domain acceptance must exercise tool-executable mismatch refusal.
-
-Root installation lifetime, private admission CAS, stage joins,
-namespace containment and maintenance ordering belong to their respective
-installed owners; this verifier does not implement them or supply native,
-packet-filter or installed acceptance by itself.
-
-### Original boot proof and fixed live readiness views
-
-`ExecutionBootBaseline#select!(expected:)` authenticates the fixed protected
-per-slot publication pointer at provisioning and returns its immutable proof
-reference. `#verify!(selection:, expected:)` reads only that original reference,
-joining whole-file bytes, slot, original boot, mapping digest, root PID1 birth
-context and exact original network installer artifact. It never discovers an old
-namespace or substitutes a current pointer. Proof JSON is closed and at most
-16KiB. Trusted host capture, per-boot refresh and cold-start admission inhibition
-remain domain gad.8/gad.b producer obligations.
-
-`ServerResourceObservation` uses the same-UID native server's pinned root and
-namespace descriptors without entering or changing a namespace. It reports the
-complete mount table (at most256 rows), fixed API/tmp view mount IDs obtained from
-contained O_PATH descriptors, server/hook IPC identities and the exact authority
-socket identity. It also holds the original server’s `/proc/<pid>/ns/net` object,
-requires the nsfs network-namespace type and rechecks its identity after collection.
-The report includes that observed `network_namespace_identity`; it never substitutes
-the hook’s namespace or a configured namespace identity. The private report shares
-a65,536-byte ceiling. Mount path
-prefixes, typed isolation flags and filesystem names alone do not prove live
-isolation. `KernelViewTopology` verifies the fixed supported profile, read-only
-API views, private IPC host difference and exact writable original backing;
-unknown writable aliases and even declared writable API descendants refuse.
-
-The fixed unit exposes only the selected read-only source-equals-view authority
-socket and has `BindLogSockets=false`. Protected endpoint type/owner/incarnation,
-contained view identity and authenticated peer remain separate required joins.
-These observations supply admission evidence, not terminality or installed
-effectiveness.
-The supported devpts profile additionally requires an authenticated per-slot
-`newinstance` backing, distinct from original host devpts. The trusted boot
-baseline pins original host and selected instance identities plus the exact host
-`pts/ptmx` link. The unit binds the selected root at `/dev/pts` and its read-only
-ptmx node at `/dev/pts/ptmx`; the contained observer verifies the unchanged link,
-character device and actual mount identity. `PrivateDevices` alone cannot prove
-this isolation. Shared host RO/RW views and another slot's backing refuse.
-gad.8 provisioning and gad.b refresh must deliver the selected source before
-activation; controlled tests do not establish installed effectiveness.
+> The native Linux worker bootstrap, the root-produced network installation
+> evidence, the boot baseline and the kernel view topology readers belong to the
+> replaced protected model. They are not part of the file-based flow and no
+> command, task, or assignment requires them. Their removal/redesign is tracked
+> in L1/L2; treat this package's runtime contract above as the supported surface.

data/lib/ace/runtime/molecules/execution_unit_installation.rb

@@ -299,7 +299,7 @@ module Ace
               %w[root_directory runtime_directory network_namespace_path].all? { |key| path?(scope[key]) } &&
               scope.fetch("runtime_directory").start_with?("/run/") && !overlaps?(scope.fetch("root_directory"), scope.fetch("runtime_directory")) &&
               {"slice_unit" => ".slice", "service_unit" => ".service"}.all? { |key, suffix|
-                scope[key].is_a?(String) && SystemdScopeManager::UNIT.match?(scope[key]) && scope[key].end_with?(suffix) && !scope[key].downcase.include?("overseer")
+                scope[key].is_a?(String) && SystemdScopeManager::UNIT.match?(scope[key]) && scope[key].end_with?(suffix)
               } &&
               scope["unit_manifest_sha256"] == service.fetch("unit_manifest").fetch("sha256") &&
               scope["boundary_manifest_sha256"] == service.fetch("boundary_manifest").fetch("sha256") &&

data/lib/ace/runtime/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Runtime
-    VERSION = "0.4.0"
+    VERSION = "0.4.1"
   end
 end

