ace-assign 0.61.1 → 0.62.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d55939eec104b31f029b0e8a703977c5b06afc67a82ddbc1b6274c9fa471bd21
-  data.tar.gz: e9f910d2474dbbdee91b75760c25711f32169c0a8e8ea476ef01ec1dd9ac8526
+  metadata.gz: 17761502c8b23ff60844d6a3da34ddde53c776d18907a23854ad4168dec3c033
+  data.tar.gz: 1538f48c6aec44ac548dcc116bddc0c4928cbc876485513b616604f886f0deb0
 SHA512:
-  metadata.gz: 86d8c02efe5e126b34d683eba6c81dc1e49367e2f847c08f3cad560bde57cfebae491745346b3cfd852fccbf067e7581f01c6175068a88e7d41df24b363cab35
-  data.tar.gz: 27c7e06bfc8e553615416ea1ec36f3bc7d4a818bf7e5c844d16fb130ef6384e8132af30e5271f529679c69714e6b222620b4bb8a8e40f2c20755735df855aa22
+  metadata.gz: 7f6b66a87f7a32496f11974ced9cb200c092488f027eb233dde59703ba3dcffa2eaad309d1f57b0b023113eb3f08c58e451b69823a33533d80c5fb45b79110e2
+  data.tar.gz: 6d0c8ef8b69d5002b98b60b22018fdc4aecf809818284e80bd11c70020a9733b9ba37140237b30fea470d539de23ce98a658bec902b1a6b9bf4454329ab50ed9

data/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.62.0] - 2026-10-04
+
+### Added
+- **Lock-scoped external attempt authority (spec 8wq.t.34i)**: `AttemptCoordinator#with_verified_attempt` verifies that a managed attempt is live (reserved/running — uncertainty never grants external authority), bound to the exact assignment/project, and owned by the requesting actor, holding the assignment `LifecycleExclusion` shared side across the caller's whole locked transition. `finish` and `reconcile` hold the exclusive side across their terminal commits, so a liveness check can never observe an attempt as active after the terminal event landed (and vice versa). This is the authority behind ace-hitl's managed HITL request binding.
+
+
 ## [0.61.1] - 2026-10-02
 
 ### Fixed

data/lib/ace/assign/organisms/attempt_coordinator.rb

@@ -104,6 +104,29 @@ module Ace
           end
         end
 
+        # The exact-authority check behind with_verified_attempt: the
+        # journal-derived managed attempt must be live (reserved/running —
+        # uncertainty is unproven liveness and never grants external
+        # authority) and bound to the exact assignment, project, and
+        # requesting actor.
+        def verified_attempt(assignment_id:, attempt_id:, project_id:, requester:)
+          attempt = journal_for.derived_attempts(assignment_id)
+            .find { |candidate| candidate.attempt_id == attempt_id }
+          raise AttemptErrors::NotFound, "Attempt '#{attempt_id}' not found" unless attempt
+
+          unless attempt.managed? && %w[reserved running].include?(attempt.state) &&
+              attempt.binding.assignment_id == assignment_id &&
+              attempt.binding.project_id == project_id
+            raise AttemptErrors::ReceiptRejected,
+              "Authority request does not match an active managed attempt"
+          end
+          unless attempt.binding.actor == requester
+            raise AttemptErrors::UnauthorizedIdentity,
+              "Requester #{requester.inspect} does not own attempt '#{attempt_id}'"
+          end
+          attempt
+        end
+
         def reject_service_request(binding, reason:)
           service_attempt(binding)
           journal_for.reject_service_request(binding, reason: reason)
@@ -299,6 +322,36 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
           true
         end
 
+        # Hold verified authority over one managed attempt for the duration
+        # of a single external transition (the HITL consume/deliver
+        # critical sections). The shared exclusion side is held across the
+        # yielded transition, so a terminal commit (finish/reconcile hold
+        # the exclusive side) or a prune cannot land between the liveness
+        # check and the caller's commit: stale, ended or replaced attempts
+        # cannot acquire new authority. Authority is attribution over
+        # journal facts and the requesting identity — never a process id,
+        # runtime marker, or caller-supplied name.
+        #
+        # @param assignment_id [String] Owning assignment ID
+        # @param attempt_id [String] Attempt ID
+        # @param project_id [String] Project the attempt must be bound to
+        # @param requester [String] Authenticated requester (execution-
+        #   boundary identity of the caller, matched against binding actor)
+        # @yield [attempt] the verified managed attempt
+        # @raise [AttemptErrors::NotFound, AttemptErrors::ReceiptRejected,
+        #   AttemptErrors::UnauthorizedIdentity] on any authority doubt
+        def with_verified_attempt(assignment_id:, attempt_id:, project_id:, requester:)
+          assignment_id = assignment_id.to_s
+          attempt_id = attempt_id.to_s
+          lifecycle_exclusion.with_shared(lifecycle_exclusion.assignment_key(assignment_id)) do
+            attempt = verified_attempt(
+              assignment_id: assignment_id, attempt_id: attempt_id,
+              project_id: project_id.to_s, requester: requester.to_s
+            )
+            yield attempt
+          end
+        end
+
         # Start a scoped attempt for an assignment.
         #
         # A repeated identical start returns the existing active attempt; a
@@ -392,38 +445,44 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
           data = read_receipt_file(receipt_path)
           assignment_id = data["assignment_id"].to_s
 
