ace-assign 0.64.0 → 0.66.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f8f85e3c4fd7760b26493ade861cb5a7b1fda59227909762005d75ee2dc14db1
-  data.tar.gz: 3a491eefefece8e3e7995f68e4fd84536a3e55e436c503119555ea55a17da464
+  metadata.gz: 72c3ae204cb6b8b4ee165ba56ca4a9820a28e417b94d74e423048cae1cecc73e
+  data.tar.gz: b9b4e043e80071b3d9335876e9d0a4981ac2a532d2db70216050b8d279665cc8
 SHA512:
-  metadata.gz: 0a47581f03920859a3712c10026b0bd034127dfd640c33d64636d88543108ebc2815b475414eccef721ac5d68db1a625a2538c8ffcc381c02cf851041206bb1e
-  data.tar.gz: 1bf276d020c5ff7c2740d9d9a3ccaf9837af09197156ded76af8f7d6ca27cb99bf4b24cfb7f1176b3134cc9ecf732822302a3ddd987355e6ff0dbecfd9ada77c
+  metadata.gz: 51cabda59e2bf66a9b3fb4e9f78670db06e239d290dd7d97ccc98eb43160dc24fd83c6a58b26fb400f7ff4b35e274ea81e625d1469c575c863ee1db50f0b23da
+  data.tar.gz: d95a4198c73b1769e21329230b1df943c87826d08905fa1b5f783334b89cc24e6bd3d3dd011f787560f8f6b8859058892cfed2ee254966b73e9d71aad5aba2ba

data/.ace-defaults/assign/catalog/steps/auto-merge.step.yml

@@ -0,0 +1,11 @@
+name: auto-merge
+description: Consume an authorized exact-candidate merge through the delivery owner
+workflow: wfi://assign/drive
+instructions: |
+  Merge only when separately authorized and the existing merge checks pass.
+  For an original protected worker, follow the protected delivery rule in
+  wfi://assign/drive using the admitted assignment, attempt and scope. Retain
+  exact approved candidate and request selectors. Request the installed service,
+  inspect canonical status, and consume its succeeded result with ace-assign
+  delivery. Never execute another provider effect during result consumption.
+  Refused, unavailable or uncertain delivery leaves this step unfinished.

data/CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.66.0] - 2026-10-08
+
+### Added
+
+- Connect protected PR delivery and parent/child campaign results to the canonical assignment owner, with current candidate checks, independent review and original operation authorization.
+- Launch authenticated prepared workers through the existing ace-llm provider CLI in the original terminal.
+
+### Changed
+
+- Remove message-read proofs, observation/signing APIs and Inbox settlement requirements from finish, recovery and stop. Retain actual service/result/review evidence and whole-scope writer checks.
+- Reuse verified immutable journal inventories only within a single operation while retaining fresh admission and compare-and-swap checks.
+- Preserve original workspace leases when provider ownership or shutdown is uncertain.
+
+## [0.65.0] - 2026-10-06
+
+### Added
+
+- Source-only protected original/candidate deployment inventory and shared execution-slot exclusions with immutable journal snapshots; full maintenance eligibility and retirement remain unavailable until historical authentication and current inventory verification are connected.
+
 ## [0.64.0] - 2026-10-05
 
