ace-assign 0.63.1 → 0.66.0

data/lib/ace/assign/cli/commands/authority/terminate.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+require "json"
+require_relative "../../../authority/launch_driver"
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        module Authority
+          class Terminate < Ace::Support::Cli::Command
+            desc "Close the original gated native child and request proven abort"
+            option :mapping, required: true, desc: "Installed launch mapping ID"
+            option :assignment, required: true, desc: "Assignment ID"
+            option :attempt, required: true, desc: "Attempt ID"
+            def call(**options)
+              client = Ace::Assign::Authority::Client.new(mapping_id: options.fetch(:mapping))
+              state = client.call("inspect_launch", {"assignment_id" => options.fetch(:assignment), "attempt_id" => options.fetch(:attempt)}).data
+              binding = state.fetch("process_binding") { raise ArgumentError, "no positively recorded original child; supervisor inspection required" }
+              result = Ace::Assign::Authority::LaunchDriver.new(mapping_id: options.fetch(:mapping)).terminate(
+                state: state, binding: binding, evidence: "protected exact-child termination requested")
+              puts JSON.generate(result)
+            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
+              raise Ace::Support::Cli::Error, error.message
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/authority/worker.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+require_relative "../../../authority/prepared_worker"
+
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        module Authority
+          class Worker < Ace::Support::Cli::Command
+            desc "Consume the original authenticated prepared subtree as its fixed worker"
+
+            def call(**options)
+              raise ArgumentError, "fixed worker accepts no options" unless options.empty?
+              Ace::Assign::Authority::PreparedWorker.new.run
+            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
+              raise Ace::Support::Cli::Error, error.message
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/campaign_export_result.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+require_relative "protected_submission"
+
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        class CampaignExportResult < Ace::Support::Cli::Command
+          include Ace::Support::Cli::Base
+          include ProtectedSubmission
+          desc "Download a verified accepted campaign result through its original authority"
+          option :mapping, desc: "Original installed parent mapping"
+          option :assignment, desc: "Original parent assignment"
+          option :attempt, desc: "Original parent attempt"
+          option :head, desc: "Exact parent candidate head"
+          option :candidate_generation, desc: "Exact parent candidate counter"
+          option :output, desc: "Result byte file (created once, exact retries allowed)"
+
+          def call(**options)
+            usage = "campaign-export-result with original parent selectors and --output FILE"
+            context = protected_context(options)
+            raise AttemptErrors::EvidenceUnavailable, "Campaign export requires installed authority" unless context
+            params = {"assignment_id" => require_option(options, :assignment, usage),
+              "attempt_id" => require_option(options, :attempt, usage), "head" => require_option(options, :head, usage),
+              "candidate_generation" => integer_option(options, :candidate_generation, usage, positive: true)}
+            raise Ace::Support::Cli::Error, "Campaign head must be an exact SHA-1" unless params["head"].match?(/\A[0-9a-f]{40}\z/)
+            context.verify_attempt_hints!(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"))
+            path = require_option(options, :output, usage)
+            reply = context.client(options: options).call("campaign_export_result", params, download: true, purpose: :artifacts, timeout: 30)
+            bytes = reply.parts&.first
+            unless reply.parts&.size == 1 && bytes.is_a?(String) && bytes.bytesize <= 64 * 1024 &&
+                reply.data.values_at("head", "candidate_generation", "bytes", "sha256") ==