-          # Serialize load-validate-accept so concurrent finishes observe one
-          # consistent state and cannot persist contradictory terminal outcomes.
-          @store.with_lock(assignment_id) do
-            attempt = @store.load(assignment_id, attempt_id) || recover_managed_attempt(assignment_id, attempt_id)
-            raise AttemptErrors::NotFound, "Attempt '#{attempt_id}' not found" unless attempt
-
-            ensure_journal_consistent!(attempt) if attempt.managed?
-            raise AttemptErrors::InvalidState, "Attempt #{attempt_id} is terminal; accepted history is immutable" if attempt.terminal?
-            raise AttemptErrors::InvalidState, "Attempt #{attempt_id} is uncertain; reconcile before finishing" if attempt.uncertain?
-
-            identity ||= @identity_resolver.resolve
-            live_head = candidate_head!
-
-            attempt = invalidate_stale_candidate(attempt, live_head)
+          # Terminal commits hold the exclusive exclusion so an external
+          # liveness reader (with_verified_attempt holds the shared side
+          # across its whole transition) can never observe the attempt as
+          # active after the terminal event landed.
+          lifecycle_exclusion.with_exclusive(lifecycle_exclusion.assignment_key(assignment_id)) do
+            # Serialize load-validate-accept so concurrent finishes observe one
+            # consistent state and cannot persist contradictory terminal outcomes.
+            @store.with_lock(assignment_id) do
+              attempt = @store.load(assignment_id, attempt_id) || recover_managed_attempt(assignment_id, attempt_id)
+              raise AttemptErrors::NotFound, "Attempt '#{attempt_id}' not found" unless attempt
+
+              ensure_journal_consistent!(attempt) if attempt.managed?
+              raise AttemptErrors::InvalidState, "Attempt #{attempt_id} is terminal; accepted history is immutable" if attempt.terminal?
+              raise AttemptErrors::InvalidState, "Attempt #{attempt_id} is uncertain; reconcile before finishing" if attempt.uncertain?
+
+              identity ||= @identity_resolver.resolve
+              live_head = candidate_head!
+
+              attempt = invalidate_stale_candidate(attempt, live_head)
+
+              receipt = @verifier.verify!(
+                data,
+                attempt: attempt,
+                identity: identity,
+                live_head: live_head,
+                repo_root: @repo_root
+              )
+              if @verifier.external_effect?(receipt.operation)
+                unless attempt.managed?
+                  raise AttemptErrors::InvalidState,
+                    "Taskless attempts cannot record external effects without managed evidence"
+                end
 
-            receipt = @verifier.verify!(
-              data,
-              attempt: attempt,
-              identity: identity,
-              live_head: live_head,
-              repo_root: @repo_root
-            )
-            if @verifier.external_effect?(receipt.operation)
-              unless attempt.managed?
-                raise AttemptErrors::InvalidState,
-                  "Taskless attempts cannot record external effects without managed evidence"
+                require_review_evidence(attempt, live_head)
               end
 
-              require_review_evidence(attempt, live_head)
+              accept(attempt, receipt, live_head)
             end
-
-            accept(attempt, receipt, live_head)
           end
         end
 
@@ -512,24 +571,27 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
           probe = @store.find(attempt_id) || recover_managed_attempt(nil, attempt_id)
           raise AttemptErrors::NotFound, "Attempt '#{attempt_id}' not found" unless probe
 
-          @store.with_lock(probe.binding.assignment_id) do
-            attempt = @store.load(probe.binding.assignment_id, attempt_id) ||
-              recover_managed_attempt(probe.binding.assignment_id, attempt_id)
-            raise AttemptErrors::NotFound, "Attempt '#{attempt_id}' not found" unless attempt
+          # Terminal commits hold the exclusive exclusion (see finish).
+          lifecycle_exclusion.with_exclusive(lifecycle_exclusion.assignment_key(probe.binding.assignment_id)) do
+            @store.with_lock(probe.binding.assignment_id) do
+              attempt = @store.load(probe.binding.assignment_id, attempt_id) ||
+                recover_managed_attempt(probe.binding.assignment_id, attempt_id)
+              raise AttemptErrors::NotFound, "Attempt '#{attempt_id}' not found" unless attempt
 
-            derived = ensure_journal_consistent!(attempt, allow_uncertain: true) if attempt.managed?
-            # The journal is authoritative for managed attempts: uncertainty
-            # journaled after the local save drives reconciliation.
-            attempt = attempt.with(state: derived.state) if derived&.state == "uncertain" && attempt.state == "running"
+              derived = ensure_journal_consistent!(attempt, allow_uncertain: true) if attempt.managed?
+              # The journal is authoritative for managed attempts: uncertainty
+              # journaled after the local save drives reconciliation.
+              attempt = attempt.with(state: derived.state) if derived&.state == "uncertain" && attempt.state == "running"
 
-            if attempt.terminal?
-              raise AttemptErrors::InvalidState, "Attempt #{attempt_id} is terminal; accepted history is immutable"
-            end
+              if attempt.terminal?
+                raise AttemptErrors::InvalidState, "Attempt #{attempt_id} is terminal; accepted history is immutable"
+              end
 
-            return classify_running(attempt) if attempt.state == "running"
+              return classify_running(attempt) if attempt.state == "running"
 
-            identity ||= @identity_resolver.resolve
-            resolve_uncertain(attempt, receipt_path, identity)
+              identity ||= @identity_resolver.resolve
+              resolve_uncertain(attempt, receipt_path, identity)
+            end
           end
         end
 

data/lib/ace/assign/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Assign
-    VERSION = "0.61.1"
+    VERSION = "0.62.0"
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-assign
 version: !ruby/object:Gem::Version
-  version: 0.61.1
+  version: 0.62.0
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-03 00:00:00.000000000 Z
+date: 2026-10-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-support-cli