 ### Added

data/docs/protected-authority.md

@@ -32,9 +32,9 @@ by `Ace::Assign::Authority::Deployment`:
 | Installed object | Required fields |
 | --- | --- |
 | `authorities.ID` | `uid`, `gid`, sorted unique `groups`, `socket_path`, `state_root`, `composition` (`launch` or `services`) |
-| `projects.ID` | `journal_repository`, `evidence_git_ref` (`refs/ace/execution`), `evidence_checkout_root`, `assignment_root`, `candidate_root`, `launcher_uids`, `reviewer_uids`, `worker_uids`, `service_executor_uids`, `supervisor_uids`, `peer_credentials`, optional `service_receivers` |
+| `projects.ID` | `journal_repository`, `evidence_git_ref` (`refs/ace/execution`), `evidence_checkout_root`, `assignment_root`, `candidate_root`, `campaign_repository`, `campaign_store_root`, `launcher_uids`, `reviewer_uids`, `worker_uids`, `service_executor_uids`, `supervisor_uids`, `peer_credentials`, optional `service_receivers` |
 | `projects.ID.peer_credentials.UID` | `gid`, sorted unique `groups`, `scratch_root`; every configured role UID has one fixed entry |
-| `launch_mappings.ID` | `project_id`, `authority_id`, `launcher_uid`, `launcher_gid`, `launcher_groups`, `worker_uid`, `worker_gid`, `worker_groups`, `worker_actor`, `worker_cwd`, `worker_argv`, `worker_env`, `bootstrap`, `bootstrap_sha256`, `native`, `execution_scope` |
+| `launch_mappings.ID` | `project_id`, `authority_id`, `launcher_uid`, `launcher_gid`, `launcher_groups`, `worker_uid`, `worker_gid`, `worker_groups`, `worker_actor`, `worker_cwd`, `worker_entry`, `worker_env`, `bootstrap`, `bootstrap_sha256`, `native`, `execution_scope`, `task_context_entry` |
 | `launch_mappings.ID.native` | `socket_path`, `executable`, `executable_sha256`, `version` (`0.9.3`), `protocol` (`22`), canonical `workspace_id` (`wN`) |
 | `launch_mappings.ID.execution_scope` | `backend` (`linux_systemd_cgroup_v2`), `slot_id`, `slice_unit`, `service_unit`, `unit_manifest_sha256`, `boundary_manifest_sha256`, `root_directory`, `runtime_directory`, `network_namespace_path` |
 
@@ -83,14 +83,20 @@ Launch one managed definition using a stable invocation ID:
 
 ```sh
 ace-assign authority launch --mapping MAPPING --assignment ASSIGNMENT \
-  --definition /absolute/managed-definition.json --step 010 \
+  --definition /absolute/prepared-definition.json \
+  --prepared-bundle /absolute/prepared-input.bundle --step 010 \
   --base-head EXACT_40_CHARACTER_COMMIT --mutation INVOCATION_ID
 ```
 
-The definition is a normal managed assignment JSON document (maximum 32 KiB),
-with matching `session_id`, `task_id` and installed `project_id`. The authority
-stores its exact immutable bytes in the canonical journal and materializes the
-owner-private assignment cache from that accepted blob. An active attempt blocks
+The final definition (maximum 32 KiB) includes the exact `prepared_work` Git
+head/tree, manifest and selected subtree reference, with matching `session_id`,
+`task_id` and installed `project_id`. `--prepared-bundle` is mandatory: it supplies
+the original complete prepared-input Git bundle, bounded to 64 MiB. Both inputs
+are read from held regular files with bounded reads and no final symlink following
+before launch effects. The authority derives the final definition from the verified
+prepared tree and commits it with the exact received bundle in one journal mutation.
+Reusing the same definition with different bundle bytes refuses. The owner-private
+definition cache remains separate from the worker queue. An active attempt blocks
 changed definitions. A fresh reservation creates canonical intent/provisioning,
 then the owner activates and binds its independent parent under the slot exclusion.
 It pins existing resource objects, the authority mount namespace and the installed
@@ -264,3 +270,13 @@ read permitted attempt evidence, including retained terminal history. Current
 visibility and peer authorization apply to every read. Reassignment revokes the
 old reviewer purpose. Inbox and observation evidence refuse until their existing
 signer and observer owners provide complete canonical provenance.
+
+The fixed worker entry is the closed `{interpreter: REF, wrapper: REF}` pair, with
+exact path/bytes/SHA256 references (interpreter<=32MiB, wrapper<=1MiB). The
+existing installed unit manifest associates the wrapper with `worker_executable`
+and the interpreter uniquely with `runtime_dependency`. The wrapper is source,
+so it need not carry executable permission; the selected interpreter must. The
+original retained mapping pair is part of the authenticated compact release.
+The native gate hashes held files, seals a readonly code snapshot, and uses the
+fixed isolated Python FD4/FD5 command while preserving operational stdio. No
+worker argv/shebang/PATH fallback remains. Native installed acceptance is separate.