+                  [params.fetch("head"), params.fetch("candidate_generation"), bytes.bytesize, Digest::SHA256.hexdigest(bytes)]
+              raise AttemptErrors::EvidenceUnavailable, "Campaign result download differs"
+            end
+            begin
+              File.open(path, File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW, 0o600) do |file|
+                file.write(bytes)
+                file.flush
+                file.fsync
+              end
+            rescue Errno::EEXIST
+              raise Ace::Support::Cli::Error, "Existing campaign result file differs" unless input_bytes(path, limit: 64 * 1024) == bytes
+            end
+            emit_json(reply.data.except("transfer").merge("path" => path))
+          rescue SecurityError, Ace::Runtime::RuntimeUnavailableError
+            protected_transport_unavailable!
+          rescue SystemCallError, IOError
+            raise Ace::Support::Cli::Error, "Campaign result file or transport is unavailable"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/campaign_record_round.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+require_relative "protected_submission"
+require_relative "../../authority/campaign_round_transfer"
+
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        class CampaignRecordRound < Ace::Support::Cli::Command
+          include Ace::Support::Cli::Base
+          include ProtectedSubmission
+          desc "Consume settled protected campaign children into the original R1 store"
+          option :mapping, desc: "Original installed parent mapping"
+          option :assignment, desc: "Original parent assignment"
+          option :attempt, desc: "Original parent attempt"
+          option :head, desc: "Exact parent candidate head"
+          option :candidate_generation, desc: "Exact parent candidate counter"
+          option :mutation, desc: "Stable R1 round attempt ID"
+          option :input, desc: "Closed bounded round envelope"
+          option :artifact, type: :array, desc: "Ordered report byte files"
+
+          def call(**options)
+            usage = "campaign-record-round with original parent selectors, --mutation ID and --input FILE"
+            context = protected_context(options)
+            raise AttemptErrors::EvidenceUnavailable, "Campaign consumption requires installed authority" unless context
+            params = {"assignment_id" => require_option(options, :assignment, usage),
+              "attempt_id" => require_option(options, :attempt, usage), "head" => require_option(options, :head, usage),
+              "candidate_generation" => integer_option(options, :candidate_generation, usage, positive: true)}
+            unless params["head"].match?(/\A[0-9a-f]{40}\z/)
+              raise Ace::Support::Cli::Error, "Campaign head must be an exact SHA-1"
+            end
+            context.verify_attempt_hints!(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"))
+            mutation = require_option(options, :mutation, usage)
+            bytes = input_bytes(require_option(options, :input, usage), limit: 16 * 1024)
+            files = options.fetch(:artifact, [])
+            raise Ace::Support::Cli::Error, "Campaign artifacts require at most 16 files" unless files.is_a?(Array) && files.size <= 16
+            parts = [bytes, *files.map { |path| input_bytes(path, limit: 64 * 1024, nonempty: false) }]
+            params["input_sha256"] = Digest::SHA256.hexdigest(bytes)
+            input = Struct.new(:parts) do
+              def count = parts.length
+              def bytes(index:) = parts.fetch(index)
+            end.new(parts)
+            admitted = Ace::Assign::Authority::CampaignRoundTransfer.decode(input: input, sha256: params.fetch("input_sha256"))
+            unless admitted.fetch(:round).values_at("attempt_id", "head") == [mutation, params.fetch("head")]
+              raise Ace::Support::Cli::Error, "Campaign input request ID or head differs"
+            end
+            emit_json(upload_call(context.client(options: options), "campaign_record_round", params, mutation, parts, :receipt_artifacts))
+          rescue SecurityError, Ace::Runtime::RuntimeUnavailableError
+            protected_transport_unavailable!
+          rescue ArgumentError => error
+            raise Ace::Support::Cli::Error, error.message
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/create.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+require "json"
 
