ace-assign 0.63.1 → 0.66.0

data/docs/protected-authority.md

@@ -0,0 +1,282 @@
+---
+doc-type: user
+purpose: Fixed protected authority deployment and canonical launch lifecycle
+ace-docs:
+  last-updated: 2026-10-05
+  last-checked: 2026-10-05
+  subject:
+    - code:
+        diff:
+          paths:
+            - ace-assign/lib/ace/assign/authority/**/*.rb
+            - ace-assign/lib/ace/assign/molecules/execution_scope_lineage.rb
+            - ace-runtime/lib/ace/runtime/molecules/systemd_scope_manager.rb
+---
+
+# Protected native launch
+
+`ace-assign authority serve --authority AUTHORITY` runs the standalone launch
+composition. Lab owns the services composition using the same Assign server,
+router, lifecycle, journal and endpoint. Its full-service startup guard remains
+closed while required finish, recovery, inbox and no-effect handlers are incomplete.
+The installed `composition` must match the entrypoint. A project has exactly one
+configured authority owner; duplicate project owners or endpoints fail before
+listener creation.
+
+An administrator provisions `/etc/ace/assignment-authorities.json`. There is no
+caller-selected configuration path or local fallback. The outer object contains
+`schema: "ace.assign.authorities/v2"`, `authorities`, `projects`, and
+`launch_mappings`; unknown fields are refused. The fixed schema is implemented
+by `Ace::Assign::Authority::Deployment`:
+
+| Installed object | Required fields |
+| --- | --- |
+| `authorities.ID` | `uid`, `gid`, sorted unique `groups`, `socket_path`, `state_root`, `composition` (`launch` or `services`) |
+| `projects.ID` | `journal_repository`, `evidence_git_ref` (`refs/ace/execution`), `evidence_checkout_root`, `assignment_root`, `candidate_root`, `campaign_repository`, `campaign_store_root`, `launcher_uids`, `reviewer_uids`, `worker_uids`, `service_executor_uids`, `supervisor_uids`, `peer_credentials`, optional `service_receivers` |
+| `projects.ID.peer_credentials.UID` | `gid`, sorted unique `groups`, `scratch_root`; every configured role UID has one fixed entry |
+| `launch_mappings.ID` | `project_id`, `authority_id`, `launcher_uid`, `launcher_gid`, `launcher_groups`, `worker_uid`, `worker_gid`, `worker_groups`, `worker_actor`, `worker_cwd`, `worker_entry`, `worker_env`, `bootstrap`, `bootstrap_sha256`, `native`, `execution_scope`, `task_context_entry` |
+| `launch_mappings.ID.native` | `socket_path`, `executable`, `executable_sha256`, `version` (`0.9.3`), `protocol` (`22`), canonical `workspace_id` (`wN`) |
+| `launch_mappings.ID.execution_scope` | `backend` (`linux_systemd_cgroup_v2`), `slot_id`, `slice_unit`, `service_unit`, `unit_manifest_sha256`, `boundary_manifest_sha256`, `root_directory`, `runtime_directory`, `network_namespace_path` |
+
+A services composition requires a nonempty installed `service_receivers` map; launch composition may omit it. Each fixed service ID maps to exactly `{executor_uid, socket_path, staging_root}`. The positive nonroot executor UID belongs to the project's executor allowlist and cannot also be any configured authority, launcher, reviewer, worker or supervisor. This keeps kernel role selection unambiguous and private authority journals inaccessible to executors.
+
+Receiver socket and staging paths are canonical absolute paths with root-or-executor owned, nonwritable ancestry. Staging is executor-owned mode0700 and disjoint from other receiver staging and authority state roots. The endpoint resides outside private staging, where the actual authority can traverse its ancestry and inspect it. A pre-existing endpoint must be an executor-owned socket with its installed GID and no permissions for others. Duplicate receiver/authority endpoints, substituted paths and unreadable placement refuse before the authority opens its listener or creates journal state. These mappings select identity and placement; operation argv and grants remain the existing Lab ServicePolicy.
+
+All paths are canonical and absolute. The native socket identity is the observed
+`[device, inode, worker_uid]`. The server identity is the exact observed object
+`{pid, uid, gid, groups, parent_pid, started_at, host}`, where `started_at` is
+`linux:BOOT_ID:START_TICKS`. These observations must be made after the root-owned
+native service starts; they cannot be invented, copied from a previous boot, or
+supplied by a worker. The immutable per-attempt native stage owns these facts;
+the deployment record contains no persisted live server/socket tuple. A replacement
+cannot be repinned into the original generation.
+The root-installed native service, its executable, environment and configuration
+are trusted. Merely running arbitrary worker-supplied server code under the worker
+account does not meet this deployment contract.
+
+The authority, launcher and worker are distinct non-root accounts. Authority
+journal/cache/import/candidate/assignment/state roots are authority-owned 0700
+with protected ancestry. Peer scratch roots are private to their mapped account.
+The authority socket's directory prevents worker/launcher replacement; its group
+and narrow installer ACL must permit the configured peers to connect. Native
+socket ACL permits the trusted launcher to use the pinned Herdr API. The
+bootstrap, payload executable, native executable, mapping and their ancestors are
+root-owned and non-writable by the worker. Payload argv/cwd/environment are fixed
+installed data; loader and interpreter injection environment fields are refused.