data/docs/usage.md

@@ -89,7 +89,9 @@ ace-assign add --yaml .ace-local/assign/jobs/add-task.yml --after 010 --child
 
 Execution evidence lives in assignment attempts, not in reports. An attempt binds an immutable ID to an assignment, step/subtree scope, project, boundary-derived actor/role/runtime, source task, and `base_head`; the deliverable `candidate_head` is pinned only when accepted evidence is submitted, and the evidence journal commit is tracked separately from both.
 
-### Attempt lifecycle
+### Ordinary local attempt lifecycle
+
+Lifecycle exclusion uses the selected repository's actual Git common directory, shared by linked worktrees. `CACHE_BASE` changes assignment cache storage but cannot split creator and prune locks into a separate namespace. A missing Git repository or malformed retained removal fence refuses admission; it does not create a fallback lock root.
 
 ```bash
 ace-assign attempt start --assignment ASSIGNMENT --step STEP --project PROJECT
@@ -103,6 +105,20 @@ ace-assign attempt reconcile --attempt ATTEMPT --receipt receipt.json
 - `attempt finish` accepts a structured receipt: operation, attributed producer, exact tested/reviewed head, verdict, artifact paths with SHA-256 digests, executed checks, and -- for review operations -- an executed independent reviewer verdict for that head.
 - `attempt reconcile` classifies interrupted attempts (`uncertain` when launch or effect completion cannot be proven either way, still `running` only for verifiably live processes) and resolves uncertainty only against a verified receipt attributed to the recorded execution boundary. Merge, publish, and deploy effects are never replayed automatically.
 
+### Protected completion, recovery and Inbox registration
+
+```bash
+ace-assign attempt finish --mapping MAP --assignment ASSIGNMENT --attempt ATTEMPT --result RESULT --head SHA --candidate-generation N --mutation ID --expected-generation N
+ace-assign attempt reconcile --mapping MAP --assignment ASSIGNMENT --attempt ATTEMPT --mutation ID --expected-generation N
+ace-assign inbox-bind --mapping MAP --assignment ASSIGNMENT --attempt ATTEMPT --event EVENT --inbox-context CONTEXT --mutation ID --expected-generation N
+```
+
+The installed authority authenticates the current caller. Finish and recovery require the original launcher or an authorized mapped supervisor; Inbox binding requires the original worker or its authenticated descendant and an open execution scope. Installed current or retained authority, service and Inbox accounts also stay on the protected path: unsupported roles refuse rather than opening local authority.
+
+Protected finish selects an already submitted canonical result. A succeeded result requires accepted independent review for that exact candidate, prior no-writers proof and complete service settlement. It does not close the scope or accept `--receipt`. Protected recovery observes one original attempt; unresolved service effects remain unresolved. Terminal/released recovery returns authenticated retained selectors without creating another mutation or restarting execution. Inbox binding retains the original event/attempt attribution; fresh binding after scope seal refuses.
+
+Keep the original `--mutation` and `--expected-generation` for exact retries. Authority generation is distinct from `--candidate-generation`; rereading a newer generation changes the request. Assignment, attempt and mapping hints must agree with explicit selection. Commands print canonical JSON metadata and never resend effects during recovery.
+
 ### State machine
 
 `reserved -> running -> succeeded | failed | stopped | uncertain`; reconciliation may resolve `uncertain -> succeeded | failed`. Terminal attempts accept no new effects, and accepted history is append-only.
@@ -422,14 +438,19 @@ See [exit-codes.md](exit-codes.md) for complete descriptions.
 ```bash
 ace-assign resume --assignment ID --dry-run
 ace-assign resume --assignment ID
-ace-assign inbox-reconcile --attempt ID --event ID --receipt proof.json
 ```
 
-Both commands return JSON with task goal, checkpoint, attempts, pending HITL references and unresolved effect/inbox references. Each attempt reports `adopt`, `restart-required` or `reconcile-required`, liveness, recovery reason and its last verified observation. Dry-run writes nothing. Actual resume journals a bounded observation; unproven running attempts become uncertain and keep their writer slot. Intent-only reservations remain `reserved` with `reconcile-required`: absent process-start history never proves that a child did not launch. `attempt start` refuses to reuse an unbound reservation, and `attempt reconcile` reports that protected launch reconciliation requires positive no-execution/no-surviving-writer proof before abort. The protected launch authority owns that proof and abort path; these source primitives do not implement it. Finish also rejects an unbound reservation before accepting any receipt, even if a stale local cache says running. Imported canonical evidence stores the exact submitted bytes without Git clean filters or line-ending conversions; immutable reuse compares the accepted Git blob. It never launches a new process or resends a payload. Restart goes through a new `attempt start` only after the previous attempt ends with accepted evidence.
