ace-assign 0.63.1 → 0.64.0

data/lib/ace/assign/cli/commands/authority/terminate.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+require "json"
+require_relative "../../../authority/launch_driver"
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        module Authority
+          class Terminate < Ace::Support::Cli::Command
+            desc "Close the original gated native child and request proven abort"
+            option :mapping, required: true, desc: "Installed launch mapping ID"
+            option :assignment, required: true, desc: "Assignment ID"
+            option :attempt, required: true, desc: "Attempt ID"
+            def call(**options)
+              client = Ace::Assign::Authority::Client.new(mapping_id: options.fetch(:mapping))
+              state = client.call("inspect_launch", {"assignment_id" => options.fetch(:assignment), "attempt_id" => options.fetch(:attempt)}).data
+              binding = state.fetch("process_binding") { raise ArgumentError, "no positively recorded original child; supervisor inspection required" }
+              result = Ace::Assign::Authority::LaunchDriver.new(mapping_id: options.fetch(:mapping)).terminate(
+                state: state, binding: binding, evidence: "protected exact-child termination requested")
+              puts JSON.generate(result)
+            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
+              raise Ace::Support::Cli::Error, error.message
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/create.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+require "json"
 
 module Ace
   module Assign
@@ -10,6 +11,7 @@ module Ace
 
           desc "Create a new workflow assignment"
 
+          option :delivery_parameters, desc: "JSON file with forge selection and explicit PR provenance (task mode)"
           option :yaml, desc: "Path to job.yaml config file"
           option :task, aliases: ["-t"], type: :array,
             desc: "Task reference(s), repeatable and comma-separated"
@@ -19,13 +21,15 @@ module Ace
 
           def call(yaml: nil, task: nil, preset: nil, **options)
             validate_modes!(yaml, task, preset)
+            raise Ace::Support::Cli::Error, "--delivery-parameters requires --task" if yaml && options[:delivery_parameters]
 
             result = if yaml
               Organisms::AssignmentExecutor.new.start(yaml)
             else
               Organisms::TaskAssignmentCreator.new.call(
                 task_refs: task,
-                preset_name: preset || Organisms::TaskAssignmentCreator::DEFAULT_PRESET
+                preset_name: preset || Organisms::TaskAssignmentCreator::DEFAULT_PRESET,
+                delivery_parameters: options[:delivery_parameters] && JSON.parse(File.read(options[:delivery_parameters]))
               )
             end
 
@@ -34,6 +38,10 @@ module Ace
               print_assignment_header(result[:assignment])
               print_step_instructions(result[:current] || result[:state]&.next_workable)
             end
+          rescue JSON::ParserError, Errno::ENOENT
+            raise Ace::Support::Cli::Error, "Delivery parameters file unavailable or invalid JSON"
+          rescue ArgumentError => e
+            raise Ace::Support::Cli::Error, e.message
           end
 