+
+Linux Yama `ptrace_scope=2`, empty Inh/Prm/Eff/Bnd/Amb capabilities,
+`NoNewPrivs=1`, fixed real/effective/saved/filesystem UID/GID and supplementary
+groups are mandatory for every participant, including the pinned native server.
+The shipped [native build/install instructions](../../ace-runtime/native/README.md)
+describe architecture, distro dependencies, immutable artifact digest and service
+unit requirements. ACE verifies and refuses missing policy; it does not modify
+sysctls, create accounts, change another user's Herdr, or install service policy.
+
+After installation, the trusted launcher preflights without any mutation or
+native creation:
+
+```sh
+ace-assign authority launch --mapping MAPPING --dry-run
+```
+
+Launch one managed definition using a stable invocation ID:
+
+```sh
+ace-assign authority launch --mapping MAPPING --assignment ASSIGNMENT \
+  --definition /absolute/prepared-definition.json \
+  --prepared-bundle /absolute/prepared-input.bundle --step 010 \
+  --base-head EXACT_40_CHARACTER_COMMIT --mutation INVOCATION_ID
+```
+
+The final definition (maximum 32 KiB) includes the exact `prepared_work` Git
+head/tree, manifest and selected subtree reference, with matching `session_id`,
+`task_id` and installed `project_id`. `--prepared-bundle` is mandatory: it supplies
+the original complete prepared-input Git bundle, bounded to 64 MiB. Both inputs
+are read from held regular files with bounded reads and no final symlink following
+before launch effects. The authority derives the final definition from the verified
+prepared tree and commits it with the exact received bundle in one journal mutation.
+Reusing the same definition with different bundle bytes refuses. The owner-private
+definition cache remains separate from the worker queue. An active attempt blocks
+changed definitions. A fresh reservation creates canonical intent/provisioning,
+then the owner activates and binds its independent parent under the slot exclusion.
+It pins existing resource objects, the authority mount namespace and the installed
+nsfs network namespace. Parent binding selects protected network evidence references
+without asserting policy readiness or requiring an available report.
+
+Native service admission is a separate private canonical CAS after all required
+readiness evidence succeeds. Only its fresh winner may start the fixed service;
+replay and lost replies never permit another start. Native and original-child
+bindings remain separate immutable stages before payload release.
+
+The original authenticated native layout response fixes workspace/tab/pane and
+exact child lineage. Record captures that original child; bind creates the running
+attempt without payload permission. The immutable native bootstrap connects once,
+sets non-dumpable before admission, and waits for the separate release. Release
+commits issuance before one framed permission. Replay returns canonical issuance
+without sending another frame. Reply loss after issuance is potentially executed.
+A worker-controlled native input/close path can deny or interrupt launch, but cannot
+replace the authenticated origin or forge authority release.
+
+Inspect or request exact native termination through the same installed mapping.
+Once the original launcher process has exited, run these commands as a mapped
+recovery supervisor with the installed native close ACL; a new process under the
+launcher UID does not inherit the original launcher incarnation:
+
+```sh
+ace-assign authority status --mapping MAPPING --assignment ASSIGNMENT --attempt ATTEMPT
+ace-assign authority terminate --mapping MAPPING --assignment ASSIGNMENT --attempt ATTEMPT
+```
+
+A child pidfd proving exit cannot release the whole parent reservation. The
+connected never-native-admitted path seals the original parent before fixed service
+stop, records fresh exact recursive-empty/no-pending/resource closure, selects that
+canonical proof in the guarded pre-release abort, then privately commits reservation
+release after service/inbox settlement at the same immutable journal commit. A lost
+reply keeps the original accepted response. Restart can resume a missing private
+release without issuing native or payload permission. A new reservation first retires
+its exactly released predecessor through the same owner and slot exclusion.
+
+`observe_execution_scope` is read-only. `close_execution_scope` is an ordinary
+canonical mutation: the first fresh call seals, a later fresh call records closure
+when verifiable. A fresh sealed close can resume a lost fixed service stop; replay
+performs no manager I/O. The private `scope_service_admission` and
+`scope_reservation_release` operations are absent from the public allowlist.
+Reserve/close RPCs have a fixed 90-second ceiling for bounded manager waits;
+other control calls retain their existing ceiling.
+
+This source checkpoint proves the connected never-native-admitted failure/recovery
+path with controlled native-owner observations and real canonical journals. Full
+native hook/readiness and post-native writer observation, admitted-but-unbound
+cleanup, non-abort terminal release, and complete original/candidate installation
+maintenance remain separate required implementation work. The current maintenance
+helpers do not yet implement the accepted candidate-deployment union contract.
+No source fixture establishes installed namespace, network policy or containment
+acceptance; every installed SC remains open.
+
+Control replies are at most 16 KiB. Source-selected service transfer operations use
+a 16 KiB authenticated header followed by bounded raw bytes, a shared 30-second
+deadline, exact hashes, upload write-EOF and at most two active transfers. Exact
+origin/role admission happens before private spool allocation and is revalidated
+before canonical mutation. The standalone launch composition exposes no transfer
+operations.
