ace-assign 0.64.0 → 0.66.0

data/lib/ace/assign/cli/commands/finish.rb

@@ -13,6 +13,8 @@ module Ace
 
           argument :step, required: false, desc: "Step number to finish (active assignment only)"
           option :message, aliases: ["-m"], desc: "Report content: string, file path, or pipe stdin"
+          option :mapping, desc: "Installed protected launch mapping ID"
+          option :attempt, desc: "Original protected attempt ID"
           option :assignment, desc: "Target specific assignment ID"
           option :quiet, aliases: ["-q"], type: :boolean, default: false, desc: "Suppress non-essential output"
           option :debug, aliases: ["-d"], type: :boolean, default: false, desc: "Show debug output"
@@ -24,7 +26,7 @@ module Ace
 
             target = resolve_assignment_target(options)
             executor = build_executor_for_target(target)
-            report_content = resolve_report_content(options)
+            report_content = resolve_report_content(options, protected: !target.prepared_input.nil?)
             result = executor.finish_step(
               report_content: report_content,
               step_number: step,
@@ -72,8 +74,27 @@ module Ace
 
           private
 
-          def resolve_report_content(options)
+          def resolve_report_content(options, protected: false)
             message = options[:message]&.strip
+            if protected
+              limit = Ace::Assign::Authority::PreparedWork::MAX_TEXT
+              if message && !message.empty? && File.exist?(message)
+                return File.open(message, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
+                  before = file.stat
+                  raise Error, "Report input must be a bounded regular file" unless before.file? && before.size.between?(1, limit)
+                  bytes = file.read(limit + 1)
+                  after = file.stat
+                  unless bytes.bytesize == before.size && [before.dev, before.ino, before.size, before.mtime, before.ctime] ==
+                      [after.dev, after.ino, after.size, after.mtime, after.ctime]
+                    raise Error, "Report input changed"
+                  end
+                  bytes
+                end
+              end
+              bytes = message && !message.empty? ? message : $stdin.read(limit + 1)
+              raise Error, "Report input exceeds captured text bound" unless bytes && bytes.bytesize.between?(1, limit)
+              return bytes
+            end
             return File.read(message) if message && !message.empty? && File.exist?(message)
             return message if message && !message.empty?
 

data/lib/ace/assign/cli/commands/fork_session.rb

@@ -7,6 +7,7 @@ module Ace
         # Internal command used by tmux-backed fork panes to launch the provider session once.
         class ForkSession < Ace::Support::Cli::Command
           include Ace::Support::Cli::Base
+          include AssignmentTarget
 
           desc "Run one provider-backed fork session for a subtree"
 
@@ -21,10 +22,11 @@ module Ace
 
           def initialize(launcher: nil)
             super()
-            @launcher = launcher || Molecules::ForkSessionLauncher.new
+            @launcher = launcher
           end
 
           def call(**options)
+            refuse_protected_graph_mutation!(options)
             launcher.launch_provider_session(
               assignment_id: options[:assignment],
               fork_root: options[:root],
@@ -44,7 +46,9 @@ module Ace
 
           private
 
-          attr_reader :launcher
+          def launcher
+            @launcher ||= Molecules::ForkSessionLauncher.new
+          end
         end
       end
     end