           private

data/lib/ace/assign/cli/commands/delivery.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+require "json"
+
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        class Delivery < Ace::Support::Cli::Command
+          desc "Execute or reconcile attempt-bound forge delivery"
+          option :assignment, required: true, desc: "Managed assignment ID"
+          option :attempt, required: true, desc: "Active delivery attempt ID"
+          option :operation, required: true, desc: "create, update, ready, review, merge, status"
+          option :parameters, desc: "JSON delivery parameters (otherwise assignment source delivery mapping)"
+          option :title, desc: "PR title"
+          option :body_file, desc: "PR description file"
+          option :tests, desc: "JSON reference to coordinator-accepted test attempt and receipt digest"
+          option :review, desc: "JSON reference to coordinator-accepted independent review attempt and receipt digest"
+          option :service_request, desc: "Completed authorized qjx merge request ID (merge consumption only)"
+
+          def call(**options)
+            result = build_delivery.perform(assignment_id: options[:assignment], attempt_id: options[:attempt],
+              operation: options[:operation], parameters: read_json(options[:parameters]),
+              title: options[:title], body: options[:body_file] && File.read(options[:body_file]),
+              tests: read_json(options[:tests]), review: read_json(options[:review]),
+              service_request_id: options[:service_request])
+            puts JSON.generate(json_value(result))
+          rescue ArgumentError, Ace::Git::Error, Ace::Assign::Error, Errno::ENOENT => e
+            raise Ace::Support::Cli::Error, e.message
+          end
+
+          private
+
+          def build_delivery
+            Organisms::DeliveryCoordinator.new(repo_root: Ace::Support::Fs::Molecules::ProjectRootFinder.find_or_current)
+          end
+
+          def read_json(path)
+            return nil unless path
+            data = JSON.parse(File.read(path))
+            raise ArgumentError, "Delivery input must be a JSON object" unless data.is_a?(Hash)
+            data
+          rescue JSON::ParserError
+            raise ArgumentError, "Delivery input must be valid JSON"
+          end
+
+          def json_value(value)
+            case value
+            when Hash then value.transform_values { |item| json_value(item) }
+            when Array then value.map { |item| json_value(item) }
+            else value.respond_to?(:to_h) ? json_value(value.to_h) : value
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/inbox_reconcile.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        class InboxReconcile < Ace::Support::Cli::Command
+          include Ace::Support::Cli::Base
+          desc "Verify a Herdr inbox proof and record its references in the assignment journal"
+          option :attempt, desc: "Exact attempt ID"
+          option :event, desc: "Herdr inbox event ID"
+          option :receipt, desc: "Existing native receipt JSON file with detached FILE.sig"
+
+          def initialize(coordinator: nil, inbox: nil)
+            super()
+            @coordinator = coordinator
+            @inbox = inbox
+          end
+
+          def call(**options)
+            %i[attempt event receipt].each do |key|
+              raise Ace::Support::Cli::Error, "--#{key} is required" if options[key].to_s.strip.empty?
+            end
+            result = (@coordinator || Organisms::AttemptCoordinator.new).reconcile_inbox(
+              attempt_id: options[:attempt], event_id: options[:event], receipt_path: options[:receipt],
+              inbox: @inbox || Ace::Herdr::Organisms::Inbox.from_config)
+            # Keep the public projection bounded; raw native output and the
+            # human observation text belong to the existing receipt file.
+            puts JSON.generate(result.slice("event_id", "attempt_id", "state", "claim_generation",
+              "receipt_key_sha256", "reconciliation_refusal"))
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/resume.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        class Resume < Ace::Support::Cli::Command
+          include Ace::Support::Cli::Base
+          desc "Recover accepted assignment state without launching another writer"
+          option :assignment, desc: "Assignment ID"
+          option :dry_run, type: :boolean, default: false, desc: "Inspect recovery without writing observations"
+
+          def call(**options)
+            id = options[:assignment].to_s.strip
+            raise Ace::Support::Cli::Error, "--assignment ID is required" if id.empty?
+
+            puts JSON.generate(Organisms::AttemptCoordinator.new.resume(
+              assignment_id: id, dry_run: options[:dry_run]))
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli.rb

@@ -44,6 +44,7 @@ require_relative "molecules/runtime_control_surface_runner"
 require_relative "molecules/preset_inferrer"
 require_relative "molecules/evidence_calculator"
 require_relative "molecules/evidence_journal"
+require_relative "molecules/canonical_evidence"
 require_relative "molecules/execution_identity_resolver"
 require_relative "molecules/receipt_verifier"
 require_relative "molecules/attempt_reconciler"
@@ -53,9 +54,12 @@ require_relative "organisms/assignment_executor"
 require_relative "organisms/attempt_coordinator"
 
