mostlyright-data 0.9.0__py3-none-any.whl

mostlyright/data_harness/coordinator.py

@@ -0,0 +1,1307 @@
+"""Separate-process review enrollment and signing authority for trusted H2 operators."""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import hashlib
+import os
+import re
+import secrets
+import select
+import socket
+import stat
+import struct
+import subprocess
+import sys
+import time
+import uuid
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+    Ed25519PrivateKey,
+    Ed25519PublicKey,
+)
+
+from mostlyright.data_harness.canonical import (
+    CanonicalJSONError,
+    canonical_json_bytes,
+    parse_canonical_json,
+)
+from mostlyright.data_harness.offline import (
+    _H2_PRODUCER_ATTEMPT,
+    _H2_PRODUCER_PRINCIPAL,
+    review_target_path,
+    workspace_result_path,  # noqa: F401  (re-exported: enrollment tests replay the workbench binding)
+)
+from mostlyright.data_harness.pipeline import verify_candidate
+from mostlyright.data_harness.review import (
+    ASSIGNMENT_SCHEMA_VERSION,
+    REPORT_SCHEMA_VERSION,
+    ReviewError,
+    _candidate_artifact_paths,
+    _normalized_assignment_digest,
+    _parse_assignment,
+    load_public_key_base64,
+    public_key_to_base64,
+)
+from mostlyright.data_harness.signing import SignerProviderError
+
+_REQUEST_SCHEMA_VERSION = "review-coordinator-request.v1"
+_RESPONSE_SCHEMA_VERSION = "review-coordinator-response.v1"
+_SESSION_SCHEMA_VERSION = "review-coordinator-session.v1"
+_STARTUP_SCHEMA_VERSION = "review-coordinator-startup.v1"
+_ANCHOR_SCHEMA_VERSION = "review-coordinator-anchor.v1"
+_SEALED_ENROLLMENT_SCHEMA_VERSION = "review-coordinator-sealed-enrollment.v1"
+_KEY_BUNDLE_SCHEMA_VERSION = "review-coordinator-key-bundle.v1"
+_SYSTEM_ANCHOR_PATH = (
+    Path("/private/etc/mostlyright/trust/anchor.json")
+    if sys.platform == "darwin"
+    else Path("/etc/mostlyright/trust/anchor.json")
+)
+_ANCHOR_MODE = 0o444
+_MAX_MESSAGE_BYTES = 1024 * 1024
+_MAX_SIGNING_BYTES = 768 * 1024
+_MAX_SESSION_REQUESTS = 32
+_DESCRIPTOR_READ_TIMEOUT_SECONDS = 5.0
+_SESSION_IDLE_TIMEOUT_SECONDS = 5.0
+_FRAME_IO_TIMEOUT_SECONDS = 2.0
+_CHILD_EXIT_TIMEOUT_SECONDS = 120.0
+_CHILD_REAP_TIMEOUT_SECONDS = 2.0
+_CHILD_KILL_ATTEMPTS = 3
+_CHILD_REAP_ATTEMPTS = 3
+_AUTHORITY_FD_ENV = "MOSTLYRIGHT_REVIEW_AUTHORITY_FD"
+# Hex shape checks, applied beyond the fields they are named for: _REQUEST_ID
+# also checks enrollment_id and anchor_id, and _NONCE also checks session ids and
+# SHA-256 digests.
+_REQUEST_ID = re.compile(r"^[0-9a-f]{32}$")
+_NONCE = re.compile(r"^[0-9a-f]{64}$")
+_HANDLE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_-]{31,127}$")
+_IDENTIFIER = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$")
+_REQUEST_FIELDS = {
+    "schema_version",
+    "session_id",
+    "request_id",
+    "client_nonce",
+    "operation",
+    "reviewer_attempt",
+    "payload",
+}
+_RESPONSE_BODY_FIELDS = {
+    "schema_version",
+    "session_id",
+    "request_id",
+    "client_nonce",
+    "server_nonce",
+    "ok",
+    "result",
+    "error",
+}
+
+
+class _CoordinatorProtocolError(RuntimeError):
+    """The coordinator transport or strict protocol failed closed."""
+
+
+@dataclass(frozen=True)
+class _TrustRecord:
+    """Client-side trust state taken from one session hello frame.
+
+    Only public_key is enforced afterwards: it verifies every response
+    signature. The enrollment fields record what the hello carried and bind
+    nothing later in the session.
+    """
+
+    public_key: Ed25519PublicKey
+    enrollment_id: str
+    enrollment_digest: str
+
+
+@dataclass(frozen=True)
+class _Enrollment:
+    """One signing role activated from the sealed enrollment and the key bundle.
+
+    role and reviewer_attempt decide which signing requests the session may
+    serve. handle_sha256 and lens record how the role was selected at activation
+    and are not rechecked per request.
+    """
+
+    handle_sha256: str
+    role: str
+    lens: str | None
+    reviewer_attempt: str | None
+    private_key: Ed25519PrivateKey
+
+
+class _PeerClosed(RuntimeError):
+    """The only inherited session peer closed its descriptor."""
+
+
+class _InheritedRemoteSigner:
+    """A role-bound signer proxy that never receives the coordinator private key."""
+
+    def __init__(
+        self,
+        provider: _InheritedReviewAuthorityProvider,
+        reviewer_attempt: str | None,
+        public_key: Ed25519PublicKey,
+    ) -> None:
+        self._provider = provider
+        self._reviewer_attempt = reviewer_attempt
+        self._public_key = public_key
+
+    def sign(self, data: bytes) -> bytes:
+        if not isinstance(data, bytes):
+            raise SignerProviderError("coordinator signer accepts exact bytes only")
+        result = self._provider._request(
+            operation="sign",
+            reviewer_attempt=self._reviewer_attempt,
+            payload=base64.b64encode(data).decode("ascii"),
+        )
+        if set(result) != {"signature"} or not isinstance(result["signature"], str):
+            raise SignerProviderError("coordinator returned an invalid signature response")
+        try:
+            signature = base64.b64decode(result["signature"], validate=True)
+        except (TypeError, ValueError) as exc:
+            raise SignerProviderError("coordinator returned invalid signature encoding") from exc
+        if len(signature) != 64:
+            raise SignerProviderError("coordinator returned an invalid Ed25519 signature")
+        try:
+            self._public_key.verify(signature, data)
+        except InvalidSignature as exc:
+            raise SignerProviderError(
+                "coordinator signature does not match the enrolled public key"
+            ) from exc
+        return signature
+
+    def public_key(self) -> Ed25519PublicKey:
+        return self._public_key
+
+
+class _InheritedReviewAuthority:
+    """One role-scoped authority view over an inherited anonymous session."""