 module Ace
   module Assign
@@ -7,9 +8,11 @@ module Ace
         # Create a new workflow assignment from YAML or preset-backed task refs
         class Create < Ace::Support::Cli::Command
           include Ace::Support::Cli::Base
+          include AssignmentTarget
 
           desc "Create a new workflow assignment"
 
+          option :delivery_parameters, desc: "JSON file with forge selection and explicit PR provenance (task mode)"
           option :yaml, desc: "Path to job.yaml config file"
           option :task, aliases: ["-t"], type: :array,
             desc: "Task reference(s), repeatable and comma-separated"
@@ -18,14 +21,17 @@ module Ace
           option :debug, aliases: ["-d"], type: :boolean, default: false, desc: "Show debug output"
 
           def call(yaml: nil, task: nil, preset: nil, **options)
+            refuse_protected_graph_mutation!(options)
             validate_modes!(yaml, task, preset)
+            raise Ace::Support::Cli::Error, "--delivery-parameters requires --task" if yaml && options[:delivery_parameters]
 
             result = if yaml
               Organisms::AssignmentExecutor.new.start(yaml)
             else
               Organisms::TaskAssignmentCreator.new.call(
                 task_refs: task,
-                preset_name: preset || Organisms::TaskAssignmentCreator::DEFAULT_PRESET
+                preset_name: preset || Organisms::TaskAssignmentCreator::DEFAULT_PRESET,
+                delivery_parameters: options[:delivery_parameters] && JSON.parse(File.read(options[:delivery_parameters]))
               )
             end
 
@@ -34,6 +40,10 @@ module Ace
               print_assignment_header(result[:assignment])
               print_step_instructions(result[:current] || result[:state]&.next_workable)
             end
+          rescue JSON::ParserError, Errno::ENOENT
+            raise Ace::Support::Cli::Error, "Delivery parameters file unavailable or invalid JSON"
+          rescue ArgumentError => e
+            raise Ace::Support::Cli::Error, e.message
           end
 