+
+Source tests and Linux primitive fixtures are separate from installed deployment
+acceptance. A Docker kernel with Yama=0 is expected to refuse the product gate;
+it does not establish the required positive protected launch proof.
+
+Protected launch uses only `layout.apply` in the installed workspace. `workspace.get` checks that exact workspace ID before creation; its reply must echo the ID even when another workspace is active. Missing or replaced containers refuse without fallback. Container contents supply no worker evidence. The original fresh layout reply remains the source of the new tab/pane identity.
+
+Receiver admission reads Linux `system.posix_acl_access` on every directory from
+the endpoint parent and private staging root to `/`, and evaluates search access
+for the installed executor UID, primary GID and supplemental groups. Named user
+entries override group/other entries; the ACL mask constrains named user and
+group entries. Absence of an access ACL uses ordinary mode permissions;
+unsupported, unreadable or malformed ACL data refuses startup. The authority
+must also actually traverse the endpoint and staging parents. This inspection
+does not claim an executor readiness handshake or bypass additional LSM policy;
+the installed receiver still performs its own bind and private staging checks.
+
+## Canonical result Client API
+
+The source-owned services handlers accept a live mapped worker's bounded result
+without terminalizing the attempt or releasing scope. The public seam is
+`Ace::Assign::Authority::Client`; no result CLI is introduced. Launch-only
+`attempt_status` retains its existing schema without a result selector. These
+source handlers and their deterministic tests do not establish installed
+full-service deployment acceptance.
+
+From an admitted services attempt, discover its current candidate and authority
+generation, then upload receipt JSON bytes followed by its declared artifact
+bytes in order:
+
+```ruby
+require "ace/assign"
+require "json"
+require "digest"
+
+client = Ace::Assign::Authority::Client.new(mapping_id: mapping_id)
+binding = {"assignment_id" => assignment_id, "attempt_id" => attempt_id}
+status = client.call("attempt_status", binding.merge(
+  "result_candidate_generation" => nil
+)).data
+receipt_bytes = File.binread(local_receipt_path)
+receipt = JSON.parse(receipt_bytes)
+artifacts = receipt.fetch("artifacts").map { |ref| File.binread(ref.fetch("path")) }
+params = binding.merge(
+  "expected_generation" => status.fetch("authority_generation"),
+  "candidate_generation" => status.fetch("result_candidate_generation"),
+  "head" => receipt.fetch("head"),
+  "receipt_sha256" => Digest::SHA256.hexdigest(receipt_bytes)
+)
+reply = client.call("submit_result", params, mutation_id: persisted_mutation_id,
+  upload_parts: [receipt_bytes, *artifacts], purpose: :receipt_artifacts, timeout: 30)
+result = reply.data
+```
+
+Only local byte strings cross the boundary; receipt paths are declarations, not
+authority filesystem access. The authority checks exact canonical worker
+attribution, original receipt digest and SHA256, candidate, native lineage and
+current visibility. It normalizes artifact references and writes private
+`result_submitted` metadata, imported blobs and a sanitized mutation reply in one
+Git CAS. Failed results may have `artifacts: []`; no synthetic artifact is added.
+Campaign receipts refuse until the trusted campaign owner is integrated.
+
+Persist the exact params, mutation ID and ordered byte strings before submission.
+An exact retry while the worker remains live and the attempt active returns the
+same result without another import. A changed input or fresh mutation ID for the
+same candidate conflicts. Correcting a result requires a new candidate generation
+even at unchanged HEAD; both records remain immutable. Submission creates no
+`receipt_accepted` event or terminal transition.
+
+The reply contains result ID, head, candidate generation, verdict, ordered
+canonical `{path, sha256}` references, generation and journal commit. Its
+`uploaded_receipt_sha256`, `original_receipt_digest` and normalized
+`receipt_digest` are distinct values. Private receipt, producer and process
+binding are excluded from fresh and replay result replies.
+
+After reply loss or worker exit, the exact owning launcher or mapped supervisor
+can discover the retained result and fetch one referenced artifact:
+
+```ruby
+status = client.call("attempt_status", binding.merge(
+  "result_candidate_generation" => retained_generation # nil selects latest
+)).data
+result = status.fetch("submitted_result")
+if result && (reference = result.fetch("artifacts").first)
+  fetched = client.call("evidence_fetch", binding.merge(
+    "kind" => "result", "purpose_id" => result.fetch("result_id"),
+    "artifact_id" => reference.fetch("path").delete_prefix("evidence/imports/")
+  ), download: true, purpose: :artifacts, timeout: 30)
+  artifact_bytes = fetched.parts.fetch(0)
+end
+```
+
+Client closes its request write side for services status and evidence fetch;
+Server refuses extra body bytes before exposing either read projection. Status
+reads launch and result projections from one immutable canonical commit.
+`authority_generation` is the current CAS generation; a known candidate without
+a result has `submitted_result: null`. Unknown selected generation is `missing`;
+corrupt or missing referenced provenance is `evidence_unavailable`. Disposable
+caches and requester files never supply evidence.