 # Commands
+require_relative "cli/commands/delivery"
 require_relative "cli/commands/create"
 require_relative "cli/commands/assignment_target"
 require_relative "cli/commands/status"
+require_relative "cli/commands/resume"
+require_relative "cli/commands/inbox_reconcile"
 require_relative "cli/commands/step"
 require_relative "cli/commands/start"
 require_relative "cli/commands/finish"
@@ -66,6 +70,10 @@ require_relative "cli/commands/list"
 require_relative "cli/commands/select"
 require_relative "cli/commands/fork_run"
 require_relative "cli/commands/fork_session"
+require_relative "cli/commands/authority/serve"
+require_relative "cli/commands/authority/launch"
+require_relative "cli/commands/authority/status"
+require_relative "cli/commands/authority/terminate"
 require_relative "cli/commands/attempt/base"
 require_relative "cli/commands/attempt/start"
 require_relative "cli/commands/attempt/status"
@@ -84,6 +92,11 @@ module Ace
       # Application commands with descriptions (for help output)
       REGISTERED_COMMANDS = [
         ["create", "Create assignment from preset or YAML"],
+        ["authority serve", "Serve the installed protected assignment owner"],
+        ["authority launch", "Launch one mapped native gated worker"],
+        ["authority status", "Inspect protected launch ownership"],
+        ["authority terminate", "Terminate the original native gated child"],
+        ["delivery", "Execute or reconcile attempt-bound forge delivery"],
         ["status", "Show assignment status"],
         ["step", "Show step instructions"],
         ["start", "Start next workable step"],
@@ -110,7 +123,8 @@ module Ace
         "cat report.md | ace-assign finish     # Complete step via stdin",
         "ace-assign fork-run 010.01            # Run subtree in subprocess",
         "ace-assign attempt start --assignment ID --step 010 --project ID",
-        "ace-assign attempt finish --attempt ID --receipt receipt.json"
+        "ace-assign attempt finish --attempt ID --receipt receipt.json",
+        "ace-assign resume --assignment ID --dry-run"
       ].freeze
 
       # Captured command exit code from last run
@@ -146,7 +160,12 @@ module Ace
       end
 
       # Register commands (wrapped to capture exit codes)
+      register "authority serve", wrap_command(Commands::Authority::Serve)
+register "authority launch", wrap_command(Commands::Authority::Launch)
+register "authority status", wrap_command(Commands::Authority::Status)
+register "authority terminate", wrap_command(Commands::Authority::Terminate)
       register "create", wrap_command(Commands::Create)
+      register "delivery", wrap_command(Commands::Delivery)
       register "status", wrap_command(Commands::Status)
       register "step", wrap_command(Commands::Step)
       register "start", wrap_command(Commands::Start)
@@ -163,6 +182,8 @@ module Ace
       register "attempt evidence", wrap_command(Commands::Attempt::Evidence)
       register "attempt finish", wrap_command(Commands::Attempt::Finish)
       register "attempt reconcile", wrap_command(Commands::Attempt::Reconcile)
+      register "resume", wrap_command(Commands::Resume)
+      register "inbox-reconcile", wrap_command(Commands::InboxReconcile)
 
       # Register version command
       version_cmd = Ace::Support::Cli::VersionCommand.build(

data/lib/ace/assign/models/evidence_event.rb

@@ -17,7 +17,9 @@ module Ace
         TYPES = %w[
           intent process_start receipt_accepted transition
           candidate_invalidated reconciliation
-          service_claim service_transition
+          service_claim service_transition recovery_observation inbox_binding inbox_reconciliation delivery
+          authority_mutation evidence_import proposal_state result_submitted
+          scope_provisioning scope_bound scope_native_bound scope_child_bound scope_sealed scope_closed_no_writers
         ].freeze
 
