ace-assign 0.61.0 → 0.62.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 494e61c0842f8930425d12aeee6c0b51b46ce491e829c19401df1296e440ca09
-  data.tar.gz: 614e997a57ea09e7ff83d30ad372514dc0c0abceac7a809cdcb4aea1b630005a
+  metadata.gz: 17761502c8b23ff60844d6a3da34ddde53c776d18907a23854ad4168dec3c033
+  data.tar.gz: 1538f48c6aec44ac548dcc116bddc0c4928cbc876485513b616604f886f0deb0
 SHA512:
-  metadata.gz: a83405e18f47bdf33cf83619a88b790ad6ed27ff933f8816530931a2eb571c744f8eeca5c25aded6c0c2dacdda5429aec87372aadae63b0393a17a2797d149ea
-  data.tar.gz: c6dba5cc8f2925af84265864bbf4b54e3102f27d0707ee936d0440ec3df28e3acbf67cc7040a103c808461d33cfd77c8dd43f5092bbec6ce0fa362b1920cfc52
+  metadata.gz: 7f6b66a87f7a32496f11974ced9cb200c092488f027eb233dde59703ba3dcffa2eaad309d1f57b0b023113eb3f08c58e451b69823a33533d80c5fb45b79110e2
+  data.tar.gz: 6d0c8ef8b69d5002b98b60b22018fdc4aecf809818284e80bd11c70020a9733b9ba37140237b30fea470d539de23ce98a658bec902b1a6b9bf4454329ab50ed9

data/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.62.0] - 2026-10-04
+
+### Added
+- **Lock-scoped external attempt authority (spec 8wq.t.34i)**: `AttemptCoordinator#with_verified_attempt` verifies that a managed attempt is live (reserved/running — uncertainty never grants external authority), bound to the exact assignment/project, and owned by the requesting actor, holding the assignment `LifecycleExclusion` shared side across the caller's whole locked transition. `finish` and `reconcile` hold the exclusive side across their terminal commits, so a liveness check can never observe an attempt as active after the terminal event landed (and vice versa). This is the authority behind ace-hitl's managed HITL request binding.
+
+
+## [0.61.1] - 2026-10-02
+
+### Fixed
+- Historical evidence reads (`--historical-head`) validate acceptance from the append-only journal without re-hashing receipt artifacts, so campaigns that resolve findings mid-campaign (archiving and annotating the referenced files) can still finish; current-head reads keep full artifact re-verification.
+
+
 ## [0.61.0] - 2026-10-02
 
 ### Added

data/lib/ace/assign/molecules/receipt_verifier.rb

@@ -64,9 +64,15 @@ module Ace
           receipt
         end
         # Recheck the source artifacts/checks of an already accepted receipt.
-        def verify_accepted_evidence!(data, live_head:, repo_root:)
+        # Historical reads (recorded at a past head) validate acceptance from
+        # the append-only journal without re-hashing artifacts: the review
+        # lifecycle legitimately archives and annotates finding files after
+        # collection, and `.ace-local` working files are disposable, so their
+        # current existence proves nothing about an accepted past receipt.
+        # Current-head reads keep full artifact re-verification.
+        def verify_accepted_evidence!(data, live_head:, repo_root:, historical: false)
           verify_head(data, live_head)
-          verify_artifacts(data, repo_root)
+          verify_artifacts(data, repo_root) unless historical
           verify_checks(data)
           verify_review(data)
         end

data/lib/ace/assign/organisms/attempt_coordinator.rb

@@ -104,6 +104,29 @@ module Ace
           end
         end
 
+        # The exact-authority check behind with_verified_attempt: the
+        # journal-derived managed attempt must be live (reserved/running —
+        # uncertainty is unproven liveness and never grants external
+        # authority) and bound to the exact assignment, project, and
+        # requesting actor.
+        def verified_attempt(assignment_id:, attempt_id:, project_id:, requester:)
+          attempt = journal_for.derived_attempts(assignment_id)
+            .find { |candidate| candidate.attempt_id == attempt_id }
+          raise AttemptErrors::NotFound, "Attempt '#{attempt_id}' not found" unless attempt
+
+          unless attempt.managed? && %w[reserved running].include?(attempt.state) &&
+              attempt.binding.assignment_id == assignment_id &&
+              attempt.binding.project_id == project_id
+            raise AttemptErrors::ReceiptRejected,
+              "Authority request does not match an active managed attempt"
+          end
+          unless attempt.binding.actor == requester
+            raise AttemptErrors::UnauthorizedIdentity,
+              "Requester #{requester.inspect} does not own attempt '#{attempt_id}'"
+          end
+          attempt
+        end
+
         def reject_service_request(binding, reason:)
           service_attempt(binding)
           journal_for.reject_service_request(binding, reason: reason)
@@ -299,6 +322,36 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
           true
         end
 