+Resume returns JSON with task goal, checkpoint, attempts, pending HITL references and unresolved effect/inbox references. Each attempt reports `adopt`, `restart-required` or `reconcile-required`, liveness, recovery reason and its last verified observation. Dry-run writes nothing. Actual resume journals a bounded observation; unproven running attempts become uncertain and keep their writer slot. Intent-only reservations remain `reserved` with `reconcile-required`: absent process-start history never proves that a child did not launch. `attempt start` refuses to reuse an unbound reservation, and `attempt reconcile` reports that protected launch reconciliation requires positive no-execution/no-surviving-writer proof before abort. The protected launch authority owns that proof and abort path; these source primitives do not implement it. Finish also rejects an unbound reservation before accepting any receipt, even if a stale local cache says running. Imported canonical evidence stores the exact submitted bytes without Git clean filters or line-ending conversions; immutable reuse compares the accepted Git blob. It never launches a new process or resends a payload. Restart goes through a new `attempt start` only after the previous attempt ends with accepted evidence.
 
 Managed agents invoking attempt start inside tmux/Herdr obtain a runtime-owned process binding. Recovery compares PID, UID, OS start time, host, exact pane/native session and Herdr terminal/native thread. A surviving shell is not the agent. Missing, unreadable or reused identity remains unknown. A plain local CLI establishes its actor through its effective UID's OS account, requiring equal real/effective UIDs, but supplies no durable agent identity; trusted service executors may supply `process_pid` in their configured identity JSON. Process observation never grants service privilege or effect authority.
 
-Pending HITL references retain their exact scope/attempt and are not rebound by resume. Uncertain external claims require existing effect receipt reconciliation. Delivery consumption is separate from business success. Herdr owns signed inbox verification (`ace-herdr inbox reconcile --event ID --receipt FILE`); the assignment `inbox-reconcile` command uses that same configured verifier and additionally records the accepted observation references. `AttemptCoordinator#bind_inbox` records only the event reference, and `#reconcile_inbox` delegates that same verifier and journals only the verified proof digest/path and native observation reference. A consumed receipt settles transport once. A superseded receipt requeues the same event for an explicit retry, without succeeding the attempt. Exact signed replay recovers a crash between Herdr settlement and the assignment journal write; changed key, target, payload or generation fails closed. Retain the matching protected key pair for unresolved events or postpone rotation.
+Pending HITL references retain their exact scope/attempt and are not rebound by
+resume. Uncertain external effects require their actual owner/result evidence;
+message submission cannot establish business success. `AttemptCoordinator#bind_inbox`
+retains original event attribution only. There is no agent-read reconciliation
+or signing-key requirement for ending or recovering an attempt. Inspect current
+agent progress at its original Herdr/tmux panel; uncertain sends are not repeated
+automatically.
 
 Installed Herdr/Pi compaction and writing-child stop/close acceptance must be recorded separately from deterministic fixture coverage before Lab cutover.
 
@@ -498,3 +519,95 @@ its candidate/target binding and verified receipt, never an older PR result.
 The fixed installed authority exposes `ace-assign authority serve`, `launch`,
 `status` and `terminate`. See [protected authority](protected-authority.md) for
 OS policy, native artifact installation, canonical launch stages and safe replay.
+
+## Source-owned installation maintenance inventory
+
+The trusted installation owner loads exact protected content references for the
+original and staged candidate descriptor using `Authority::Deployment.load_artifact`.
+This Ruby-only source interface validates immutable authenticated descriptor bytes;
+it does not establish installed network or native readiness and is not exposed
+through worker transport or a CLI selector.
+
+`LaunchLifecycle#with_execution_slots(mapping_ids:, candidate_deployment:)` holds