         # Build an event chained to a previous digest.

data/lib/ace/assign/molecules/attempt_reconciler.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
+require "json"
+
 module Ace
   module Assign
     module Molecules
       # Conservative classification and resolution of interrupted attempts.
       #
       # Classification of a `running` attempt found after a lost session:
-      # - no recorded process start -> `stopped` (nothing could have run)
+      # - no recorded process start -> `uncertain` (launch may be unbound)
       # - recorded process still verifiably live -> keep `running`
       # - otherwise -> `uncertain` (the operation may have completed without
       #   a durable receipt)
@@ -19,9 +21,11 @@ module Ace
       class AttemptReconciler
         # @param journal [EvidenceJournal, nil] Managed evidence journal
         # @param verifier [ReceiptVerifier, nil] Receipt verifier (coordinator supplies on use)
-        def initialize(journal: nil, verifier: nil)
+        def initialize(journal: nil, verifier: nil, observer: nil, runtime_resolver: Ace::Runtime)
           @journal = journal
           @verifier = verifier
+          @observer = observer || Ace::Runtime::Molecules::ProcessIdentity.new
+          @runtime_resolver = runtime_resolver
         end
 
         # Classify a running attempt after an interruption.
@@ -30,8 +34,6 @@ module Ace
         # @return [Symbol] :stopped, :live, or :uncertain
         def classify(attempt)
           return :live if process_live?(attempt)
-          return :stopped unless process_started?(attempt)
-
           :uncertain
         end
 
@@ -44,15 +46,27 @@ module Ace
         # @param attempt [Models::Attempt] Attempt to inspect
         # @return [Boolean] True when the recorded process is verifiably alive
         def process_live?(attempt)
-          pid = start_event(attempt)&.dig("payload", "pid")
-          return false unless pid
+          observation(attempt)["liveness"] == "live"
+        end
+
+        def observation(attempt)
+          payload = start_event(attempt)&.dig("payload")
+          observation = @observer.observe(payload&.dig("process_identity"))
+          binding = payload&.dig("runtime_binding")
+          return observation unless binding && observation["liveness"] == "live"
+
+          live = @runtime_resolver.resolve(binding["runtime"]).process_binding(
+            pane: binding["pane"], caller_pid: binding.dig("process_identity", "pid"))
+          return observation if binding == live
 
-          Process.kill(0, pid)
-          true
-        rescue Errno::EPERM
-          true
-        rescue Errno::ESRCH, TypeError, ArgumentError
-          false
+          observation.merge("liveness" => "unknown", "reason" => "native process/session binding changed")
+        rescue Ace::Runtime::Error
+          {"liveness" => "unknown", "observed_at" => Time.now.utc.iso8601,
+            "reason" => "native process/session observation unavailable"}
+        end
+
+        def events(attempt)
+          events_for(attempt)
         end
 
         # Runtime recorded at the attempt's process start — the boundary any
@@ -64,6 +78,11 @@ module Ace
           start_event(attempt)&.dig("payload", "runtime")
         end
 
+        def recorded_binding(attempt)
+          binding = start_event(attempt)&.dig("payload", "runtime_binding")
+          JSON.parse(JSON.generate(binding)) if binding.is_a?(Hash)
+        end
+
         private
 
         def start_event(attempt)