+
+Fetch returns exactly `descriptor`, `generation`, `journal_commit` and the
+Server-generated `transfer` descriptor, with one binary part. Client validates
+the closed canonical descriptor, exact selected purpose, one-part framing,
+aggregate length and SHA256 before exposing bytes. Owning workers read only
+their own results; assigned reviewers read their exact retained review and
+same-candidate result under their live process binding; recorded executors read
+only their own service evidence. Exact owning launchers and mapped supervisors
+read permitted attempt evidence, including retained terminal history. Current
+visibility and peer authorization apply to every read. Reassignment revokes the
+old reviewer purpose. Inbox and observation evidence refuse until their existing
+signer and observer owners provide complete canonical provenance.
+
+The fixed worker entry is the closed `{interpreter: REF, wrapper: REF}` pair, with
+exact path/bytes/SHA256 references (interpreter<=32MiB, wrapper<=1MiB). The
+existing installed unit manifest associates the wrapper with `worker_executable`
+and the interpreter uniquely with `runtime_dependency`. The wrapper is source,
+so it need not carry executable permission; the selected interpreter must. The
+original retained mapping pair is part of the authenticated compact release.
+The native gate hashes held files, seals a readonly code snapshot, and uses the
+fixed isolated Python FD4/FD5 command while preserving operational stdio. No
+worker argv/shebang/PATH fallback remains. Native installed acceptance is separate.

data/docs/usage.md

@@ -89,7 +89,9 @@ ace-assign add --yaml .ace-local/assign/jobs/add-task.yml --after 010 --child
 
 Execution evidence lives in assignment attempts, not in reports. An attempt binds an immutable ID to an assignment, step/subtree scope, project, boundary-derived actor/role/runtime, source task, and `base_head`; the deliverable `candidate_head` is pinned only when accepted evidence is submitted, and the evidence journal commit is tracked separately from both.
 
-### Attempt lifecycle
+### Ordinary local attempt lifecycle
+
+Lifecycle exclusion uses the selected repository's actual Git common directory, shared by linked worktrees. `CACHE_BASE` changes assignment cache storage but cannot split creator and prune locks into a separate namespace. A missing Git repository or malformed retained removal fence refuses admission; it does not create a fallback lock root.
 
 ```bash
 ace-assign attempt start --assignment ASSIGNMENT --step STEP --project PROJECT
@@ -101,7 +103,21 @@ ace-assign attempt reconcile --attempt ATTEMPT --receipt receipt.json
 - `attempt start` returns a JSON projection of the attempt (ID, state, binding facts, evidence references, digests). A repeated identical start returns the same attempt; a conflicting start exits 5 without launching a second writer.
 - `attempt status` exposes only state, binding, references, and digests -- never credentials or receipt bytes.
 - `attempt finish` accepts a structured receipt: operation, attributed producer, exact tested/reviewed head, verdict, artifact paths with SHA-256 digests, executed checks, and -- for review operations -- an executed independent reviewer verdict for that head.
-- `attempt reconcile` classifies interrupted attempts (`stopped` before process start, `uncertain` when an effect cannot be proven either way, still `running` only for verifiably live processes) and resolves uncertainty only against a verified receipt attributed to the recorded execution boundary. Merge, publish, and deploy effects are never replayed automatically.
+- `attempt reconcile` classifies interrupted attempts (`uncertain` when launch or effect completion cannot be proven either way, still `running` only for verifiably live processes) and resolves uncertainty only against a verified receipt attributed to the recorded execution boundary. Merge, publish, and deploy effects are never replayed automatically.
+
+### Protected completion, recovery and Inbox registration
+
+```bash
+ace-assign attempt finish --mapping MAP --assignment ASSIGNMENT --attempt ATTEMPT --result RESULT --head SHA --candidate-generation N --mutation ID --expected-generation N
+ace-assign attempt reconcile --mapping MAP --assignment ASSIGNMENT --attempt ATTEMPT --mutation ID --expected-generation N
+ace-assign inbox-bind --mapping MAP --assignment ASSIGNMENT --attempt ATTEMPT --event EVENT --inbox-context CONTEXT --mutation ID --expected-generation N
+```
+
+The installed authority authenticates the current caller. Finish and recovery require the original launcher or an authorized mapped supervisor; Inbox binding requires the original worker or its authenticated descendant and an open execution scope. Installed current or retained authority, service and Inbox accounts also stay on the protected path: unsupported roles refuse rather than opening local authority.
+
+Protected finish selects an already submitted canonical result. A succeeded result requires accepted independent review for that exact candidate, prior no-writers proof and complete service settlement. It does not close the scope or accept `--receipt`. Protected recovery observes one original attempt; unresolved service effects remain unresolved. Terminal/released recovery returns authenticated retained selectors without creating another mutation or restarting execution. Inbox binding retains the original event/attempt attribution; fresh binding after scope seal refuses.
+
+Keep the original `--mutation` and `--expected-generation` for exact retries. Authority generation is distinct from `--candidate-generation`; rereading a newer generation changes the request. Assignment, attempt and mapping hints must agree with explicit selection. Commands print canonical JSON metadata and never resend effects during recovery.