+the same slot exclusions as normal admission while yielding frozen fixed
+mapping/journal/commit contexts. Changed, added and removed mappings cannot be
+omitted. Removed mappings retain their original journal selection; new mappings
+use the staged selection. Existing mappings and physical slots cannot be recycled
+to hide history. Ref changes, unreadable roots and conflicting aliases refuse.
+
+Full `slot_reusable!` maintenance eligibility and parent retirement remain
+unavailable until complete historical authentication and actual current inventory
+verification are connected. The inventory block grants neither policy publication
+nor positive maintenance readiness. Finish/stop wiring and installed acceptance
+remain separate unfinished 9c2 requirements. Existing normal admission and guarded
+abort/release behavior retain their current checks.
+
+## Authenticated readiness and terminal scope closure
+
+The source-owned fixed ExecStartPost readiness hook uploads one bounded report
+through the authenticated authority connection, closes its write side and waits
+for acknowledgement. The authority joins the exact manager-selected hook/server
+actors, immutable runtime/configuration dependencies, original boot/network
+proofs and complete live mount/IPC/resource observations before binding native
+admission. The hook’s observed server network namespace must match both the original
+parent selection and the canonical network installation admission. A missing,
+malformed or different identity refuses native binding before child release.
+Unknown writable projections, writable API descendants, changed
+socket endpoints and incomplete evidence refuse. A read-only socket mount does
+not authorize messages.
+
+Original service issuance remains tracked while the manager command runs outside
+the callback's exclusions. Sealing cannot publish an empty-scope proof while an
+original issuer can still start the service. Admitted-but-unbound starts use the
+same positive cleanup and worker baseline as bound starts; an inactive snapshot
+does not assert that execution never happened.
+
+After the genuine terminal owner accepts authenticated result evidence, the
+existing release producer joins that receipt to the exact sealed empty scope.
+Current activation, jobs, recursive population, original resource identities,
+native directory absence and outside worker UID writers are checked again before
+publishing or consuming the proof. Empty scope alone supplies no terminal result.
+
+The required per-boot host proof is selected before parent activation and retained
+in canonical `scope_bound.boot_baseline_selection`; later reads authenticate that
+original immutable artifact rather than a current pointer. Domain gad.8/gad.b
+still must deliver trusted cold-start/boot refresh and activation inhibition.
+These source interfaces and controlled tests do not establish installed native,
+network or boot acceptance, and task 9c2 remains in progress through integration
+and independent review.
+
+
+### Protected sealed-service no-effect settlement
+
+For the fixed original executor, `service_status` includes a closed immutable `settlement_context` containing the authenticated original request, execution binding and accepted current challenge (or null). Full original mapping/project/receiver credentials are checked before this private context is exposed. Ordinary status roles retain their existing projection. Terminal status still authenticates the imported original receipt through the canonical reader.
+
+The fixed original executor uses `claim_service_settlement` against the sealed original request. The authority records an acyclic challenge selecting the latest canonical uncertain/failed outcome. `complete_no_effect` uploads the exact original receipt and bounded inspection artifact through the existing private transfer. It authenticates the accepted challenge, original dispatch binding and imported artifact before atomically reaching `failed-settled`. Exact retries retain their first reply and do not invoke a new effect. A later genuine failure needs a fresh challenge; missing/orphan/stale challenges and changed input refuse.
+
+This generic authority path attributes the closed inspection report to the recorded executor. Actual operation-specific target absence, handler termination and surviving-writer inspection are an open gad.b producer obligation; a closed scope or timeout does not prove no effect. The current protected ingress atomically accepts a request and executor claim, so an absent canonical request cannot be converted into a requested-but-unclaimed settlement record.
+
+
+### Protected original worker submission
+
+Run under the actual original prepared worker while its lineage is live. Read
+`ace-assign authority status --mapping M --assignment A --attempt T` and save
+`authority_generation` for the next new mutation. Candidate submission uses