+        # Hold verified authority over one managed attempt for the duration
+        # of a single external transition (the HITL consume/deliver
+        # critical sections). The shared exclusion side is held across the
+        # yielded transition, so a terminal commit (finish/reconcile hold
+        # the exclusive side) or a prune cannot land between the liveness
+        # check and the caller's commit: stale, ended or replaced attempts
+        # cannot acquire new authority. Authority is attribution over
+        # journal facts and the requesting identity — never a process id,
+        # runtime marker, or caller-supplied name.
+        #
+        # @param assignment_id [String] Owning assignment ID
+        # @param attempt_id [String] Attempt ID
+        # @param project_id [String] Project the attempt must be bound to
+        # @param requester [String] Authenticated requester (execution-
+        #   boundary identity of the caller, matched against binding actor)
+        # @yield [attempt] the verified managed attempt
+        # @raise [AttemptErrors::NotFound, AttemptErrors::ReceiptRejected,
+        #   AttemptErrors::UnauthorizedIdentity] on any authority doubt
+        def with_verified_attempt(assignment_id:, attempt_id:, project_id:, requester:)
+          assignment_id = assignment_id.to_s
+          attempt_id = attempt_id.to_s
+          lifecycle_exclusion.with_shared(lifecycle_exclusion.assignment_key(assignment_id)) do
+            attempt = verified_attempt(
+              assignment_id: assignment_id, attempt_id: attempt_id,
+              project_id: project_id.to_s, requester: requester.to_s
+            )
+            yield attempt
+          end
+        end
+
         # Start a scoped attempt for an assignment.
         #
         # A repeated identical start returns the existing active attempt; a
@@ -392,38 +445,44 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
           data = read_receipt_file(receipt_path)
           assignment_id = data["assignment_id"].to_s
 
-          # Serialize load-validate-accept so concurrent finishes observe one
-          # consistent state and cannot persist contradictory terminal outcomes.
-          @store.with_lock(assignment_id) do
-            attempt = @store.load(assignment_id, attempt_id) || recover_managed_attempt(assignment_id, attempt_id)
-            raise AttemptErrors::NotFound, "Attempt '#{attempt_id}' not found" unless attempt
-
-            ensure_journal_consistent!(attempt) if attempt.managed?
-            raise AttemptErrors::InvalidState, "Attempt #{attempt_id} is terminal; accepted history is immutable" if attempt.terminal?
-            raise AttemptErrors::InvalidState, "Attempt #{attempt_id} is uncertain; reconcile before finishing" if attempt.uncertain?
-
-            identity ||= @identity_resolver.resolve
-            live_head = candidate_head!
-
-            attempt = invalidate_stale_candidate(attempt, live_head)
+          # Terminal commits hold the exclusive exclusion so an external
+          # liveness reader (with_verified_attempt holds the shared side
+          # across its whole transition) can never observe the attempt as
+          # active after the terminal event landed.
+          lifecycle_exclusion.with_exclusive(lifecycle_exclusion.assignment_key(assignment_id)) do
+            # Serialize load-validate-accept so concurrent finishes observe one
+            # consistent state and cannot persist contradictory terminal outcomes.
+            @store.with_lock(assignment_id) do
+              attempt = @store.load(assignment_id, attempt_id) || recover_managed_attempt(assignment_id, attempt_id)
+              raise AttemptErrors::NotFound, "Attempt '#{attempt_id}' not found" unless attempt
+
+              ensure_journal_consistent!(attempt) if attempt.managed?
+              raise AttemptErrors::InvalidState, "Attempt #{attempt_id} is terminal; accepted history is immutable" if attempt.terminal?
+              raise AttemptErrors::InvalidState, "Attempt #{attempt_id} is uncertain; reconcile before finishing" if attempt.uncertain?
+
+              identity ||= @identity_resolver.resolve
+              live_head = candidate_head!
+
+              attempt = invalidate_stale_candidate(attempt, live_head)
+
+              receipt = @verifier.verify!(
+                data,
+                attempt: attempt,
+                identity: identity,
+                live_head: live_head,
+                repo_root: @repo_root
+              )
+              if @verifier.external_effect?(receipt.operation)
+                unless attempt.managed?
+                  raise AttemptErrors::InvalidState,
+                    "Taskless attempts cannot record external effects without managed evidence"
+                end
 