 
 ### State machine
 
@@ -138,7 +154,14 @@ External service operations (driven through `ace-lab service request`) claim the
 
 - Task-attached (managed) attempts journal accepted evidence to the configured evidence Git ref (default `refs/ace/execution`) through an isolated, disposable audit checkout, outside the deliverable candidate branch. Journal commits never advance or exempt the reviewed candidate.
 - Taskless assignments persist attempts under `.ace-local/assign` with `recovery_mode: local_only`. This path never claims Git-backed recovery and cannot record external effects (`merge`, `publish`, `deploy`, `release`); attach the assignment to a source task before managed delivery.
-- Actor identity always comes from the execution boundary (OS login for local use, or the trusted service executor's identity). Unknown identity fails closed; flags never grant identity or authority.
+- Actor identity always comes from the execution boundary (the kernel process account for local use, or the trusted service executor's identity). Local execution requires equal real and effective UIDs and resolves the effective UID's OS account; terminal login, `USER`, and `LOGNAME` do not select the actor. Unknown accounts, changing credentials, and unsupported privilege transitions fail closed; flags never grant identity or authority. Historical attempt ownership is never rewritten.
+
+For developer callers, `Ace::Assign::Molecules::ExecutionIdentityResolver.new(adapter: "local").resolve.actor`
+returns `Etc.getpwuid(Process.euid).name` for an ordinary process, including one without a terminal login.
+If the OS account cannot be established or real/effective UIDs differ, it raises
+`Ace::Assign::AttemptErrors::UnauthorizedIdentity` (CLI exit code 5). Correct the process launch/account;
+setting `USER` or `LOGNAME` cannot authorize it. A previously recorded foreign owner still requires the
+existing recovery process; this change does not transfer ownership.
 
 ### status integration
 
@@ -409,3 +432,182 @@ ace-assign select --clear
 | 130 | Interrupted (SIGINT) |
 
 See [exit-codes.md](exit-codes.md) for complete descriptions.
+
+## Resume accepted assignment state
+
+```bash
+ace-assign resume --assignment ID --dry-run
+ace-assign resume --assignment ID
+```
+
+Resume returns JSON with task goal, checkpoint, attempts, pending HITL references and unresolved effect/inbox references. Each attempt reports `adopt`, `restart-required` or `reconcile-required`, liveness, recovery reason and its last verified observation. Dry-run writes nothing. Actual resume journals a bounded observation; unproven running attempts become uncertain and keep their writer slot. Intent-only reservations remain `reserved` with `reconcile-required`: absent process-start history never proves that a child did not launch. `attempt start` refuses to reuse an unbound reservation, and `attempt reconcile` reports that protected launch reconciliation requires positive no-execution/no-surviving-writer proof before abort. The protected launch authority owns that proof and abort path; these source primitives do not implement it. Finish also rejects an unbound reservation before accepting any receipt, even if a stale local cache says running. Imported canonical evidence stores the exact submitted bytes without Git clean filters or line-ending conversions; immutable reuse compares the accepted Git blob. It never launches a new process or resends a payload. Restart goes through a new `attempt start` only after the previous attempt ends with accepted evidence.
+
+Managed agents invoking attempt start inside tmux/Herdr obtain a runtime-owned process binding. Recovery compares PID, UID, OS start time, host, exact pane/native session and Herdr terminal/native thread. A surviving shell is not the agent. Missing, unreadable or reused identity remains unknown. A plain local CLI establishes its actor through its effective UID's OS account, requiring equal real/effective UIDs, but supplies no durable agent identity; trusted service executors may supply `process_pid` in their configured identity JSON. Process observation never grants service privilege or effect authority.
+
+Pending HITL references retain their exact scope/attempt and are not rebound by
+resume. Uncertain external effects require their actual owner/result evidence;
+message submission cannot establish business success. `AttemptCoordinator#bind_inbox`
+retains original event attribution only. There is no agent-read reconciliation
+or signing-key requirement for ending or recovering an attempt. Inspect current
+agent progress at its original Herdr/tmux panel; uncertain sends are not repeated
+automatically.
+
+Installed Herdr/Pi compaction and writing-child stop/close acceptance must be recorded separately from deterministic fixture coverage before Lab cutover.
+
+### Attempt-bound forge delivery
+
+`ace-assign create --task TASK --preset work-on-task --delivery-parameters delivery.json`
+accepts an explicit delivery mapping. A local-only preset rejects that mapping.
+The same mapping is retained as `delivery` in the assignment job:
+
+```json
+{"forge_server":"lab-forge","pr_provenance":{"mode":"fork","head_repository_url":"https://forge.example/worker/project","head_ref":"task-branch","base_repository_url":"https://forge.example/team/project","base_ref":"main"}}
+```
+
+Use either `forge_server` or boolean `forge_default: true`. With neither,
+the first remote delivery resolves the repository remote and journals the selected
+forge. Subsequent mutations retain that identity. Canonical mode requires equal
+head and base repository URLs; fork mode names both repositories explicitly.
+The source ref must already contain the exact local candidate commit.