+current `result_candidate_generation` (zero if null), then returns the next
+positive candidate generation. Review/result use that returned generation.
+
+```sh
+ace-assign submit-candidate --mapping M --assignment A --attempt T --head H \
+  --candidate-generation CURRENT --expected-generation G --mutation CANDIDATE --bundle candidate.bundle
+ace-assign submit-result --mapping M --assignment A --attempt T --head H \
+  --candidate-generation ACCEPTED --expected-generation G --mutation RESULT --receipt result.json \
+  --artifact first-evidence --artifact second-evidence
+```
+
+The actual worker builds `Ace::Assign::Models::ExecutionReceipt` from its original
+assignment/project/scope, installed worker actor, tested head and actual executed
+checks/artifact digests. Failed receipts may have zero artifacts; succeeded
+receipts require evidence. Captured queue completion does not create a receipt or
+canonical acceptance. Independent installed reviewers use the existing
+`ace-overseer review` consumer for that exact candidate. Result submission obtains
+a new generation after review; exact retries retain the original generation,
+mutation and identical ordered bytes. Supervisor finish still revalidates result,
+review, writer exclusion and settlement. A lost reply never causes automatic resend.

data/exe/ace-scope-ready

@@ -0,0 +1,55 @@
+#!/usr/bin/ruby
+# frozen_string_literal: true
+# Private fixed interpreter action; the unit supplies --disable=gems,rubyopt.
+abort "fixed readiness requires one slot" unless ARGV.length == 1 && ARGV.first.match?(/\A[A-Za-z0-9][A-Za-z0-9._-]{0,127}\z/)
+abort "readiness startup features differ" if defined?(Gem) || ENV.keys.any? { |key| key.match?(/\A(?:RUBY|GEM|BUNDLE)/) }
+protected_path = lambda do |path, directory|
+  abort "readiness path substituted" unless path.start_with?("/") && File.expand_path(path) == path && File.realpath(path) == path
+  current = path
+  loop do
+    stat = File.lstat(current)
+    abort "readiness path is writable" unless stat.uid.zero? && !stat.symlink? && (stat.mode & 0o022).zero?
+    abort "readiness directory differs" if current == path && directory && !stat.directory?
+    break if current == "/"
+    current = File.dirname(current)
+  end
+end
+$LOAD_PATH.each { |path| protected_path.call(path, true) }
+require "json"
+require "digest"
+path = "/etc/ace/execution-slots/#{ARGV.first}/readiness.json"
+protected_path.call(path, false)
+bytes = File.open(path, File::RDONLY | File::NOFOLLOW) { |file| file.read(65_537) }
+abort "readiness configuration bound differs" unless bytes.bytesize.between?(1, 65_536)
+config = JSON.parse(bytes.force_encoding(Encoding::UTF_8), create_additions: false, max_nesting: 8,
+  allow_duplicate_key: false, allow_comments: false)
+runtime = config.fetch("runtime")
+references = runtime.fetch("dependencies")
+abort "readiness runtime closure oversized" unless references.is_a?(Array) && references.size.between?(1, 256)
+total = 0
+references.each do |ref|
+  abort "readiness dependency reference differs" unless ref.is_a?(Hash) && ref.keys.sort == %w[bytes path sha256] &&
+    ref["path"].is_a?(String) && ref["path"].bytesize.between?(1, 4096) && !ref["path"].include?("\0") &&
+    ref["bytes"].is_a?(Integer) && ref["bytes"].between?(1, 1_048_576) &&
+    ref["sha256"].is_a?(String) && ref["sha256"].match?(/\A[0-9a-f]{64}\z/)
+  total += ref.fetch("bytes")
+  abort "readiness runtime closure byte bound differs" if total > 16_777_216
+  protected_path.call(ref.fetch("path"), false)
+  content = File.open(ref.fetch("path"), File::RDONLY | File::NOFOLLOW) { |file| file.read(ref.fetch("bytes") + 1) }
+  abort "readiness dependency changed" unless content.bytesize == ref.fetch("bytes") && Digest::SHA256.hexdigest(content) == ref.fetch("sha256")
+end
+builtins = %w[enumerator.so thread.rb fiber.so rational.so complex.so ruby2_keywords.rb]
+$LOADED_FEATURES.each do |feature|
+  abort "readiness startup loaded undeclared code" unless builtins.include?(feature) || references.any? { |ref| ref.fetch("path") == feature }
+end
+paths = runtime.fetch("load_paths")
+abort "readiness load paths oversized" unless paths.is_a?(Array) && paths.size.between?(1, 16)
+paths.each { |selected| protected_path.call(selected, true) }
+$LOAD_PATH.replace(paths)
+require "ace/runtime/molecules/readiness_configuration"
+require "ace/runtime/molecules/readiness_runtime"
+configuration = Ace::Runtime::Molecules::ReadinessConfiguration.decode(bytes, slot: ARGV.first)
+Ace::Runtime::Molecules::ReadinessRuntime.new(configuration: configuration.data).activate!
+require "ace/assign/errors"
+require "ace/assign/authority/readiness_hook"
+Ace::Assign::Authority::ReadinessHook.new(slot: ARGV.first, configuration: configuration).run

data/handbook/workflow-instructions/assign/drive.wf.md

@@ -40,7 +40,8 @@ If this workflow is invoked with an argument (for example `/as-assign-drive abc1
 