data/lib/ace/assign/cli/commands/inbox_bind.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+require_relative "attempt/base"
+
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        class InboxBind < Ace::Support::Cli::Command
+          include Ace::Support::Cli::Base
+          include Attempt::Base
+
+          desc "Bind an original protected Inbox registration before scope closure"
+          option :mapping, desc: "Exact installed mapping ID"
+          option :assignment, desc: "Exact original assignment ID"
+          option :attempt, desc: "Exact original attempt ID"
+          option :event, desc: "Original Inbox event ID"
+          option :inbox_context, desc: "Installed Inbox context ID"
+          option :mutation, desc: "Stable original authority mutation ID"
+          option :expected_generation, desc: "Original authority mutation generation"
+
+          def call(**options)
+            context = protected_context(options)
+            raise AttemptErrors::EvidenceUnavailable, "Inbox binding requires installed protected authority" unless context
+            usage = "inbox-bind --mapping MAP --assignment ID --attempt ID --event ID --inbox-context ID --mutation ID --expected-generation N"
+            client, params, mutation = protected_attempt_request(context, options, usage)
+            params.merge!("event_id" => require_option(options, :event, usage),
+              "inbox_context_id" => require_option(options, :inbox_context, usage))
+            emit_json(protected_call(client, "bind_inbox", params, mutation))
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/protected_submission.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+require_relative "attempt/base"
+require "digest"
+
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        # Local files provide bounded bytes; only the existing authority grants admission.
+        module ProtectedSubmission
+          include Attempt::Base
+          private
+
+          def require_option(options, key, usage)
+            value = options[key].to_s.strip
+            raise Ace::Support::Cli::Error, "Missing --#{key}: usage: ace-assign #{usage}" if value.empty?
+            value
+          end
+
+          def submission_request(options, usage)
+            context = protected_context(options)
+            raise AttemptErrors::EvidenceUnavailable, "Submission requires installed protected authority" unless context
+            protected_attempt_request(context, options, usage)
+          end
+
+          def input_bytes(path, limit:, nonempty: true)
+            File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
+              before = file.stat
+              raise Ace::Support::Cli::Error, "Input must be a bounded regular file" unless before.file? && before.size.between?(nonempty ? 1 : 0, limit)
+              bytes = file.read(limit + 1)
+              after = file.stat
+              selected = File.lstat(path)
+              identity = ->(stat) { [stat.dev, stat.ino, stat.size, stat.mtime, stat.ctime] }
+              unless bytes.bytesize == before.size && identity.call(before) == identity.call(after) &&
+                  identity.call(after) == identity.call(selected) && !selected.symlink?
+                raise Ace::Support::Cli::Error, "Input changed during bounded read"
+              end
+              bytes.freeze
+            end
+          rescue SystemCallError, IOError
+            raise Ace::Support::Cli::Error, "Input file is unavailable"
+          end
+
+          def input_json(bytes)
+            text = bytes.dup.force_encoding(Encoding::UTF_8)
+            raise Ace::Support::Cli::Error, "Input JSON is malformed" unless text.valid_encoding?
+            JSON.parse(text, create_additions: false, max_nesting: 32, allow_duplicate_key: false, allow_comments: false)
+          rescue JSON::ParserError
+            raise Ace::Support::Cli::Error, "Input JSON is malformed"
+          end
+
+          def upload_call(client, operation, params, mutation, parts, purpose)
+            client.call(operation, params, mutation_id: mutation, upload_parts: parts, purpose: purpose, timeout: 30).data
+          rescue SecurityError, Ace::Runtime::RuntimeUnavailableError, SystemCallError, IOError
+            protected_transport_unavailable!
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/resume.rb

@@ -8,11 +8,23 @@ module Ace
       module Commands
         class Resume < Ace::Support::Cli::Command
           include Ace::Support::Cli::Base
+          include AssignmentTarget
           desc "Recover accepted assignment state without launching another writer"
           option :assignment, desc: "Assignment ID"
+          option :mapping, desc: "Installed protected launch mapping ID"
+          option :attempt, desc: "Original protected attempt ID"
           option :dry_run, type: :boolean, default: false, desc: "Inspect recovery without writing observations"
 
           def call(**options)
+            target = resolve_assignment_target(options)
+            if target.prepared_input
+              raise Ace::Support::Cli::Error, "protected resume only supports --dry-run" unless options[:dry_run]
+              result = build_executor_for_target(target).status
+              descriptor = target.prepared_input.descriptor
+              puts JSON.generate(descriptor.slice("assignment_id", "mapping_id", "attempt_id", "scope", "definition_digest", "selection_sha256").merge(
+                "state" => result.fetch(:state).assignment_state.to_s, "dry_run" => true))
+              return
+            end
             id = options[:assignment].to_s.strip
             raise Ace::Support::Cli::Error, "--assignment ID is required" if id.empty?
 

data/lib/ace/assign/cli/commands/select.rb

@@ -13,6 +13,7 @@ module Ace
         #   ace-assign select --clear
         class Select < Ace::Support::Cli::Command
           include Ace::Support::Cli::Base
+          include AssignmentTarget
 
           desc "Select an assignment as the current active assignment"
 
@@ -22,6 +23,7 @@ module Ace
           option :debug, aliases: ["-d"], type: :boolean, default: false, desc: "Show debug output"
 
           def call(id: nil, **options)
+            refuse_protected_graph_mutation!(options)
             manager = Molecules::AssignmentManager.new
 
             if options[:clear]

data/lib/ace/assign/cli/commands/start.rb

@@ -12,6 +12,8 @@ module Ace
           desc "Start next workable pending step"
 
           argument :step, required: false, desc: "Step number to start (active assignment only)"
+          option :mapping, desc: "Installed protected launch mapping ID"
+          option :attempt, desc: "Original protected attempt ID"
           option :assignment, desc: "Target specific assignment ID"
           option :quiet, aliases: ["-q"], type: :boolean, default: false, desc: "Suppress non-essential output"
           option :debug, aliases: ["-d"], type: :boolean, default: false, desc: "Show debug output"