+
+`ace-assign delivery --assignment ID --attempt ATTEMPT --operation create --title TITLE`
+creates a draft. Operations `update`, `review` and `status` reuse that attempt;
+status and review do not append evidence. `ready --tests TEST-REF.json --review
+REVIEW-REF.json` requires references containing `attempt_id` and `receipt_digest`
+to coordinator-accepted, executed tests and independent approval at the current
+candidate. Remote CI remains visible and advisory. An unresolved mutation is
+reconciled by exact provider identity; absence or conflicting matches remain
+unresolved and never trigger an automatic second write. Retrying readiness uses
+the original intent's evidence references, revalidated against the current head.
+
+Merge runs in the authorized qjx executor, which calls the neutral provider merge
+primitive under its existing scoped policy. The worker only consumes completion:
+`delivery --operation merge --service-request REQUEST --tests TEST-REF.json
+--review REVIEW-REF.json`. A completed, verified receipt must bind this assignment,
+attempt, candidate and exact PR resource; credentials do not grant authority.
+Version and changelog preparation do not authorize publication.
+
+The neutral `git/pr/create` and `git/pr/update` workflow and skill assets require
+qkb.1 companion adoption across installed consumers. Their source tests do not
+claim fresh installed workflow acceptance or authorized live merge acceptance.
+
+Delivery context belongs to the assignment's existing evidence journal, while each
+operation belongs to its own scoped attempt. Closing create step `030` and starting
+update `147` or readiness `148` retains the exact PR and forge. An unresolved intent
+from any earlier scoped attempt prevents a second mutation: reconciliation records
+a result under the current attempt and links the original intent digest and attempt.
+Status history includes each event's owning `attempt_id` and `event_digest`. No
+single delivery attempt needs to remain active throughout the recipe.
+If reconciliation recovers a different operation than the requested step (for
+example, create while invoking readiness), the command reports that the requested
+step still needs execution. It does not return success for an unperformed step.
+Retry that requested operation with its current evidence after recovery settles.
+
+Recovery compares the exact requested effect, not only its operation name. An
+uncertain update of one title/body cannot complete a later update with different
+content. Creation also checks the requested title/body against the observed draft,
+including adoption of an already known draft. A mismatched request receives
+`AttemptErrors::CurrentEffectRequired` after the old intent is settled; the new
+effect remains unperformed until explicitly retried. Explicit readiness references
+must match the recovered intent; omitting them during retry retains and revalidates
+its original references. Merge always consumes the exact named qjx service request,
+its candidate/target binding and verified receipt, never an older PR result.
+
+
+## Protected cross-user native launch
+
+The fixed installed authority exposes `ace-assign authority serve`, `launch`,
+`status` and `terminate`. See [protected authority](protected-authority.md) for
+OS policy, native artifact installation, canonical launch stages and safe replay.
+
+## Source-owned installation maintenance inventory
+
+The trusted installation owner loads exact protected content references for the
+original and staged candidate descriptor using `Authority::Deployment.load_artifact`.
+This Ruby-only source interface validates immutable authenticated descriptor bytes;
+it does not establish installed network or native readiness and is not exposed
+through worker transport or a CLI selector.
+
+`LaunchLifecycle#with_execution_slots(mapping_ids:, candidate_deployment:)` holds
+the same slot exclusions as normal admission while yielding frozen fixed
+mapping/journal/commit contexts. Changed, added and removed mappings cannot be
+omitted. Removed mappings retain their original journal selection; new mappings
+use the staged selection. Existing mappings and physical slots cannot be recycled
+to hide history. Ref changes, unreadable roots and conflicting aliases refuse.
+
+Full `slot_reusable!` maintenance eligibility and parent retirement remain
+unavailable until complete historical authentication and actual current inventory
+verification are connected. The inventory block grants neither policy publication
+nor positive maintenance readiness. Finish/stop wiring and installed acceptance
+remain separate unfinished 9c2 requirements. Existing normal admission and guarded
+abort/release behavior retain their current checks.
+
+## Authenticated readiness and terminal scope closure
+
+The source-owned fixed ExecStartPost readiness hook uploads one bounded report
+through the authenticated authority connection, closes its write side and waits
+for acknowledgement. The authority joins the exact manager-selected hook/server
+actors, immutable runtime/configuration dependencies, original boot/network
+proofs and complete live mount/IPC/resource observations before binding native
+admission. The hook’s observed server network namespace must match both the original
+parent selection and the canonical network installation admission. A missing,
+malformed or different identity refuses native binding before child release.
+Unknown writable projections, writable API descendants, changed
+socket endpoints and incomplete evidence refuse. A read-only socket mount does
+not authorize messages.
+
+Original service issuance remains tracked while the manager command runs outside
+the callback's exclusions. Sealing cannot publish an empty-scope proof while an
+original issuer can still start the service. Admitted-but-unbound starts use the
+same positive cleanup and worker baseline as bound starts; an inactive snapshot
+does not assert that execution never happened.
+
+After the genuine terminal owner accepts authenticated result evidence, the
+existing release producer joins that receipt to the exact sealed empty scope.
+Current activation, jobs, recursive population, original resource identities,
+native directory absence and outside worker UID writers are checked again before
+publishing or consuming the proof. Empty scope alone supplies no terminal result.