 ```bash
 # Set once from workflow argument or internal scoped default (empty when neither is provided)
-ASSIGNMENT_TARGET="${1:-${ACE_ASSIGN_DEFAULT_TARGET:-}}"
+DEFAULT_ASSIGNMENT_TARGET="${ACE_ASSIGN_DEFAULT_TARGET:-}"
+ASSIGNMENT_TARGET="${1:-$DEFAULT_ASSIGNMENT_TARGET}"
 
 # Resolve and pin assignment identity for the full drive loop
 if [ -n "$ASSIGNMENT_TARGET" ]; then
@@ -659,6 +660,30 @@ Follow the instructions directly, performing the described work:
 
 Every external-facing step (implement, verify, review, merge, publish, deploy, release) runs inside a scoped attempt. The attempt -- not the report and not exit status -- is the delivery record.
 
+For an original protected PreparedWorker, use its already admitted assignment,
+attempt and selected scope. Do not run the local `attempt start`/receipt-file
+sequence below, acquire another attempt, or execute an outer preset step. The
+delivery step must already belong to the immutable captured subtree. Submit the
+actual candidate and obtain the installed independent reviewer acceptance through
+the protected commands supplied by the original drive prompt.
+
+For an authorized protected merge, retain the exact approved head/candidate
+generation, structured input file, installed receiver, authorization and stable
+request ID. Read current authority generation for the first new request. Invoke
+`ace-lab service request` with those original mapping/assignment/attempt/scope
+selectors. Inspect `ace-lab service status` with the same request, input digest and
+target, then consume succeeded canonical evidence with `ace-assign delivery
+--operation merge --service-request REQUEST` and the same selectors. Include
+`--artifact-digest` on status and consumption when the original target has one.
+Exact retries retain the original generation, mutation/request ID and input bytes;
+uncertainty never permits refreshing or resending an effect. The protected delivery
+consumer verifies the imported receipt and canonical delivery event without another
+provider mutation. Only that succeeded result permits finishing the active queue
+step. Refusal, unavailable evidence or uncertainty leaves it unfinished and reports
+the exact blocker. Credentials and queue completion do not replace authorization
+or canonical evidence. The following local attempt sequence applies only to
+ordinary standalone assignments.
+
 **Step 1: Start the attempt before executing the step.** Actor identity is derived from the execution boundary; never pass actor flags.
 
 ```bash

data/lib/ace/assign/atoms/attempt_state_machine.rb

@@ -59,6 +59,14 @@ module Ace
           TRANSITIONS.fetch(from.to_s, [])
         end
 
+        # Source-owned cessation, invoked only after original no-writers and
+        # exhaustive independent settlement proof. This does not broaden the
+        # ordinary uncertain receipt-reconciliation transition table.
+        def self.proof_stopped_transition!(state)
+          return "stopped" if %w[running uncertain].include?(state.to_s)
+          raise AttemptErrors::InvalidTransition, "Proof-linked stop requires an active bound attempt"
+        end
+
         # Validate a transition.
         #