           private

data/lib/ace/assign/cli/commands/delivery.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+require "json"
+require_relative "../../authority/protected_assignment_context"
+require_relative "../../organisms/protected_delivery_coordinator"
+
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        class Delivery < Ace::Support::Cli::Command
+          desc "Execute or reconcile attempt-bound forge delivery"
+          option :assignment, required: true, desc: "Managed assignment ID"
+          option :attempt, required: true, desc: "Active delivery attempt ID"
+          option :operation, required: true, desc: "create, update, ready, review, merge, status"
+          option :parameters, desc: "JSON delivery parameters (otherwise assignment source delivery mapping)"
+          option :title, desc: "PR title"
+          option :body_file, desc: "PR description file"
+          option :tests, desc: "JSON reference to coordinator-accepted test attempt and receipt digest"
+          option :review, desc: "JSON reference to coordinator-accepted independent review attempt and receipt digest"
+          option :service_request, desc: "Original authorized PR service request ID"
+          option :mapping, desc: "Installed original protected mapping selector"
+          option :scope, desc: "Original prepared worker scope"
+          option :candidate_head, desc: "Exact original protected candidate SHA"
+          option :candidate_generation, type: :integer, desc: "Exact original protected candidate generation"
+          option :input_digest, desc: "Exact original accepted service input SHA256"
+          option :target, desc: "Exact original target repository or PR URL"
+          option :artifact_digest, desc: "Original target artifact SHA256, if present"
+
+          def initialize(protected_context: nil)
+            @protected_assignment_context = protected_context
+          end
+
+          def call(**options)
+            context = @protected_assignment_context ||= Ace::Assign::Authority::ProtectedAssignmentContext.load
+            protected = context.protected_participant? || options[:mapping] || context.mapping_hint?
+            if protected
+              unless context.protected_worker?
+                raise AttemptErrors::EvidenceUnavailable, "protected delivery is worker-only"
+              end
+              unless %w[create update ready merge status].include?(options[:operation]) && %i[title body_file tests review].all? { |key| options[key].nil? }
+                raise ArgumentError, "protected delivery accepts canonical PR results/status only; local input/evidence flags are unavailable"
+              end
+              input = context.resolve(options: options, assignment_id: options[:assignment], scope: options[:scope])
+              raise AttemptErrors::EvidenceUnavailable, "original protected prepared input is unavailable" unless input
+              result = Organisms::ProtectedDeliveryCoordinator.new(client: context.client(options: options),
+                project_id: input.work.manifest.fetch("project_id")).perform(assignment_id: options[:assignment],
+                  attempt_id: options[:attempt], operation: options[:operation], service_request_id: options[:service_request],
+                  candidate_head: options[:candidate_head], candidate_generation: options[:candidate_generation],
+                  input_digest: options[:input_digest], target: {"resource" => options[:target], "artifact_digest" => options[:artifact_digest]},
+                  parameters: read_json(options[:parameters]))
+              puts JSON.generate(json_value(result))
+              return
+            end
+            if %i[mapping scope candidate_head candidate_generation input_digest target artifact_digest].any? { |key| options[key] }
+              raise ArgumentError, "protected delivery selectors cannot select ordinary local delivery"
+            end
+            result = build_delivery.perform(assignment_id: options[:assignment], attempt_id: options[:attempt],
+              operation: options[:operation], parameters: read_json(options[:parameters]),
+              title: options[:title], body: options[:body_file] && File.read(options[:body_file]),
+              tests: read_json(options[:tests]), review: read_json(options[:review]),
+              service_request_id: options[:service_request])
+            puts JSON.generate(json_value(result))
+          rescue ArgumentError, Ace::Git::Error, Ace::Assign::Error, Ace::Runtime::RuntimeUnavailableError,
+            JSON::ParserError, SecurityError, SystemCallError => e
+            message = e.is_a?(JSON::ParserError) ? "protected installed selection unavailable" : e.message
+            raise Ace::Support::Cli::Error, message
+          end
+
+          private
+
+          def build_delivery
+            Organisms::DeliveryCoordinator.new(repo_root: Ace::Support::Fs::Molecules::ProjectRootFinder.find_or_current)
+          end
+
+          def read_json(path)
+            return nil unless path
+            bytes = File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
+              before = file.stat
+              raise ArgumentError, "Delivery input must be a bounded regular file" unless before.file? && before.size <= 65_536
+              value = file.read(65_537)
+              after = file.stat
+              unless value && value.bytesize <= 65_536 &&
+                  [before.dev, before.ino, before.size, before.mtime, before.ctime] == [after.dev, after.ino, after.size, after.mtime, after.ctime]
+                raise ArgumentError, "Delivery input changed or exceeds its bound"
+              end
+              value
+            end
+            data = JSON.parse(bytes, max_nesting: 16, create_additions: false,
+              allow_duplicate_key: false, allow_comments: false, allow_nan: false)
+            raise ArgumentError, "Delivery input must be a JSON object" unless data.is_a?(Hash)
+            data
+          rescue JSON::ParserError
+            raise ArgumentError, "Delivery input must be valid JSON"
+          end
+
+          def json_value(value)
+            case value
+            when Hash then value.transform_values { |item| json_value(item) }
+            when Array then value.map { |item| json_value(item) }
+            else value.respond_to?(:to_h) ? json_value(value.to_h) : value
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/fail.rb

@@ -12,6 +12,8 @@ module Ace
           desc "Mark current step as failed"
 
           option :message, aliases: ["-m"], required: true, desc: "Error message"
+          option :mapping, desc: "Installed protected launch mapping ID"
+          option :attempt, desc: "Original protected attempt ID"
           option :assignment, desc: "Target specific assignment ID"
           option :quiet, aliases: ["-q"], type: :boolean, default: false, desc: "Suppress non-essential output"
           option :debug, aliases: ["-d"], type: :boolean, default: false, desc: "Show debug output"
@@ -28,6 +30,10 @@ module Ace
               puts "Step #{failed.number} (#{failed.name}) marked as failed"
               puts "Updated: #{File.basename(failed.file_path)}"
               puts "Error: #{message}"
+              if target.prepared_input
+                puts "Further work requires a reviewed new prepared version and attempt."
+                return
+              end
               puts
               puts "Options:"
               puts "- ace-assign add \"fix-step\" to add a fix step"