data/native/README.md

@@ -1,124 +1,13 @@
-# Protected Linux worker bootstrap
-
-The `ace-runtime` gem ships `native/worker_gate.c` and `native/build-worker-gate`.
-This is a Linux executable, not a Ruby interpreter wrapper. Build on the target
-architecture from the installed gem with the system compiler, json-c parser and OpenSSL 3 libcrypto.
-Supported initial architectures are Linux x86_64 and aarch64 with little-endian
-ELF64. A bootstrap built on another architecture fails deployment preflight.
-
-On Debian bookworm install the distribution's `build-essential`, `pkg-config`
-`libjson-c-dev` and `libssl-dev` build packages. The executable requires the matching system
-`libjson-c5`, OpenSSL 3 `libcrypto.so.3` (`libssl3`), libc and ELF loader at runtime. Use the same distribution/architecture
-for build and deployment; retain package versions, source SHA, compiler version,
-ELF machine, `readelf -d` dependencies and output SHA256 in installer evidence.
-These libraries and their loader search directories must remain root-owned and
-non-worker-writable. The pinned Herdr service starts with a clean root-controlled
-environment, so no worker loader/preload environment reaches bootstrap startup.
-
-From the installed gem directory, in a private unprivileged build directory:
-
-```sh
-native/build-worker-gate /absolute/private/build/ace-worker-gate
-sha256sum /absolute/private/build/ace-worker-gate
-readelf -h -d /absolute/private/build/ace-worker-gate
-```
-
-The administrator installs this exact artifact, without setuid/setgid bits:
-
-```sh
-install -o root -g root -m 0755 /absolute/private/build/ace-worker-gate /usr/libexec/ace-worker-gate
-```
-
-All installation ancestors are root-owned and non-worker-writable. The fixed
-root-owned `/etc/ace/assignment-authorities.json` records `bootstrap` and its exact
-`bootstrap_sha256`. ACE verifies digest, ELF architecture, executable permissions,
-ownership and ancestry before reservation. The native layout uses only this
-absolute executable, installed mapping ID and correlation ticket; cwd and environment come from the root-controlled mapping after authority release.
-The mandatory closed `worker_entry` pins interpreter and wrapper references; arbitrary
-worker argv and shebang/PATH execution are not admitted.
-The map grants no UID switching and the binary is never privileged.
-
-The root-installed authority, launcher and native server units require:
-
-```ini
-User=<their distinct mapped account>
-NoNewPrivileges=yes
-CapabilityBoundingSet=
-AmbientCapabilities=
-```
-
-Worker children inherit the server's empty bounds and no-new-privileges policy.
-ACE checks all real/effective/saved/filesystem IDs, supplementary groups, every
-capability set and `NoNewPrivs` from kernel status for all mapped participants,
-including the pinned server. CAP_DAC_OVERRIDE/CAP_SETUID are refused, as is an
-exec context that could gain capabilities or setuid privilege. Yama=2 remains
-mandatory; an empty capability set alone does not stop same-UID injection.
-
-The bootstrap sets non-dumpable before connecting, requires enforced Yama
-`ptrace_scope=2`, requires empty Inh/Prm/Eff/Bnd/Amb capability sets and NoNewPrivs=1, verifies
-worker IDs/groups and its retained actual kernel parent birth, authenticates authority
-SO_PEERCRED and protected socket ancestry, and waits at most 30 seconds on one
-stream. It never reconnects or executes after pre-release EOF, malformed input
-or timeout. A committed release whose response is lost remains potentially
-executed; public inspection must retain ownership rather than resend release.
-
-The gate accepts only the maintained `ace.assign.authorities/v2` mapping. It
-captures its actual parent PID and kernel boot/start-tick birth before reading
-the map, checks that same birth before and after parent credentials, and repeats
-the check before authority admission and immediately before exec. The canonical
-`gate_ready` authority owner associates the actual gate peer and its parent with
-the original recorded child/server; the map supplies no `server_identity`.
-Changed parent birth, reparenting, inaccessible credentials or changed policy
-refuses. The original retained mapping supplies `worker_entry={interpreter:REF,wrapper:REF}`
-in the authenticated release, rather than selecting code from the current map.
-Interpreter references are bounded to 32MiB and wrapper references to 1MiB.
-Both root-protected regular held files are hashed and their metadata rechecked.