+
+    def __init__(self, provider: _InheritedReviewAuthorityProvider) -> None:
+        self._provider = provider
+
+    def assignment_value(self) -> dict[str, Any]:
+        result = self._provider._request(
+            operation="assignment",
+            reviewer_attempt=None,
+            payload=None,
+        )
+        if set(result) != {"assignment"} or not isinstance(result["assignment"], dict):
+            raise SignerProviderError("coordinator returned an invalid assignment response")
+        return result["assignment"]
+
+    def reviewer_signer_for(self, reviewer_attempt: str) -> _InheritedRemoteSigner:
+        if not isinstance(reviewer_attempt, str) or _IDENTIFIER.fullmatch(reviewer_attempt) is None:
+            raise SignerProviderError("reviewer attempt is not a valid identifier")
+        public_key = self._public_key_for(reviewer_attempt)
+        return _InheritedRemoteSigner(
+            self._provider,
+            reviewer_attempt,
+            public_key,
+        )
+
+    def verifier_signer(self) -> _InheritedRemoteSigner:
+        public_key = self._public_key_for(None)
+        return _InheritedRemoteSigner(self._provider, None, public_key)
+
+    def _public_key_for(self, reviewer_attempt: str | None) -> Ed25519PublicKey:
+        result = self._provider._request(
+            operation="public_key",
+            reviewer_attempt=reviewer_attempt,
+            payload=None,
+        )
+        if set(result) != {"public_key"} or not isinstance(result["public_key"], str):
+            raise SignerProviderError("coordinator returned an invalid public-key response")
+        try:
+            return load_public_key_base64(result["public_key"])
+        except Exception as exc:
+            raise SignerProviderError("coordinator returned an invalid public key") from exc
+
+
+class _InheritedReviewAuthorityProvider:
+    """Resolve one role-scoped authority through a launcher-created socketpair."""
+
+    def __init__(self) -> None:
+        if os.name == "nt" or not hasattr(socket, "AF_UNIX"):
+            raise SignerProviderError("Unix review coordinator transport is unavailable")
+        descriptor = _take_inherited_authority_descriptor()
+        connection: socket.socket | None = None
+        try:
+            connection = socket.socket(fileno=descriptor)
+            if connection.family != socket.AF_UNIX:
+                raise _CoordinatorProtocolError("authority descriptor is not a Unix socket")
+            raw_hello = _receive_frame(
+                connection,
+                idle_timeout=_SESSION_IDLE_TIMEOUT_SECONDS,
+            )
+            self._trust, self._session_id = _parse_session_hello(raw_hello)
+            self._connection = connection
+        except Exception as exc:
+            if connection is None:
+                try:
+                    os.close(descriptor)
+                except OSError:
+                    pass
+            else:
+                connection.close()
+            raise SignerProviderError("inherited coordinator session is unavailable") from exc
+
+    def authority(self) -> _InheritedReviewAuthority:
+        return _InheritedReviewAuthority(self)
+
+    def _request(
+        self,
+        *,
+        operation: str,
+        reviewer_attempt: str | None,
+        payload: str | None,
+    ) -> dict[str, Any]:
+        request_id = uuid.uuid4().hex
+        client_nonce = secrets.token_hex(32)
+        request = {
+            "schema_version": _REQUEST_SCHEMA_VERSION,
+            "session_id": self._session_id,
+            "request_id": request_id,
+            "client_nonce": client_nonce,
+            "operation": operation,
+            "reviewer_attempt": reviewer_attempt,
+            "payload": payload,
+        }
+        try:
+            _send_frame(
+                self._connection,
+                canonical_json_bytes(request),
+            )
+            raw_response = _receive_frame(
+                self._connection,
+                idle_timeout=_SESSION_IDLE_TIMEOUT_SECONDS,
+            )
+            envelope = _parse_canonical_message(raw_response, "coordinator response")
+            return self._verify_response(
+                envelope,
+                request_id=request_id,
+                client_nonce=client_nonce,
+            )
+        except SignerProviderError:
+            raise
+        except Exception as exc:
+            raise SignerProviderError("coordinator request failed closed") from exc
+
+    def _verify_response(
+        self,
+        value: Any,
+        *,
+        request_id: str,
+        client_nonce: str,
+    ) -> dict[str, Any]:
+        if not isinstance(value, dict) or set(value) != {"body", "signature"}:
+            raise _CoordinatorProtocolError("coordinator response envelope fields are invalid")
+        body = value["body"]
+        signature_text = value["signature"]
+        if not isinstance(body, dict) or set(body) != _RESPONSE_BODY_FIELDS:
+            raise _CoordinatorProtocolError("coordinator response body fields are invalid")
+        if (
+            body["schema_version"] != _RESPONSE_SCHEMA_VERSION
+            or body["session_id"] != self._session_id
+            or body["request_id"] != request_id
+            or body["client_nonce"] != client_nonce
+            or not isinstance(body["server_nonce"], str)
+            or _NONCE.fullmatch(body["server_nonce"]) is None
+            or type(body["ok"]) is not bool
+        ):
+            raise _CoordinatorProtocolError("coordinator response binding is invalid")
+        if not isinstance(signature_text, str):
+            raise _CoordinatorProtocolError("coordinator response signature is invalid")
+        try:
+            signature = base64.b64decode(signature_text, validate=True)
+        except (TypeError, ValueError) as exc:
+            raise _CoordinatorProtocolError(
+                "coordinator response signature encoding is invalid"
+            ) from exc
+        try:
+            self._trust.public_key.verify(signature, canonical_json_bytes(body))
+        except InvalidSignature as exc:
+            raise _CoordinatorProtocolError(
+                "coordinator response root signature is invalid"
+            ) from exc
+
+        if body["ok"] is True:
+            if not isinstance(body["result"], dict) or body["error"] is not None:
+                raise _CoordinatorProtocolError("coordinator success response is invalid")
+            return body["result"]
+        error = body["error"]
+        if body["result"] is not None or not isinstance(error, dict):
+            raise _CoordinatorProtocolError("coordinator error response is invalid")
+        if set(error) != {"code", "message"} or not all(
+            isinstance(error[field], str) for field in ("code", "message")
+        ):
+            raise _CoordinatorProtocolError("coordinator error fields are invalid")
+        raise SignerProviderError(f"coordinator rejected request: {error['code']}")
+
+
+class _CoordinatorSessionServer:
+    """Serve one socketpair session for the single role the child was launched as.