data/lib/ace/assign/molecules/canonical_evidence.rb

@@ -0,0 +1,150 @@
+# frozen_string_literal: true
+
+require "digest"
+require "securerandom"
+require "time"
+
+module Ace
+  module Assign
+    module Molecules
+      # One import/verification contract for protected review, service and
+      # inbox evidence. Filesystem projections never supply accepted bytes.
+      class CanonicalEvidence
+        MAX_ARTIFACT_BYTES = 64 * 1024
+        MAX_TOTAL_BYTES = 256 * 1024
+        MAX_ARTIFACTS = 16
+        ID = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/
+        ROLES = {"service" => "executor", "review" => "reviewer", "inbox" => "signer",
+                 "observation" => "observer", "result" => "worker"}.freeze
+        DESCRIPTOR_FIELDS = %w[version artifact_id kind project_id assignment_id attempt_id peer_uid role
+          binding_digest sha256 bytes admitted_at admitted_after_event_digest request_id_or_event_id
+          candidate_generation_or_claim_generation].freeze
+
+        # Shared closed descriptor validation before clients accept any bytes.
+        def self.valid_descriptor?(descriptor)
+          return false unless descriptor.is_a?(Hash) && descriptor.keys.sort == DESCRIPTOR_FIELDS.sort &&
+            descriptor["version"] == 1 && ROLES.key?(descriptor["kind"]) && ROLES[descriptor["kind"]] == descriptor["role"] &&
+            %w[artifact_id project_id assignment_id attempt_id request_id_or_event_id].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(ID) } &&
+            %w[binding_digest sha256 admitted_after_event_digest].all? { |key| descriptor[key].is_a?(String) && descriptor[key].match?(/\A[0-9a-f]{64}\z/) } &&
+            descriptor["peer_uid"].is_a?(Integer) && descriptor["peer_uid"] >= 0 &&
+            descriptor["bytes"].is_a?(Integer) && descriptor["bytes"].between?(0, MAX_ARTIFACT_BYTES) &&
+            descriptor["candidate_generation_or_claim_generation"].is_a?(Integer) && descriptor["candidate_generation_or_claim_generation"] >= 0 &&
+            descriptor["admitted_at"].is_a?(String)
+          Time.iso8601(descriptor.fetch("admitted_at"))
+          true
+        rescue ArgumentError, TypeError
+          false
+        end
+
+        def initialize(journal:)
+          @journal = journal
+        end
+
+        # Construct the immutable bytes/events for EvidenceJournal#mutate.
+        # peer_uid comes from the accepted kernel-authenticated connection;
+        # callers of the wire API cannot supply provenance or artifact IDs.
+        def import_plan(kind:, project_id:, assignment_id:, attempt_id:, peer_uid:, binding:,
+          request_id_or_event_id:, generation:, admitted_after_event_digest:, artifacts:)
+          role = ROLES.fetch(kind) { raise ArgumentError, "invalid evidence kind" }
+          ids = [project_id, assignment_id, attempt_id, request_id_or_event_id]
+          unless ids.all? { |id| id.is_a?(String) && id.match?(ID) } && binding.is_a?(Hash) &&
+              admitted_after_event_digest.is_a?(String) && admitted_after_event_digest.match?(/\A[0-9a-f]{64}\z/) &&
+              peer_uid.is_a?(Integer) && peer_uid >= 0 && generation.is_a?(Integer) && generation >= 0 &&
+              artifacts.is_a?(Array) && !artifacts.empty? && artifacts.length <= MAX_ARTIFACTS &&
+              artifacts.all? { |bytes| bytes.is_a?(String) && bytes.bytesize <= MAX_ARTIFACT_BYTES } &&
+              artifacts.sum(&:bytesize) <= MAX_TOTAL_BYTES
+            raise ArgumentError, "invalid or oversized canonical evidence import"
+          end
+          events = []
+          blobs = {}
+          references = artifacts.map do |bytes|
+            artifact_id = SecureRandom.hex(16)
+            artifact_id += "-no-effect" if kind == "service" && binding["no_effect_challenge"]
+            digest = Digest::SHA256.hexdigest(bytes.b)
+            path = "evidence/imports/#{artifact_id}"
+            descriptor = {"version" => 1, "artifact_id" => artifact_id, "kind" => kind,
+                          "project_id" => project_id, "assignment_id" => assignment_id,
+                          "attempt_id" => attempt_id, "peer_uid" => peer_uid, "role" => role,
+                          "binding_digest" => Atoms::EvidenceDigest.digest(binding), "sha256" => digest,
+                          "bytes" => bytes.bytesize, "admitted_at" => Time.now.utc.iso8601(9),
+                          "admitted_after_event_digest" => admitted_after_event_digest,
+                          "request_id_or_event_id" => request_id_or_event_id,