+
+The required per-boot host proof is selected before parent activation and retained
+in canonical `scope_bound.boot_baseline_selection`; later reads authenticate that
+original immutable artifact rather than a current pointer. Domain gad.8/gad.b
+still must deliver trusted cold-start/boot refresh and activation inhibition.
+These source interfaces and controlled tests do not establish installed native,
+network or boot acceptance, and task 9c2 remains in progress through integration
+and independent review.
+
+
+### Protected sealed-service no-effect settlement
+
+For the fixed original executor, `service_status` includes a closed immutable `settlement_context` containing the authenticated original request, execution binding and accepted current challenge (or null). Full original mapping/project/receiver credentials are checked before this private context is exposed. Ordinary status roles retain their existing projection. Terminal status still authenticates the imported original receipt through the canonical reader.
+
+The fixed original executor uses `claim_service_settlement` against the sealed original request. The authority records an acyclic challenge selecting the latest canonical uncertain/failed outcome. `complete_no_effect` uploads the exact original receipt and bounded inspection artifact through the existing private transfer. It authenticates the accepted challenge, original dispatch binding and imported artifact before atomically reaching `failed-settled`. Exact retries retain their first reply and do not invoke a new effect. A later genuine failure needs a fresh challenge; missing/orphan/stale challenges and changed input refuse.
+
+This generic authority path attributes the closed inspection report to the recorded executor. Actual operation-specific target absence, handler termination and surviving-writer inspection are an open gad.b producer obligation; a closed scope or timeout does not prove no effect. The current protected ingress atomically accepts a request and executor claim, so an absent canonical request cannot be converted into a requested-but-unclaimed settlement record.
+
+
+### Protected original worker submission
+
+Run under the actual original prepared worker while its lineage is live. Read
+`ace-assign authority status --mapping M --assignment A --attempt T` and save
+`authority_generation` for the next new mutation. Candidate submission uses
+current `result_candidate_generation` (zero if null), then returns the next
+positive candidate generation. Review/result use that returned generation.
+
+```sh
+ace-assign submit-candidate --mapping M --assignment A --attempt T --head H \
+  --candidate-generation CURRENT --expected-generation G --mutation CANDIDATE --bundle candidate.bundle
+ace-assign submit-result --mapping M --assignment A --attempt T --head H \
+  --candidate-generation ACCEPTED --expected-generation G --mutation RESULT --receipt result.json \
+  --artifact first-evidence --artifact second-evidence
+```
+
+The actual worker builds `Ace::Assign::Models::ExecutionReceipt` from its original
+assignment/project/scope, installed worker actor, tested head and actual executed
+checks/artifact digests. Failed receipts may have zero artifacts; succeeded
+receipts require evidence. Captured queue completion does not create a receipt or
+canonical acceptance. Independent installed reviewers use the existing
+`ace-overseer review` consumer for that exact candidate. Result submission obtains
+a new generation after review; exact retries retain the original generation,
+mutation and identical ordered bytes. Supervisor finish still revalidates result,
+review, writer exclusion and settlement. A lost reply never causes automatic resend.

data/exe/ace-scope-ready

@@ -0,0 +1,55 @@
+#!/usr/bin/ruby
+# frozen_string_literal: true
+# Private fixed interpreter action; the unit supplies --disable=gems,rubyopt.
+abort "fixed readiness requires one slot" unless ARGV.length == 1 && ARGV.first.match?(/\A[A-Za-z0-9][A-Za-z0-9._-]{0,127}\z/)
+abort "readiness startup features differ" if defined?(Gem) || ENV.keys.any? { |key| key.match?(/\A(?:RUBY|GEM|BUNDLE)/) }
+protected_path = lambda do |path, directory|
+  abort "readiness path substituted" unless path.start_with?("/") && File.expand_path(path) == path && File.realpath(path) == path
+  current = path
+  loop do
+    stat = File.lstat(current)
+    abort "readiness path is writable" unless stat.uid.zero? && !stat.symlink? && (stat.mode & 0o022).zero?
+    abort "readiness directory differs" if current == path && directory && !stat.directory?