+
+    The first frame is a hello carrying the session id and the sealed
+    enrollment, from which the client derives the response root public key.
+    Every response after it is signed by that root key over its canonical body.
+    A request id or client nonce may be used once per session; a repeat is
+    answered with a replayed_request error rather than the operation. The
+    assignment is readable by any session, while public_key and sign are refused
+    unless the request names this session's own role. The session ends after
+    _MAX_SESSION_REQUESTS requests, at the child deadline, or when the peer
+    closes.
+    """
+
+    def __init__(
+        self,
+        *,
+        connection: socket.socket,
+        assignment: dict[str, Any],
+        enrollment: _Enrollment,
+        root_private_key: Ed25519PrivateKey,
+        sealed_enrollment: dict[str, Any],
+    ) -> None:
+        self.connection = connection
+        self.assignment = assignment
+        self.enrollment = enrollment
+        self.root_private_key = root_private_key
+        self.sealed_enrollment = sealed_enrollment
+        self.session_id = secrets.token_hex(32)
+        self._seen_request_ids: set[str] = set()
+        self._seen_client_nonces: set[str] = set()
+
+    def serve(self, *, deadline: float) -> None:
+        hello = {
+            "schema_version": _SESSION_SCHEMA_VERSION,
+            "session_id": self.session_id,
+            "sealed_enrollment": self.sealed_enrollment,
+        }
+        _send_frame(self.connection, canonical_json_bytes(hello))
+        for _request_number in range(_MAX_SESSION_REQUESTS):
+            remaining = deadline - time.monotonic()
+            if remaining <= 0:
+                raise TimeoutError("coordinator session deadline expired")
+            try:
+                raw_request = _receive_frame(
+                    self.connection,
+                    idle_timeout=min(_SESSION_IDLE_TIMEOUT_SECONDS, remaining),
+                )
+            except _PeerClosed:
+                return
+            request = _parse_request(raw_request)
+            if request["session_id"] != self.session_id:
+                raise _CoordinatorProtocolError("request is bound to another session")
+            _send_frame(self.connection, self._dispatch(request))
+        raise _CoordinatorProtocolError("coordinator session request limit exceeded")
+
+    def _dispatch(self, request: dict[str, Any]) -> bytes:
+        request_id = request["request_id"]
+        client_nonce = request["client_nonce"]
+        if request_id in self._seen_request_ids or client_nonce in self._seen_client_nonces:
+            return self._signed_response(
+                request_id,
+                client_nonce,
+                ok=False,
+                error_code="replayed_request",
+                error_message="request identity has already been used",
+            )
+        self._seen_request_ids.add(request_id)
+        self._seen_client_nonces.add(client_nonce)
+
+        operation = request["operation"]
+        reviewer_attempt = request["reviewer_attempt"]
+        if operation == "assignment":
+            return self._signed_response(
+                request_id,
+                client_nonce,
+                ok=True,
+                result={"assignment": self.assignment},
+            )
+        if not self._authorized_signer_request(self.enrollment, reviewer_attempt):
+            return self._signed_response(
+                request_id,
+                client_nonce,
+                ok=False,
+                error_code="role_not_authorized",
+                error_message="inherited session is not authorized for this signing role",
+            )
+        if operation == "public_key":
+            return self._signed_response(
+                request_id,
+                client_nonce,
+                ok=True,
+                result={
+                    "public_key": public_key_to_base64(self.enrollment.private_key.public_key())
+                },
+            )
+        if operation == "sign":
+            try:
+                payload = base64.b64decode(request["payload"], validate=True)
+            except (TypeError, ValueError):
+                return self._signed_response(
+                    request_id,
+                    client_nonce,
+                    ok=False,
+                    error_code="invalid_payload",
+                    error_message="signing payload encoding is invalid",
+                )
+            if len(payload) > _MAX_SIGNING_BYTES:
+                return self._signed_response(
+                    request_id,
+                    client_nonce,
+                    ok=False,
+                    error_code="payload_too_large",
+                    error_message="signing payload exceeds the byte limit",
+                )
+            signature = self.enrollment.private_key.sign(payload)
+            return self._signed_response(
+                request_id,
+                client_nonce,
+                ok=True,
+                result={"signature": base64.b64encode(signature).decode("ascii")},
+            )
+        raise _CoordinatorProtocolError("validated request operation is unreachable")
+
+    @staticmethod
+    def _authorized_signer_request(
+        enrollment: _Enrollment,
+        reviewer_attempt: str | None,
+    ) -> bool:
+        if enrollment.role == "verifier":
+            return reviewer_attempt is None
+        return reviewer_attempt == enrollment.reviewer_attempt
+
+    def _signed_response(
+        self,
+        request_id: str,
+        client_nonce: str,
+        *,
+        ok: bool,
+        result: dict[str, Any] | None = None,
+        error_code: str | None = None,
+        error_message: str | None = None,
+    ) -> bytes:
+        body = {
+            "schema_version": _RESPONSE_SCHEMA_VERSION,
+            "session_id": self.session_id,
+            "request_id": request_id,
+            "client_nonce": client_nonce,
+            "server_nonce": secrets.token_hex(32),
+            "ok": ok,
+            "result": result if ok else None,
+            "error": (
+                None
+                if ok
+                else {
+                    "code": error_code,
+                    "message": error_message,
+                }
+            ),
+        }
+        signature = self.root_private_key.sign(canonical_json_bytes(body))
+        response = {
+            "body": body,
+            "signature": base64.b64encode(signature).decode("ascii"),
+        }
+        encoded = canonical_json_bytes(response)
+        if len(encoded) > _MAX_MESSAGE_BYTES:
+            raise _CoordinatorProtocolError("coordinator response exceeds the byte limit")
+        return encoded
+
+
+def coordinator_main(argv: list[str] | None = None) -> int:
+    """Prepare metadata or launch one role-scoped anonymous authority session."""