-The interpreter must be an executable native ELF. The verified wrapper is copied
-into a memfd sealed against writes/growth/shrinkage, reopened read-only, and the
-writable descriptor dropped. Selected held interpreter FD4 and code FD5 survive
-`fexecve(4, ["/proc/self/fd/4", "-I", "-S", "-B", "/proc/self/fd/5", "authority", "worker"], env)`.
-Inherited stdin/stdout/stderr remain untouched; no provider lifetime timeout is added.
-The retained original source owner inside the wrapper separately validates and
-executes the accepted Ruby snapshot and its package closure.
-
-Release is one compact JSON record containing the original ticket/assignment/
-attempt/generation/commit plus `prepared_input`. That closed object pins the
-original registration generation/commit, definition and original binding digest,
-prepared-work reference, original worker entry pair and exact journal bundle reference/length/SHA256. The
-authority verifies the original bundle before durable issue; subsequent prepared
-fetch authenticates the accepted release pin before returning body bytes. The
-gate validates the closed ten-field pin, including the original workspace exclusion,
-digests and unchanged bounds before exec. The exclusion has five closed fields:
-key, authority UID/GID, readonly root resource and original cwd resource. Each
-resource has the existing eight identity fields. The gate checks integer/path/
-filesystem bounds and exact mapping/view/key association; the retained Ruby owner
-verifies the canonical cwd digest and held filesystem identity before acquiring
-the lifetime reader. This metadata does not itself grant filesystem access.
-The complete encoded release is bounded to16KiB before durable issue and at the gate. It
-does not receive inline work or propagate an input FD to providers. The worker
-uses the existing authenticated original prepared fetch after release.
-
-An ordinary Docker kernel with Yama=0 can verify compilation and fail-closed
-policy rejection. It cannot demonstrate protected launch acceptance. A real
-isolated Linux deployment enforcing the complete policy is required for that
-positive proof; installing this gem does not change host sysctls or install OS
-service/account policy. Downstream gad.8 provisions those requirements and
-consumes this shipped build mechanism.
-
-## Fixed digest initialization and acceptance limits
-
-Before any OpenSSL API call the gate selects `OPENSSL_INIT_NO_LOAD_CONFIG`.
-It creates a private library context, fixes its provider search path to `/dev/null`
-(a non-directory), explicitly loads only `default`, and fetches `SHA256` with
-`provider=default`. Failure refuses execution; no config/engine/module fallback
-is provided. [Initialization semantics](https://docs.openssl.org/3.0/man3/OPENSSL_init_crypto/),
-[provider search path](https://docs.openssl.org/3.0/man3/OSSL_PROVIDER/), and
-[fixed provider property](https://docs.openssl.org/3.0/man7/OSSL_PROVIDER-default/) and
-[libcrypto built-in default provider](https://docs.openssl.org/3.0/man7/crypto/#default-provider)
-are the maintained API basis. The system libcrypto/loader remain in the accepted
-root-controlled OS artifact closure; this does not attest an arbitrary library build.
-
-This source checkpoint does not compile or execute native code. Real ELF,
-OpenSSL linkage/provider availability, memfd seals, retained FD execution and
-Python script/stdlib behavior require installed Linux acceptance. The trusted
-provisioned OS/Python premise remains; no separate Python runtime tree is introduced.
+# Native worker bootstrap (retired from the file-based flow)
+
+The `ace-runtime` gem still ships `native/worker_gate.c` and
+`native/build-worker-gate` from the replaced protected model. They are not part
+of the current file-based flow: no command, task, assignment, or local
+documentation requires the native gate, its authority file, or its admission
+checks.
+
+Do not treat this directory as an owner of execution state. The supported
+`ace-runtime` surface is the terminal intent contract described in the
+[README](../README.md) and [usage](../docs/usage.md). Removal or redesign of the
+native bootstrap is tracked with the L1/L2 cleanup; this note keeps the
+historical source discoverable without presenting it as a requirement.

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-runtime
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-16 00:00:00.000000000 Z
+date: 2026-10-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: fiddle