+                          "candidate_generation_or_claim_generation" => generation}
+            events << {type: "evidence_import", payload: descriptor}
+            blobs[path] = bytes.b
+            {"ref" => path, "sha256" => digest}
+          end
+          {events: events, blobs: blobs, references: references}
+        end
+
+        def read(reference, kind:, project_id:, assignment_id:, attempt_id:, peer_uid:, binding:,
+          request_id_or_event_id:, generation:, commit: @journal.ref_value)
+          # One immutable commit supplies both provenance events and bytes.
+          events = @journal.read_events(assignment_id, commit: commit)
+            .select { |event| event["attempt_id"] == attempt_id }
+          verified_bytes(reference, events: events, kind: kind, project_id: project_id,
+            assignment_id: assignment_id, attempt_id: attempt_id, peer_uid: peer_uid, binding: binding,
+            request_id_or_event_id: request_id_or_event_id, generation: generation) do |path|
+            @journal.blob(path, commit: commit)
+          end
+        end
+
+        # Only the journal writer supplies this transient pre-CAS view. It
+        # validates the exact same provenance/chain/bytes as committed reads;
+        # it does not accept a receipt or advance the canonical ref itself.
+        def read_pending(reference, current_events:, pending_events:, blobs:, commit:,
+          kind:, project_id:, assignment_id:, attempt_id:, peer_uid:, binding:,
+          request_id_or_event_id:, generation:)
+          events = current_events + pending_events
+          unless events.all? { |event| event["attempt_id"] == attempt_id } && blobs.is_a?(Hash)
+            unavailable!
+          end
+          verified_bytes(reference, events: events, kind: kind, project_id: project_id,
+            assignment_id: assignment_id, attempt_id: attempt_id, peer_uid: peer_uid, binding: binding,
+            request_id_or_event_id: request_id_or_event_id, generation: generation) do |path|
+            blobs.key?(path) ? blobs.fetch(path) : @journal.blob(path, commit: commit)
+          end
+        end
+
+        private
+
+        def verified_bytes(reference, events:, kind:, project_id:, assignment_id:, attempt_id:, peer_uid:, binding:,
+          request_id_or_event_id:, generation:)
+          unless reference.is_a?(Hash) && reference.keys.sort == %w[ref sha256] &&
+              reference["ref"].is_a?(String) && reference["ref"].match?(%r{\Aevidence/imports/[a-z0-9-]+\z})
+            unavailable!
+          end
+          unavailable! unless Models::EvidenceEvent.chain_valid?(events)
+          artifact_id = reference.fetch("ref").delete_prefix("evidence/imports/")
+          imports = events.select do |event|
+            event["type"] == "evidence_import" && event.dig("payload", "artifact_id") == artifact_id
+          end
+          unavailable! unless imports.length == 1
+          event = imports.first
+          descriptor = event.fetch("payload")
+          expected = {"version" => 1, "artifact_id" => artifact_id, "kind" => kind,
+                      "project_id" => project_id, "assignment_id" => assignment_id,
+                      "attempt_id" => attempt_id, "peer_uid" => peer_uid, "role" => ROLES.fetch(kind),
+                      "binding_digest" => Atoms::EvidenceDigest.digest(binding),
+                      "sha256" => reference.fetch("sha256"), "request_id_or_event_id" => request_id_or_event_id,
+                      "candidate_generation_or_claim_generation" => generation}
+          unavailable! unless self.class.valid_descriptor?(descriptor) &&
+            expected.all? { |key, value| descriptor[key] == value }
+          before = events.take_while { |entry| entry["digest"] != event["digest"] }
+          unavailable! unless before.any? { |entry| entry["digest"] == descriptor["admitted_after_event_digest"] }
+          Time.iso8601(descriptor.fetch("admitted_at"))
+          bytes = yield(reference.fetch("ref"))
+          unavailable! unless bytes.is_a?(String) && bytes.bytesize <= MAX_ARTIFACT_BYTES && bytes.bytesize == descriptor["bytes"] &&
+            Digest::SHA256.hexdigest(bytes) == descriptor["sha256"]
+          bytes
+        rescue ArgumentError, KeyError, TypeError
+          unavailable!
+        end
+
+        def unavailable!
+          raise AttemptErrors::EvidenceUnavailable, "Canonical evidence import or binding is unverifiable"
+        end
+      end
+    end
+  end
+end