+
+    parser = argparse.ArgumentParser(prog="mr-data-coordinator")
+    subparsers = parser.add_subparsers(dest="command", required=True)
+    prepare = subparsers.add_parser("prepare")
+    prepare.add_argument("--workspace", required=True)
+    prepare.add_argument("--sealed-enrollment-fd", type=_descriptor_argument, required=True)
+    run = subparsers.add_parser("run")
+    run.add_argument("--workspace", required=True)
+    run.add_argument("--sealed-enrollment-fd", type=_descriptor_argument, required=True)
+    run.add_argument("--key-bundle-fd", type=_descriptor_argument, required=True)
+    run.add_argument("--role-token-fd", type=_descriptor_argument, required=True)
+    run.add_argument("child_command", nargs=argparse.REMAINDER)
+    args = parser.parse_args(argv)
+    if os.name == "nt" or not hasattr(socket, "AF_UNIX"):
+        parser.error("Unix socketpair transport is required")
+
+    workspace = Path(os.path.abspath(args.workspace))
+    try:
+        candidate = verify_candidate(review_target_path(workspace))
+        descriptor_values = [args.sealed_enrollment_fd]
+        if args.command == "run":
+            descriptor_values.extend([args.key_bundle_fd, args.role_token_fd])
+        if len(set(descriptor_values)) != len(descriptor_values):
+            raise _CoordinatorProtocolError("coordinator input descriptors must be distinct")
+        sealed_enrollment = _read_canonical_descriptor(
+            args.sealed_enrollment_fd,
+            label="sealed enrollment",
+        )
+        if args.command == "prepare":
+            assignment, enrollment_id = _prepare_enrollment(
+                candidate,
+                sealed_enrollment=sealed_enrollment,
+            )
+            startup = {
+                "schema_version": _STARTUP_SCHEMA_VERSION,
+                "assignment": assignment,
+                "report_templates": _report_templates(candidate, assignment),
+                "enrollment_id": enrollment_id,
+            }
+            sys.stdout.buffer.write(canonical_json_bytes(startup) + b"\n")
+            sys.stdout.buffer.flush()
+            return 0
+
+        key_bundle = _read_canonical_descriptor(
+            args.key_bundle_fd,
+            label="coordinator key bundle",
+        )
+        role_token_commitment = _read_role_token_commitment_descriptor(args.role_token_fd)
+        child_command = list(args.child_command)
+        if child_command and child_command[0] == "--":
+            child_command.pop(0)
+        if not child_command:
+            raise _CoordinatorProtocolError("coordinator child command is required")
+        assignment, enrollments, root_private_key, _enrollment_id = _activate_enrollment(
+            candidate,
+            sealed_enrollment=sealed_enrollment,
+            key_bundle=key_bundle,
+        )
+        enrollment = enrollments.get(role_token_commitment)
+        if enrollment is None:
+            raise _CoordinatorProtocolError("role token is not enrolled")
+        return _run_authorized_child(
+            child_command,
+            assignment=assignment,
+            enrollment=enrollment,
+            root_private_key=root_private_key,
+            sealed_enrollment=sealed_enrollment,
+        )
+    except (
+        CanonicalJSONError,
+        OSError,
+        subprocess.SubprocessError,
+        TimeoutError,
+        ValueError,
+        ReviewError,
+        SignerProviderError,
+        _CoordinatorProtocolError,
+    ) as exc:
+        print(f"coordinator startup failed: {type(exc).__name__}", file=sys.stderr)
+        return 2
+
+
+def _prepare_enrollment(
+    candidate: Any,
+    *,
+    sealed_enrollment: Any,
+) -> tuple[dict[str, Any], str]:
+    body = _verified_enrollment_body(candidate, sealed_enrollment)
+    return _assignment_from_enrollment_body(body), body["enrollment_id"]
+
+
+def _activate_enrollment(
+    candidate: Any,
+    *,
+    sealed_enrollment: Any,
+    key_bundle: Any,
+) -> tuple[
+    dict[str, Any],
+    dict[str, _Enrollment],
+    Ed25519PrivateKey,
+    str,
+]:
+    body = _verified_enrollment_body(candidate, sealed_enrollment)
+    assignment = _assignment_from_enrollment_body(body)
+    bundle = _parse_key_bundle(key_bundle, enrollment_id=body["enrollment_id"])
+    root_private_key = bundle["response_root_private_key"]
+    if public_key_to_base64(root_private_key.public_key()) != body["response_root_public_key"]:
+        raise _CoordinatorProtocolError(
+            "coordinator response key does not match the sealed enrollment"
+        )
+    enrollments: dict[str, _Enrollment] = {}
+    for reviewer in body["reviewers"]:
+        lens = reviewer["lens"]
+        key = bundle["reviewer_private_keys"][lens]
+        if public_key_to_base64(key.public_key()) != reviewer["public_key"]:
+            raise _CoordinatorProtocolError(
+                "reviewer key bundle does not match the sealed enrollment"
+            )
+        handle_sha256 = reviewer["handle_sha256"]
+        enrollments[handle_sha256] = _Enrollment(
+            handle_sha256=handle_sha256,
+            role="reviewer",
+            lens=lens,
+            reviewer_attempt=reviewer["attempt_id"],
+            private_key=key,
+        )
+    verifier_key = bundle["verifier_private_key"]
+    if public_key_to_base64(verifier_key.public_key()) != body["verifier"]["public_key"]:
+        raise _CoordinatorProtocolError("verifier key bundle does not match the sealed enrollment")
+    verifier_handle_sha256 = body["verifier"]["handle_sha256"]
+    enrollments[verifier_handle_sha256] = _Enrollment(
+        handle_sha256=verifier_handle_sha256,
+        role="verifier",
+        lens=None,
+        reviewer_attempt=None,
+        private_key=verifier_key,
+    )
+    if len(enrollments) != 3:
+        raise _CoordinatorProtocolError("sealed enrollment has duplicate role handles")
+    return assignment, enrollments, root_private_key, body["enrollment_id"]
+
+
+def _verified_enrollment_body(candidate: Any, sealed_enrollment: Any) -> dict[str, Any]:
+    body = _verify_sealed_enrollment(sealed_enrollment, _load_anchor_public_key())
+    trusted_producer = {
+        "principal_id": _H2_PRODUCER_PRINCIPAL,
+        "attempt_id": _H2_PRODUCER_ATTEMPT,
+    }
+    if (
+        body["candidate_digest"] != candidate.candidate_digest
+        or body["validation_policy_digest"] != candidate.validation_policy_digest
+        or body["producer"] != trusted_producer
+        or {
+            "principal_id": candidate.producer_principal,