         # @param from [String] Current state

data/lib/ace/assign/atoms/delivery_parameters.rb

@@ -1,52 +1,17 @@
 # frozen_string_literal: true
-require "ace/git/atoms/server_url"
+require "ace/git/atoms/delivery_parameters"
 
 module Ace
   module Assign
     module Atoms
-      # Explicit non-secret remote delivery inputs; local recipes need not call this validator.
+      # Assignment configuration consumes the shared forge-neutral owner.
       module DeliveryParameters
-        PROVENANCE_FIELDS = %w[mode head_repository_url head_ref base_repository_url base_ref].freeze
         def self.validate(input)
-          raise ArgumentError, "Delivery parameters must be a mapping" unless input.is_a?(Hash)
-          unless (input.keys - %w[forge_server forge_default pr_provenance]).empty?
-            raise ArgumentError, "Unexpected delivery parameter fields"
-          end
-          default = input.fetch("forge_default", false)
-          raise ArgumentError, "forge_default must be boolean" unless [true, false].include?(default)
-          server = input["forge_server"]
-          if server && (!server.is_a?(String) || !server.match?(/\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/))
-            raise ArgumentError, "Invalid forge_server"
-          end
-          raise ArgumentError, "forge_server and forge_default are mutually exclusive" if server && default
-          provenance = input["pr_provenance"]
-          unless provenance.is_a?(Hash) && provenance.keys.sort == PROVENANCE_FIELDS.sort &&
-              %w[fork canonical].include?(provenance["mode"])
-            raise ArgumentError, "Explicit complete fork or canonical PR provenance is required"
-          end
-          %w[head_repository_url base_repository_url].each { |key| validate_url!(provenance[key]) }
-          %w[head_ref base_ref].each do |key|
-            ref = provenance[key]
-            unless ref.is_a?(String) && ref.match?(/\A[a-zA-Z0-9][a-zA-Z0-9_\/.\-]{0,255}\z/) &&
-                !ref.include?("..") && !ref.include?("//") && !ref.end_with?("/", ".", ".lock")
-              raise ArgumentError, "Invalid PR ref"
-            end
-          end
-          if provenance["mode"] == "canonical" && !Ace::Git::Atoms::ServerUrl.match?(
-              provenance["head_repository_url"], provenance["base_repository_url"])
-            raise ArgumentError, "Canonical provenance requires matching head and base repositories"
-          end
-          {"forge_server" => server, "forge_default" => default,
-           "pr_provenance" => provenance.transform_values(&:dup)}
+          Ace::Git::Atoms::DeliveryParameters.validate(input)
         end
 
         def self.validate_url!(url)
-          unless url.is_a?(String) && url.length <= 512 &&
-              (url.match?(%r{\Ahttps?://[a-zA-Z0-9.:-]+/[a-zA-Z0-9_./-]+\z}) ||
-               url.match?(%r{\Agit@[a-zA-Z0-9.-]+:[a-zA-Z0-9_./-]+\z}) ||
-               url.match?(%r{\Assh://git@[a-zA-Z0-9.:-]+/[a-zA-Z0-9_./-]+\z}))
-            raise ArgumentError, "PR repository URL must contain a repository and no credentials or query"
-          end
+          Ace::Git::Atoms::DeliveryParameters.validate_url!(url)
         end
       end
     end