data/lib/ace/assign/cli/commands/finish.rb

@@ -13,6 +13,8 @@ module Ace
 
           argument :step, required: false, desc: "Step number to finish (active assignment only)"
           option :message, aliases: ["-m"], desc: "Report content: string, file path, or pipe stdin"
+          option :mapping, desc: "Installed protected launch mapping ID"
+          option :attempt, desc: "Original protected attempt ID"
           option :assignment, desc: "Target specific assignment ID"
           option :quiet, aliases: ["-q"], type: :boolean, default: false, desc: "Suppress non-essential output"
           option :debug, aliases: ["-d"], type: :boolean, default: false, desc: "Show debug output"
@@ -24,7 +26,7 @@ module Ace
 
             target = resolve_assignment_target(options)
             executor = build_executor_for_target(target)
-            report_content = resolve_report_content(options)
+            report_content = resolve_report_content(options, protected: !target.prepared_input.nil?)
             result = executor.finish_step(
               report_content: report_content,
               step_number: step,
@@ -72,8 +74,27 @@ module Ace
 
           private
 
-          def resolve_report_content(options)
+          def resolve_report_content(options, protected: false)
             message = options[:message]&.strip
+            if protected
+              limit = Ace::Assign::Authority::PreparedWork::MAX_TEXT
+              if message && !message.empty? && File.exist?(message)
+                return File.open(message, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
+                  before = file.stat
+                  raise Error, "Report input must be a bounded regular file" unless before.file? && before.size.between?(1, limit)
+                  bytes = file.read(limit + 1)
+                  after = file.stat
+                  unless bytes.bytesize == before.size && [before.dev, before.ino, before.size, before.mtime, before.ctime] ==
+                      [after.dev, after.ino, after.size, after.mtime, after.ctime]
+                    raise Error, "Report input changed"
+                  end
+                  bytes
+                end
+              end
+              bytes = message && !message.empty? ? message : $stdin.read(limit + 1)
+              raise Error, "Report input exceeds captured text bound" unless bytes && bytes.bytesize.between?(1, limit)
+              return bytes
+            end
             return File.read(message) if message && !message.empty? && File.exist?(message)
             return message if message && !message.empty?
 

data/lib/ace/assign/cli/commands/fork_session.rb

@@ -7,6 +7,7 @@ module Ace
         # Internal command used by tmux-backed fork panes to launch the provider session once.
         class ForkSession < Ace::Support::Cli::Command
           include Ace::Support::Cli::Base
+          include AssignmentTarget
 
           desc "Run one provider-backed fork session for a subtree"
 
@@ -21,10 +22,11 @@ module Ace
 
           def initialize(launcher: nil)
             super()
-            @launcher = launcher || Molecules::ForkSessionLauncher.new
+            @launcher = launcher
           end
 
           def call(**options)
+            refuse_protected_graph_mutation!(options)
             launcher.launch_provider_session(
               assignment_id: options[:assignment],
               fork_root: options[:root],
@@ -44,7 +46,9 @@ module Ace
 
           private
 
-          attr_reader :launcher
+          def launcher
+            @launcher ||= Molecules::ForkSessionLauncher.new
+          end
         end
       end
     end