+            "attempt_id": candidate.producer_attempt,
+        }
+        != trusted_producer
+    ):
+        raise _CoordinatorProtocolError(
+            "sealed enrollment does not bind the exact candidate and fixed H2 producer"
+        )
+    return body
+
+
+def _assignment_from_enrollment_body(body: dict[str, Any]) -> dict[str, Any]:
+    reviewers = [
+        {key: value for key, value in reviewer.items() if key != "handle_sha256"}
+        for reviewer in body["reviewers"]
+    ]
+    assignment = _parse_assignment(
+        {
+            "schema_version": ASSIGNMENT_SCHEMA_VERSION,
+            "candidate_digest": body["candidate_digest"],
+            "validation_policy_digest": body["validation_policy_digest"],
+            "cycle_lineage": body["cycle_lineage"],
+            "failed_cycle_count": 0,
+            "producer": body["producer"],
+            "reviewers": reviewers,
+            "verifier": {
+                "principal_id": body["verifier"]["principal_id"],
+                "public_key": body["verifier"]["public_key"],
+            },
+        }
+    )
+    return assignment
+
+
+def _verify_sealed_enrollment(
+    value: Any,
+    anchor_public_key: Ed25519PublicKey,
+) -> dict[str, Any]:
+    if not isinstance(value, dict) or set(value) != {"body", "signature"}:
+        raise _CoordinatorProtocolError("sealed enrollment envelope is invalid")
+    body = value["body"]
+    signature_text = value["signature"]
+    if not isinstance(body, dict) or set(body) != {
+        "schema_version",
+        "enrollment_id",
+        "candidate_digest",
+        "validation_policy_digest",
+        "cycle_lineage",
+        "producer",
+        "reviewers",
+        "verifier",
+        "response_root_public_key",
+    }:
+        raise _CoordinatorProtocolError("sealed enrollment fields are invalid")
+    if (
+        body["schema_version"] != _SEALED_ENROLLMENT_SCHEMA_VERSION
+        or not isinstance(body["enrollment_id"], str)
+        or _REQUEST_ID.fullmatch(body["enrollment_id"]) is None
+        or not isinstance(body["candidate_digest"], str)
+        or _NONCE.fullmatch(body["candidate_digest"]) is None
+        or not isinstance(body["validation_policy_digest"], str)
+        or _NONCE.fullmatch(body["validation_policy_digest"]) is None
+        or not isinstance(body["cycle_lineage"], str)
+        or _IDENTIFIER.fullmatch(body["cycle_lineage"]) is None
+        or not isinstance(body["producer"], dict)
+        or set(body["producer"]) != {"principal_id", "attempt_id"}
+    ):
+        raise _CoordinatorProtocolError("sealed enrollment binding is invalid")
+    reviewers = body["reviewers"]
+    if not isinstance(reviewers, list) or len(reviewers) != 2:
+        raise _CoordinatorProtocolError("sealed enrollment reviewer set is invalid")
+    expected_reviewer_fields = {
+        "principal_id",
+        "attempt_id",
+        "lens",
+        "key_id",
+        "public_key",
+        "handle_sha256",
+    }
+    for reviewer in reviewers:
+        if (
+            not isinstance(reviewer, dict)
+            or set(reviewer) != expected_reviewer_fields
+            or not isinstance(reviewer["handle_sha256"], str)
+            or _NONCE.fullmatch(reviewer["handle_sha256"]) is None
+        ):
+            raise _CoordinatorProtocolError("sealed enrollment reviewer entry is invalid")
+    verifier = body["verifier"]
+    if (
+        not isinstance(verifier, dict)
+        or set(verifier) != {"principal_id", "public_key", "handle_sha256"}
+        or not isinstance(verifier["handle_sha256"], str)
+        or _NONCE.fullmatch(verifier["handle_sha256"]) is None
+        or not isinstance(body["response_root_public_key"], str)
+    ):
+        raise _CoordinatorProtocolError("sealed enrollment verifier entry is invalid")
+    role_hashes = [
+        *(reviewer["handle_sha256"] for reviewer in reviewers),
+        verifier["handle_sha256"],
+    ]
+    if len(set(role_hashes)) != 3:
+        raise _CoordinatorProtocolError("sealed enrollment role handle hashes must be distinct")
+    role_public_keys = [
+        *(reviewer["public_key"] for reviewer in reviewers),
+        verifier["public_key"],
+    ]
+    for public_key in [*role_public_keys, body["response_root_public_key"]]:
+        load_public_key_base64(public_key)
+    if len(set(role_public_keys)) != 3 or body["response_root_public_key"] in role_public_keys:
+        raise _CoordinatorProtocolError("sealed enrollment signing keys must be distinct")
+    if not isinstance(signature_text, str):
+        raise _CoordinatorProtocolError("sealed enrollment signature is invalid")
+    try:
+        signature = base64.b64decode(signature_text, validate=True)
+        anchor_public_key.verify(signature, canonical_json_bytes(body))
+    except (InvalidSignature, TypeError, ValueError) as exc:
+        raise _CoordinatorProtocolError(
+            "sealed enrollment signature is not from the trusted anchor"
+        ) from exc
+    return body
+
+
+def _parse_key_bundle(
+    value: Any,
+    *,
+    enrollment_id: str,
+) -> dict[str, Any]:
+    if not isinstance(value, dict) or set(value) != {
+        "schema_version",
+        "enrollment_id",
+        "response_root_private_key",
+        "reviewer_private_keys",
+        "verifier_private_key",
+    }:
+        raise _CoordinatorProtocolError("coordinator key bundle fields are invalid")
+    if (
+        value["schema_version"] != _KEY_BUNDLE_SCHEMA_VERSION
+        or value["enrollment_id"] != enrollment_id
+        or not isinstance(value["reviewer_private_keys"], dict)
+        or set(value["reviewer_private_keys"])
+        != {"question_source_fit", "transformation_data_quality"}
+    ):
+        raise _CoordinatorProtocolError("coordinator key bundle binding is invalid")
+    return {
+        "response_root_private_key": _load_private_key(value["response_root_private_key"]),
+        "reviewer_private_keys": {
+            lens: _load_private_key(encoded)
+            for lens, encoded in value["reviewer_private_keys"].items()
+        },
+        "verifier_private_key": _load_private_key(value["verifier_private_key"]),
+    }
+
+
+def _load_private_key(value: Any) -> Ed25519PrivateKey:
+    if not isinstance(value, str):
+        raise _CoordinatorProtocolError("coordinator private key encoding is invalid")
+    try:
+        raw = base64.b64decode(value, validate=True)
+        if len(raw) != 32:
+            raise ValueError
+        return Ed25519PrivateKey.from_private_bytes(raw)
+    except (TypeError, ValueError) as exc:
+        raise _CoordinatorProtocolError("coordinator private key encoding is invalid") from exc
+
+
+def _report_templates(candidate: Any, assignment: dict[str, Any]) -> dict[str, Any]:
+    assignment_digest = _normalized_assignment_digest(assignment)
+    reviewed_paths = _candidate_artifact_paths(candidate)
+    return {
+        reviewer["lens"]: {
+            "schema_version": REPORT_SCHEMA_VERSION,
+            "assignment_digest": assignment_digest,
+            "candidate_digest": assignment["candidate_digest"],
+            "validation_policy_digest": assignment["validation_policy_digest"],
+            "cycle_lineage": assignment["cycle_lineage"],
+            "failed_cycle_count": assignment["failed_cycle_count"],
+            "reviewer_principal": reviewer["principal_id"],
+            "reviewer_attempt": reviewer["attempt_id"],
+            "reviewer_key_id": reviewer["key_id"],
+            "lens": reviewer["lens"],
+            "reviewed_artifact_paths": reviewed_paths,
+            "summary": "REPLACE_WITH_INDEPENDENT_REVIEW_SUMMARY",
+            "findings": [],
+        }
+        for reviewer in assignment["reviewers"]
+    }
+
+
+def _parse_request(raw: bytes) -> dict[str, Any]:
+    value = _parse_canonical_message(raw, "coordinator request")
+    if not isinstance(value, dict) or set(value) != _REQUEST_FIELDS:
+        raise _CoordinatorProtocolError("coordinator request fields are invalid")
+    if (
+        value["schema_version"] != _REQUEST_SCHEMA_VERSION
+        or not isinstance(value["session_id"], str)
+        or _NONCE.fullmatch(value["session_id"]) is None
+        or not isinstance(value["request_id"], str)
+        or _REQUEST_ID.fullmatch(value["request_id"]) is None
+        or not isinstance(value["client_nonce"], str)
+        or _NONCE.fullmatch(value["client_nonce"]) is None
+        or value["operation"] not in {"assignment", "public_key", "sign"}
+    ):
+        raise _CoordinatorProtocolError("coordinator request binding is invalid")
+    operation = value["operation"]
+    reviewer_attempt = value["reviewer_attempt"]
+    payload = value["payload"]
+    if reviewer_attempt is not None and (
+        not isinstance(reviewer_attempt, str) or _IDENTIFIER.fullmatch(reviewer_attempt) is None
+    ):
+        raise _CoordinatorProtocolError("coordinator reviewer attempt is invalid")
+    if operation == "assignment":
+        if reviewer_attempt is not None or payload is not None:
+            raise _CoordinatorProtocolError("assignment request contains signer fields")
+    elif operation == "public_key":
+        if payload is not None:
+            raise _CoordinatorProtocolError("public-key request contains a payload")
+    elif not isinstance(payload, str):
+        raise _CoordinatorProtocolError("sign request payload is invalid")
+    return value
+
+
+def _parse_session_hello(raw: bytes) -> tuple[_TrustRecord, str]:
+    value = _parse_canonical_message(raw, "coordinator session hello")
+    if not isinstance(value, dict) or set(value) != {
+        "schema_version",
+        "session_id",
+        "sealed_enrollment",
+    }:
+        raise _CoordinatorProtocolError("coordinator session hello fields are invalid")
+    session_id = value["session_id"]
+    if (
+        value["schema_version"] != _SESSION_SCHEMA_VERSION
+        or not isinstance(session_id, str)
+        or _NONCE.fullmatch(session_id) is None
+    ):
+        raise _CoordinatorProtocolError("coordinator session hello binding is invalid")
+    enrollment_body = _verify_sealed_enrollment(
+        value["sealed_enrollment"],
+        _load_anchor_public_key(),
+    )
+    public_key = load_public_key_base64(enrollment_body["response_root_public_key"])
+    return (
+        _TrustRecord(
+            public_key=public_key,
+            enrollment_id=enrollment_body["enrollment_id"],
+            enrollment_digest=hashlib.sha256(
+                canonical_json_bytes(value["sealed_enrollment"])
+            ).hexdigest(),
+        ),
+        session_id,
+    )
+
+
+def _send_frame(connection: socket.socket, payload: bytes) -> None:
+    if not payload or len(payload) > _MAX_MESSAGE_BYTES:
+        raise _CoordinatorProtocolError("coordinator frame size is invalid")
+    framed = struct.pack("!I", len(payload)) + payload
+    deadline = time.monotonic() + _FRAME_IO_TIMEOUT_SECONDS
+    offset = 0
+    while offset < len(framed):
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            raise TimeoutError("coordinator frame write deadline expired")
+        _readable, writable, _exceptional = select.select([], [connection], [], remaining)
+        if not writable:
+            raise TimeoutError("coordinator frame write deadline expired")
+        try:
+            written = connection.send(framed[offset:])
+        except BlockingIOError:
+            continue
+        if written <= 0:
+            raise _PeerClosed("coordinator session peer closed during frame write")
+        offset += written
+
+
+def _receive_frame(
+    connection: socket.socket,
+    *,
+    idle_timeout: float,
+) -> bytes:
+    header = _receive_exact(connection, 4, timeout=idle_timeout)
+    (length,) = struct.unpack("!I", header)
+    if length <= 0 or length > _MAX_MESSAGE_BYTES:
+        raise _CoordinatorProtocolError("coordinator frame size is invalid")
+    return _receive_exact(
+        connection,
+        length,
+        timeout=_FRAME_IO_TIMEOUT_SECONDS,
+    )
+
+
+def _receive_exact(connection: socket.socket, size: int, *, timeout: float) -> bytes:
+    deadline = time.monotonic() + timeout
+    chunks: list[bytes] = []
+    remaining_bytes = size
+    while remaining_bytes:
+        remaining_time = deadline - time.monotonic()
+        if remaining_time <= 0:
+            raise TimeoutError("coordinator frame read deadline expired")
+        readable, _writable, _exceptional = select.select([connection], [], [], remaining_time)
+        if not readable:
+            raise TimeoutError("coordinator frame read deadline expired")
+        try:
+            chunk = connection.recv(remaining_bytes)
+        except BlockingIOError:
+            continue
+        except ConnectionResetError as exc:
+            # A peer that exits with unread frames still buffered resets the socketpair
+            # on Linux, where macOS delivers plain EOF for the same abandonment; the two
+            # kernels must share one contract, so reset-at-frame-start is the peer
+            # closing and reset-mid-frame is the same truncation EOF would be.