-            receipt = @verifier.verify!(
-              data,
-              attempt: attempt,
-              identity: identity,
-              live_head: live_head,
-              repo_root: @repo_root
-            )
-            if @verifier.external_effect?(receipt.operation)
-              unless attempt.managed?
-                raise AttemptErrors::InvalidState,
-                  "Taskless attempts cannot record external effects without managed evidence"
+                require_review_evidence(attempt, live_head)
               end
 
-              require_review_evidence(attempt, live_head)
+              accept(attempt, receipt, live_head)
             end
-
-            accept(attempt, receipt, live_head)
           end
         end
 
@@ -485,7 +544,8 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
           unless data["verdict"] == "succeeded" && data["head"] == evidence_head && attempt.candidate_head == evidence_head
             raise AttemptErrors::ReceiptRejected, "Accepted execution evidence is stale or unsuccessful"
           end
-          @verifier.verify_accepted_evidence!(data, live_head: evidence_head, repo_root: @repo_root)
+          @verifier.verify_accepted_evidence!(data, live_head: evidence_head, repo_root: @repo_root,
+            historical: !historical_head.nil?)
           {"attempt_id" => attempt_id, "receipt_digest" => receipt_digest, "head" => evidence_head, "kind" => kind,
            "historical" => !historical_head.nil?,
            "operation" => data["operation"], "checks" => data["checks"], "producer" => data["producer"], "review" => data["review"],
@@ -511,24 +571,27 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
           probe = @store.find(attempt_id) || recover_managed_attempt(nil, attempt_id)
           raise AttemptErrors::NotFound, "Attempt '#{attempt_id}' not found" unless probe
 
-          @store.with_lock(probe.binding.assignment_id) do
-            attempt = @store.load(probe.binding.assignment_id, attempt_id) ||
-              recover_managed_attempt(probe.binding.assignment_id, attempt_id)
-            raise AttemptErrors::NotFound, "Attempt '#{attempt_id}' not found" unless attempt
+          # Terminal commits hold the exclusive exclusion (see finish).
+          lifecycle_exclusion.with_exclusive(lifecycle_exclusion.assignment_key(probe.binding.assignment_id)) do
+            @store.with_lock(probe.binding.assignment_id) do
+              attempt = @store.load(probe.binding.assignment_id, attempt_id) ||
+                recover_managed_attempt(probe.binding.assignment_id, attempt_id)
+              raise AttemptErrors::NotFound, "Attempt '#{attempt_id}' not found" unless attempt
 
-            derived = ensure_journal_consistent!(attempt, allow_uncertain: true) if attempt.managed?
-            # The journal is authoritative for managed attempts: uncertainty
-            # journaled after the local save drives reconciliation.
-            attempt = attempt.with(state: derived.state) if derived&.state == "uncertain" && attempt.state == "running"
+              derived = ensure_journal_consistent!(attempt, allow_uncertain: true) if attempt.managed?
+              # The journal is authoritative for managed attempts: uncertainty
+              # journaled after the local save drives reconciliation.
+              attempt = attempt.with(state: derived.state) if derived&.state == "uncertain" && attempt.state == "running"
 
-            if attempt.terminal?
-              raise AttemptErrors::InvalidState, "Attempt #{attempt_id} is terminal; accepted history is immutable"
-            end
+              if attempt.terminal?
+                raise AttemptErrors::InvalidState, "Attempt #{attempt_id} is terminal; accepted history is immutable"
+              end
 
-            return classify_running(attempt) if attempt.state == "running"
+              return classify_running(attempt) if attempt.state == "running"
 
-            identity ||= @identity_resolver.resolve
-            resolve_uncertain(attempt, receipt_path, identity)
+              identity ||= @identity_resolver.resolve
+              resolve_uncertain(attempt, receipt_path, identity)
+            end
           end
         end
 

data/lib/ace/assign/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Assign
-    VERSION = "0.61.0"
+    VERSION = "0.62.0"
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-assign
 version: !ruby/object:Gem::Version
-  version: 0.61.0
+  version: 0.62.0
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-02 00:00:00.000000000 Z
+date: 2026-10-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-support-cli