data/lib/ace/assign/cli/commands/inbox_bind.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+require_relative "attempt/base"
+
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        class InboxBind < Ace::Support::Cli::Command
+          include Ace::Support::Cli::Base
+          include Attempt::Base
+
+          desc "Bind an original protected Inbox registration before scope closure"
+          option :mapping, desc: "Exact installed mapping ID"
+          option :assignment, desc: "Exact original assignment ID"
+          option :attempt, desc: "Exact original attempt ID"
+          option :event, desc: "Original Inbox event ID"
+          option :inbox_context, desc: "Installed Inbox context ID"
+          option :mutation, desc: "Stable original authority mutation ID"
+          option :expected_generation, desc: "Original authority mutation generation"
+
+          def call(**options)
+            context = protected_context(options)
+            raise AttemptErrors::EvidenceUnavailable, "Inbox binding requires installed protected authority" unless context
+            usage = "inbox-bind --mapping MAP --assignment ID --attempt ID --event ID --inbox-context ID --mutation ID --expected-generation N"
+            client, params, mutation = protected_attempt_request(context, options, usage)
+            params.merge!("event_id" => require_option(options, :event, usage),
+              "inbox_context_id" => require_option(options, :inbox_context, usage))
+            emit_json(protected_call(client, "bind_inbox", params, mutation))
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/protected_submission.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+require_relative "attempt/base"
+require "digest"
+
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        # Local files provide bounded bytes; only the existing authority grants admission.
+        module ProtectedSubmission
+          include Attempt::Base
+          private
+
+          def require_option(options, key, usage)
+            value = options[key].to_s.strip
+            raise Ace::Support::Cli::Error, "Missing --#{key}: usage: ace-assign #{usage}" if value.empty?
+            value
+          end
+
+          def submission_request(options, usage)
+            context = protected_context(options)
+            raise AttemptErrors::EvidenceUnavailable, "Submission requires installed protected authority" unless context
+            protected_attempt_request(context, options, usage)
+          end
+
+          def input_bytes(path, limit:, nonempty: true)
+            File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
+              before = file.stat
+              raise Ace::Support::Cli::Error, "Input must be a bounded regular file" unless before.file? && before.size.between?(nonempty ? 1 : 0, limit)
+              bytes = file.read(limit + 1)
+              after = file.stat
+              selected = File.lstat(path)
+              identity = ->(stat) { [stat.dev, stat.ino, stat.size, stat.mtime, stat.ctime] }
+              unless bytes.bytesize == before.size && identity.call(before) == identity.call(after) &&
+                  identity.call(after) == identity.call(selected) && !selected.symlink?
+                raise Ace::Support::Cli::Error, "Input changed during bounded read"
+              end
+              bytes.freeze
+            end
+          rescue SystemCallError, IOError
+            raise Ace::Support::Cli::Error, "Input file is unavailable"
+          end
+
+          def input_json(bytes)
+            text = bytes.dup.force_encoding(Encoding::UTF_8)
+            raise Ace::Support::Cli::Error, "Input JSON is malformed" unless text.valid_encoding?
+            JSON.parse(text, create_additions: false, max_nesting: 32, allow_duplicate_key: false, allow_comments: false)
+          rescue JSON::ParserError
+            raise Ace::Support::Cli::Error, "Input JSON is malformed"
+          end
+
+          def upload_call(client, operation, params, mutation, parts, purpose)
+            client.call(operation, params, mutation_id: mutation, upload_parts: parts, purpose: purpose, timeout: 30).data
+          rescue SecurityError, Ace::Runtime::RuntimeUnavailableError, SystemCallError, IOError
+            protected_transport_unavailable!
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/resume.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        class Resume < Ace::Support::Cli::Command
+          include Ace::Support::Cli::Base
+          include AssignmentTarget
+          desc "Recover accepted assignment state without launching another writer"
+          option :assignment, desc: "Assignment ID"
+          option :mapping, desc: "Installed protected launch mapping ID"
+          option :attempt, desc: "Original protected attempt ID"
+          option :dry_run, type: :boolean, default: false, desc: "Inspect recovery without writing observations"
+
+          def call(**options)
+            target = resolve_assignment_target(options)
+            if target.prepared_input
+              raise Ace::Support::Cli::Error, "protected resume only supports --dry-run" unless options[:dry_run]
+              result = build_executor_for_target(target).status
+              descriptor = target.prepared_input.descriptor
+              puts JSON.generate(descriptor.slice("assignment_id", "mapping_id", "attempt_id", "scope", "definition_digest", "selection_sha256").merge(
+                "state" => result.fetch(:state).assignment_state.to_s, "dry_run" => true))
+              return
+            end
+            id = options[:assignment].to_s.strip
+            raise Ace::Support::Cli::Error, "--assignment ID is required" if id.empty?
+
+            puts JSON.generate(Organisms::AttemptCoordinator.new.resume(
+              assignment_id: id, dry_run: options[:dry_run]))
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/select.rb