+            if remaining_bytes == size:
+                raise _PeerClosed("coordinator session peer closed") from exc
+            raise _CoordinatorProtocolError("coordinator frame was truncated") from exc
+        if not chunk:
+            if remaining_bytes == size:
+                raise _PeerClosed("coordinator session peer closed")
+            raise _CoordinatorProtocolError("coordinator frame was truncated")
+        chunks.append(chunk)
+        remaining_bytes -= len(chunk)
+    return b"".join(chunks)
+
+
+def _parse_canonical_message(raw: bytes, label: str) -> Any:
+    if not raw or len(raw) > _MAX_MESSAGE_BYTES:
+        raise _CoordinatorProtocolError(f"{label} exceeds the byte limit")
+    try:
+        return parse_canonical_json(raw)
+    except CanonicalJSONError as exc:
+        raise _CoordinatorProtocolError(f"{label} is not strict canonical JSON") from exc
+
+
+def _inherited_authority_available() -> bool:
+    """Return whether a launcher supplied the non-secret session descriptor number."""
+
+    return _AUTHORITY_FD_ENV in os.environ
+
+
+def _take_inherited_authority_descriptor() -> int:
+    raw = os.environ.pop(_AUTHORITY_FD_ENV, None)
+    if raw is None:
+        raise _CoordinatorProtocolError("inherited authority descriptor is absent")
+    descriptor = _descriptor_argument(raw)
+    try:
+        duplicate = os.dup(descriptor)
+    finally:
+        os.close(descriptor)
+    return duplicate
+
+
+def _descriptor_argument(value: str) -> int:
+    if not isinstance(value, str) or not value.isascii() or not value.isdecimal():
+        raise argparse.ArgumentTypeError("descriptor must be a decimal integer")
+    descriptor = int(value)
+    if descriptor < 3:
+        raise argparse.ArgumentTypeError("descriptor must not be stdin, stdout, or stderr")
+    return descriptor
+
+
+def _read_canonical_descriptor(descriptor: int, *, label: str) -> Any:
+    raw = _read_descriptor_bytes(
+        descriptor,
+        label=label,
+        limit=_MAX_MESSAGE_BYTES,
+    )
+    try:
+        return parse_canonical_json(raw)
+    except CanonicalJSONError as exc:
+        raise _CoordinatorProtocolError(
+            f"coordinator {label} is not strict canonical JSON"
+        ) from exc
+
+
+def _read_role_token_commitment_descriptor(descriptor: int) -> str:
+    raw = _read_descriptor_bytes(descriptor, label="role token", limit=256)
+    if not raw.endswith(b"\n") or raw.count(b"\n") != 1:
+        raise _CoordinatorProtocolError("role token must be exactly one newline-terminated value")
+    token = raw[:-1]
+    try:
+        token_text = token.decode("ascii")
+    except UnicodeDecodeError as exc:
+        raise _CoordinatorProtocolError("role token is not ASCII") from exc
+    if _HANDLE.fullmatch(token_text) is None:
+        raise _CoordinatorProtocolError("role token has an invalid format")
+    return hashlib.sha256(token).hexdigest()
+
+
+def _read_descriptor_bytes(descriptor: int, *, label: str, limit: int) -> bytes:
+    deadline = time.monotonic() + _DESCRIPTOR_READ_TIMEOUT_SECONDS
+    chunks: list[bytes] = []
+    total = 0
+    try:
+        os.fstat(descriptor)
+        while True:
+            remaining = deadline - time.monotonic()
+            if remaining <= 0:
+                raise TimeoutError(f"coordinator {label} read deadline expired")
+            readable, _writable, _exceptional = select.select([descriptor], [], [], remaining)
+            if not readable:
+                raise TimeoutError(f"coordinator {label} read deadline expired")
+            chunk = os.read(descriptor, min(65_536, limit + 1 - total))
+            if not chunk:
+                break
+            chunks.append(chunk)
+            total += len(chunk)
+            if total > limit:
+                raise _CoordinatorProtocolError(f"coordinator {label} exceeds the byte limit")
+    finally:
+        os.close(descriptor)
+    raw = b"".join(chunks)
+    if not raw:
+        raise _CoordinatorProtocolError(f"coordinator {label} is empty")
+    return raw
+
+
+def _run_authorized_child(
+    child_command: list[str],
+    *,
+    assignment: dict[str, Any],
+    enrollment: _Enrollment,
+    root_private_key: Ed25519PrivateKey,
+    sealed_enrollment: dict[str, Any],
+) -> int:
+    server_socket, child_socket = socket.socketpair(socket.AF_UNIX, socket.SOCK_STREAM)
+    server = _CoordinatorSessionServer(
+        connection=server_socket,
+        assignment=assignment,
+        enrollment=enrollment,
+        root_private_key=root_private_key,
+        sealed_enrollment=sealed_enrollment,
+    )
+    child_environment = os.environ.copy()
+    child_environment.pop(_AUTHORITY_FD_ENV, None)
+    child_environment[_AUTHORITY_FD_ENV] = str(child_socket.fileno())
+    process: subprocess.Popen[bytes] | None = None
+    deadline = time.monotonic() + _CHILD_EXIT_TIMEOUT_SECONDS
+    try:
+        process = subprocess.Popen(
+            child_command,
+            env=child_environment,
+            close_fds=True,
+            pass_fds=(child_socket.fileno(),),
+        )
+        child_socket.close()
+        server.serve(deadline=deadline)
+        try:
+            remaining = deadline - time.monotonic()
+            if remaining <= 0:
+                raise subprocess.TimeoutExpired(child_command, _CHILD_EXIT_TIMEOUT_SECONDS)
+            return_code = process.wait(timeout=remaining)
+        except subprocess.TimeoutExpired as exc:
+            raise TimeoutError("authorized child exceeded its exit deadline") from exc
+    except BaseException:
+        if process is not None:
+            try:
+                _terminate_child(process)
+            except BaseException:
+                pass
+        try:
+            _close_session_sockets(child_socket, server_socket)
+        except BaseException:
+            pass
+        raise
+    _close_session_sockets(child_socket, server_socket)
+    return return_code
+
+
+def _terminate_child(process: subprocess.Popen[bytes]) -> None:
+    first_failure: BaseException | None = None
+
+    def record_failure(exc: BaseException) -> None:
+        nonlocal first_failure
+        if first_failure is None:
+            first_failure = exc
+
+    def reap_child(*, attempts: int) -> bool:
+        for _attempt in range(attempts):
+            try:
+                process.wait(timeout=_CHILD_REAP_TIMEOUT_SECONDS)
+            except subprocess.TimeoutExpired:
+                pass
+            except BaseException as exc:
+                record_failure(exc)
+            else:
+                return True
+
+            try:
+                return_code = process.poll()
+            except BaseException as exc:
+                record_failure(exc)
+            else:
+                if return_code is not None:
+                    return True
+        return False
+
+    try:
+        process.terminate()
+    except BaseException as exc:
+        record_failure(exc)
+
+    if reap_child(attempts=1):
+        if first_failure is not None:
+            raise first_failure
+        return
+
+    for _attempt in range(_CHILD_KILL_ATTEMPTS):
+        try:
+            process.kill()
+        except BaseException as exc:
+            record_failure(exc)
+            continue
+        break
+
+    if reap_child(attempts=_CHILD_REAP_ATTEMPTS):
+        if first_failure is not None:
+            raise first_failure
+        return
+
+    if first_failure is not None:
+        raise first_failure
+    raise TimeoutError("authorized child could not be killed and reaped")
+
+
+def _close_session_sockets(*connections: socket.socket) -> None:
+    first_failure: BaseException | None = None
+    for connection in connections:
+        try:
+            connection.close()
+        except BaseException as exc:
+            if first_failure is None:
+                first_failure = exc
+    if first_failure is not None:
+        raise first_failure
+
+
+def _load_anchor_public_key() -> Ed25519PublicKey:
+    anchor_path = (
+        Path("/private/etc/mostlyright/trust/anchor.json")
+        if sys.platform == "darwin"
+        else Path("/etc/mostlyright/trust/anchor.json")
+    )
+    value = _read_system_anchor(
+        anchor_path,
+        owner_uid=0,
+    )
+    if not isinstance(value, dict) or set(value) != {
+        "schema_version",
+        "algorithm",
+        "anchor_id",
+        "public_key",
+    }:
+        raise _CoordinatorProtocolError("coordinator trust anchor fields are invalid")
+    if (
+        value["schema_version"] != _ANCHOR_SCHEMA_VERSION
+        or value["algorithm"] != "Ed25519"
+        or not isinstance(value["anchor_id"], str)
+        or _REQUEST_ID.fullmatch(value["anchor_id"]) is None
+        or not isinstance(value["public_key"], str)
+    ):
+        raise _CoordinatorProtocolError("coordinator trust anchor binding is invalid")
+    return load_public_key_base64(value["public_key"])
+
+
+def _read_system_anchor(path: Path, *, owner_uid: int) -> Any:
+    if not isinstance(path, Path) or not path.is_absolute():
+        raise _CoordinatorProtocolError("coordinator system anchor path is not fixed and absolute")
+    if type(owner_uid) is not int or owner_uid < 0:
+        raise _CoordinatorProtocolError("coordinator system anchor owner is invalid")
+    absolute = Path(os.path.abspath(os.fspath(path)))
+    current = Path(absolute.anchor)
+    for component in absolute.parts[1:-1]:
+        current /= component
+        info = os.lstat(current)
+        if (
+            not stat.S_ISDIR(info.st_mode)
+            or info.st_uid not in {0, owner_uid}
+            or stat.S_IMODE(info.st_mode) & 0o022
+        ):
+            raise _CoordinatorProtocolError(
+                "coordinator system anchor ancestor is not operator-owned"
+            )
+        descriptor = os.open(
+            current,
+            os.O_RDONLY | getattr(os, "O_DIRECTORY", 0) | getattr(os, "O_NOFOLLOW", 0),
+        )
+        try:
+            if _stat_identity(os.fstat(descriptor)) != _stat_identity(info):
+                raise _CoordinatorProtocolError(
+                    "coordinator system anchor ancestor changed identity"
+                )
+        finally:
+            os.close(descriptor)
+    info = os.lstat(absolute)
+    if (
+        not stat.S_ISREG(info.st_mode)
+        or info.st_uid != owner_uid
+        or info.st_nlink != 1
+        or stat.S_IMODE(info.st_mode) != _ANCHOR_MODE
+    ):
+        raise _CoordinatorProtocolError("coordinator system anchor metadata is invalid")
+    descriptor = os.open(
+        absolute,
+        os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0),
+    )
+    try:
+        opened = os.fstat(descriptor)
+        if _stat_identity(opened) != _stat_identity(info):
+            raise _CoordinatorProtocolError("coordinator system anchor changed identity")
+        raw = os.read(descriptor, _MAX_MESSAGE_BYTES + 1)
+        if len(raw) > _MAX_MESSAGE_BYTES:
+            raise _CoordinatorProtocolError("coordinator system anchor exceeds the byte limit")
+    finally:
+        os.close(descriptor)
+    try:
+        return parse_canonical_json(raw)
+    except CanonicalJSONError as exc:
+        raise _CoordinatorProtocolError(
+            "coordinator system anchor is not strict canonical JSON"
+        ) from exc
+
+
+def _stat_identity(info: os.stat_result) -> tuple[int, int, int, int, int, int]:
+    return (
+        info.st_dev,
+        info.st_ino,
+        info.st_uid,
+        stat.S_IFMT(info.st_mode),
+        stat.S_IMODE(info.st_mode),
+        info.st_size,
+    )
+
+
+__all__ = ["coordinator_main"]