+    break if current == "/"
+    current = File.dirname(current)
+  end
+end
+$LOAD_PATH.each { |path| protected_path.call(path, true) }
+require "json"
+require "digest"
+path = "/etc/ace/execution-slots/#{ARGV.first}/readiness.json"
+protected_path.call(path, false)
+bytes = File.open(path, File::RDONLY | File::NOFOLLOW) { |file| file.read(65_537) }
+abort "readiness configuration bound differs" unless bytes.bytesize.between?(1, 65_536)
+config = JSON.parse(bytes.force_encoding(Encoding::UTF_8), create_additions: false, max_nesting: 8,
+  allow_duplicate_key: false, allow_comments: false)
+runtime = config.fetch("runtime")
+references = runtime.fetch("dependencies")
+abort "readiness runtime closure oversized" unless references.is_a?(Array) && references.size.between?(1, 256)
+total = 0
+references.each do |ref|
+  abort "readiness dependency reference differs" unless ref.is_a?(Hash) && ref.keys.sort == %w[bytes path sha256] &&
+    ref["path"].is_a?(String) && ref["path"].bytesize.between?(1, 4096) && !ref["path"].include?("\0") &&
+    ref["bytes"].is_a?(Integer) && ref["bytes"].between?(1, 1_048_576) &&
+    ref["sha256"].is_a?(String) && ref["sha256"].match?(/\A[0-9a-f]{64}\z/)
+  total += ref.fetch("bytes")
+  abort "readiness runtime closure byte bound differs" if total > 16_777_216
+  protected_path.call(ref.fetch("path"), false)
+  content = File.open(ref.fetch("path"), File::RDONLY | File::NOFOLLOW) { |file| file.read(ref.fetch("bytes") + 1) }
+  abort "readiness dependency changed" unless content.bytesize == ref.fetch("bytes") && Digest::SHA256.hexdigest(content) == ref.fetch("sha256")
+end
+builtins = %w[enumerator.so thread.rb fiber.so rational.so complex.so ruby2_keywords.rb]
+$LOADED_FEATURES.each do |feature|
+  abort "readiness startup loaded undeclared code" unless builtins.include?(feature) || references.any? { |ref| ref.fetch("path") == feature }
+end
+paths = runtime.fetch("load_paths")
+abort "readiness load paths oversized" unless paths.is_a?(Array) && paths.size.between?(1, 16)
+paths.each { |selected| protected_path.call(selected, true) }
+$LOAD_PATH.replace(paths)
+require "ace/runtime/molecules/readiness_configuration"
+require "ace/runtime/molecules/readiness_runtime"
+configuration = Ace::Runtime::Molecules::ReadinessConfiguration.decode(bytes, slot: ARGV.first)
+Ace::Runtime::Molecules::ReadinessRuntime.new(configuration: configuration.data).activate!
+require "ace/assign/errors"
+require "ace/assign/authority/readiness_hook"
+Ace::Assign::Authority::ReadinessHook.new(slot: ARGV.first, configuration: configuration).run

data/handbook/workflow-instructions/assign/drive.wf.md

@@ -40,7 +40,8 @@ If this workflow is invoked with an argument (for example `/as-assign-drive abc1
 
 ```bash
 # Set once from workflow argument or internal scoped default (empty when neither is provided)
-ASSIGNMENT_TARGET="${1:-${ACE_ASSIGN_DEFAULT_TARGET:-}}"
+DEFAULT_ASSIGNMENT_TARGET="${ACE_ASSIGN_DEFAULT_TARGET:-}"
+ASSIGNMENT_TARGET="${1:-$DEFAULT_ASSIGNMENT_TARGET}"
 
 # Resolve and pin assignment identity for the full drive loop
 if [ -n "$ASSIGNMENT_TARGET" ]; then
@@ -659,6 +660,30 @@ Follow the instructions directly, performing the described work:
 
 Every external-facing step (implement, verify, review, merge, publish, deploy, release) runs inside a scoped attempt. The attempt -- not the report and not exit status -- is the delivery record.
 
+For an original protected PreparedWorker, use its already admitted assignment,
+attempt and selected scope. Do not run the local `attempt start`/receipt-file
+sequence below, acquire another attempt, or execute an outer preset step. The
+delivery step must already belong to the immutable captured subtree. Submit the
+actual candidate and obtain the installed independent reviewer acceptance through
+the protected commands supplied by the original drive prompt.
+
+For an authorized protected merge, retain the exact approved head/candidate
+generation, structured input file, installed receiver, authorization and stable
+request ID. Read current authority generation for the first new request. Invoke
+`ace-lab service request` with those original mapping/assignment/attempt/scope
+selectors. Inspect `ace-lab service status` with the same request, input digest and
+target, then consume succeeded canonical evidence with `ace-assign delivery
+--operation merge --service-request REQUEST` and the same selectors. Include
+`--artifact-digest` on status and consumption when the original target has one.
+Exact retries retain the original generation, mutation/request ID and input bytes;
+uncertainty never permits refreshing or resending an effect. The protected delivery
+consumer verifies the imported receipt and canonical delivery event without another
+provider mutation. Only that succeeded result permits finishing the active queue
+step. Refusal, unavailable evidence or uncertainty leaves it unfinished and reports
+the exact blocker. Credentials and queue completion do not replace authorization
+or canonical evidence. The following local attempt sequence applies only to
+ordinary standalone assignments.
+
 **Step 1: Start the attempt before executing the step.** Actor identity is derived from the execution boundary; never pass actor flags.
 
 ```bash
@@ -924,10 +949,10 @@ When executing a step with a `skill:` field:
 |-------|-----------|---------|
 | `onboard` | `/as-onboard` | Load project context |
 | `ace:task-work` | `/as-task-work <taskref>` | Implement task changes |
-| `ace:github-pr-create` | `/as-github-pr-create` | Create pull request |
+| `ace:git-pr-create` | `/as-git-pr-create` | Create pull request |
 | `ace:review-pr` | `/as-review-pr [pr#]` | Review code changes |
 | `ace:git-commit` | `/as-git-commit` | Generate commit message |
-| `ace:github-pr-update` | `/as-github-pr-update` | Update PR description |
+| `ace:git-pr-update` | `/as-git-pr-update` | Update PR description |
 
 ## Error Handling