@@ -13,6 +13,7 @@ module Ace
         #   ace-assign select --clear
         class Select < Ace::Support::Cli::Command
           include Ace::Support::Cli::Base
+          include AssignmentTarget
 
           desc "Select an assignment as the current active assignment"
 
@@ -22,6 +23,7 @@ module Ace
           option :debug, aliases: ["-d"], type: :boolean, default: false, desc: "Show debug output"
 
           def call(id: nil, **options)
+            refuse_protected_graph_mutation!(options)
             manager = Molecules::AssignmentManager.new
 
             if options[:clear]

data/lib/ace/assign/cli/commands/start.rb

@@ -12,6 +12,8 @@ module Ace
           desc "Start next workable pending step"
 
           argument :step, required: false, desc: "Step number to start (active assignment only)"
+          option :mapping, desc: "Installed protected launch mapping ID"
+          option :attempt, desc: "Original protected attempt ID"
           option :assignment, desc: "Target specific assignment ID"
           option :quiet, aliases: ["-q"], type: :boolean, default: false, desc: "Suppress non-essential output"
           option :debug, aliases: ["-d"], type: :boolean, default: false, desc: "Show debug output"

data/lib/ace/assign/cli/commands/status.rb

@@ -41,6 +41,8 @@ module Ace
           option :format, desc: "Output format (table, json)", default: "table"
           option :quiet, aliases: ["-q"], type: :boolean, default: false, desc: "Suppress non-essential output"
           option :debug, aliases: ["-d"], type: :boolean, default: false, desc: "Show debug output"
+          option :mapping, desc: "Installed protected launch mapping ID"
+          option :attempt, desc: "Original protected attempt ID"
           option :assignment, desc: "Show status for specific assignment ID"
           option :all, aliases: ["-a"], type: :boolean, default: false, desc: "Include completed assignments in other assignments section"
 
@@ -85,7 +87,7 @@ module Ace
           def status_to_h(assignment, state, active_steps, next_step, target:, scope_root:)
             # Extract auto_merge config if present in assignment settings or preset
             auto_merge = false
-            preset_name = Ace::Assign::Molecules::PresetInferrer.infer_from_assignment(assignment)
+            preset_name = Ace::Assign::Molecules::PresetInferrer.infer_from_assignment(assignment) unless target.prepared_input
             auto_merge = true if preset_name && preset_name.start_with?("work-on-task-auto-merge")
 
             evidence = Ace::Assign::Molecules::EvidenceCalculator.calculate(
@@ -135,7 +137,7 @@ module Ace
             lines = []
             lines.concat(compact_summary_lines(view.assignment, view.scoped_state, view.active_steps, view.next_step))
 
-            if (attempt_line = compact_attempt_line(view.assignment.id))
+            if !target.prepared_input && (attempt_line = compact_attempt_line(view.assignment.id))
               lines.insert(1, attempt_line)
             end
 

data/lib/ace/assign/cli/commands/step.rb

@@ -12,6 +12,8 @@ module Ace
           desc "Show instructions for the active, next, or explicit step"
 
           argument :step, required: false, desc: "Exact step number to inspect"
+          option :mapping, desc: "Installed protected launch mapping ID"
+          option :attempt, desc: "Original protected attempt ID"
           option :assignment, desc: "Target specific assignment ID"
           option :quiet, aliases: ["-q"], type: :boolean, default: false, desc: "Suppress non-essential output"
           option :debug, aliases: ["-d"], type: :boolean, default: false, desc: "Show debug output"
@@ -24,7 +26,7 @@ module Ace
             return if options[:quiet]
 
             if inspected
-              puts inspected.instructions
+              puts(target.prepared_input ? target.prepared_input.render(inspected.instructions) : inspected.instructions)
             else
               puts no_work_message(view)
             end