data/lib/ace/assign/cli/commands/status.rb

@@ -41,6 +41,8 @@ module Ace
           option :format, desc: "Output format (table, json)", default: "table"
           option :quiet, aliases: ["-q"], type: :boolean, default: false, desc: "Suppress non-essential output"
           option :debug, aliases: ["-d"], type: :boolean, default: false, desc: "Show debug output"
+          option :mapping, desc: "Installed protected launch mapping ID"
+          option :attempt, desc: "Original protected attempt ID"
           option :assignment, desc: "Show status for specific assignment ID"
           option :all, aliases: ["-a"], type: :boolean, default: false, desc: "Include completed assignments in other assignments section"
 
@@ -85,7 +87,7 @@ module Ace
           def status_to_h(assignment, state, active_steps, next_step, target:, scope_root:)
             # Extract auto_merge config if present in assignment settings or preset
             auto_merge = false
-            preset_name = Ace::Assign::Molecules::PresetInferrer.infer_from_assignment(assignment)
+            preset_name = Ace::Assign::Molecules::PresetInferrer.infer_from_assignment(assignment) unless target.prepared_input
             auto_merge = true if preset_name && preset_name.start_with?("work-on-task-auto-merge")
 
             evidence = Ace::Assign::Molecules::EvidenceCalculator.calculate(
@@ -135,7 +137,7 @@ module Ace
             lines = []
             lines.concat(compact_summary_lines(view.assignment, view.scoped_state, view.active_steps, view.next_step))
 
-            if (attempt_line = compact_attempt_line(view.assignment.id))
+            if !target.prepared_input && (attempt_line = compact_attempt_line(view.assignment.id))
               lines.insert(1, attempt_line)
             end
 

data/lib/ace/assign/cli/commands/step.rb

@@ -12,6 +12,8 @@ module Ace
           desc "Show instructions for the active, next, or explicit step"
 
           argument :step, required: false, desc: "Exact step number to inspect"
+          option :mapping, desc: "Installed protected launch mapping ID"
+          option :attempt, desc: "Original protected attempt ID"
           option :assignment, desc: "Target specific assignment ID"
           option :quiet, aliases: ["-q"], type: :boolean, default: false, desc: "Suppress non-essential output"
           option :debug, aliases: ["-d"], type: :boolean, default: false, desc: "Show debug output"
@@ -24,7 +26,7 @@ module Ace
             return if options[:quiet]
 
             if inspected
-              puts inspected.instructions
+              puts(target.prepared_input ? target.prepared_input.render(inspected.instructions) : inspected.instructions)
             else
               puts no_work_message(view)
             end

data/lib/ace/assign/cli/commands/submit_candidate.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+require_relative "protected_submission"
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        class SubmitCandidate < Ace::Support::Cli::Command
+          include Ace::Support::Cli::Base
+          include ProtectedSubmission
+          desc "Submit original protected worker bundle bytes"
+          option :mapping, desc: "Installed mapping"
+          option :assignment, desc: "Original assignment"
+          option :attempt, desc: "Original attempt"
+          option :head, desc: "Exact candidate head"
+          option :candidate_generation, desc: "Expected current candidate generation (zero before first submission)"
+          option :expected_generation, desc: "Persisted authority generation"
+          option :mutation, desc: "Stable original mutation"
+          option :bundle, desc: "Bounded local byte file"
+
+          def call(**options)
+            usage = "submit-candidate with original selectors, generation, mutation and --bundle FILE"
+            client, params, mutation = submission_request(options, usage)
+            head = require_option(options, :head, usage)
+            raise Ace::Support::Cli::Error, "Head must be an exact SHA-1" unless head.match?(/\A[0-9a-f]{40}\z/)
+            params.merge!("head" => head, "candidate_generation" => integer_option(options, :candidate_generation, usage))
+            bytes = input_bytes(require_option(options, :bundle, usage), limit: 64 * 1024 * 1024)
+            parts = [bytes]
+            emit_json(upload_call(client, "submit_candidate", params, mutation, parts, :candidate))
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli/commands/submit_result.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+require_relative "protected_submission"
+require_relative "../../authority/receipt_transfer"
+module Ace
+  module Assign
+    module CLI
+      module Commands
+        class SubmitResult < Ace::Support::Cli::Command
+          include Ace::Support::Cli::Base
+          include ProtectedSubmission
+          desc "Submit original protected worker receipt bytes"
+          option :mapping, desc: "Installed mapping"
+          option :assignment, desc: "Original assignment"
+          option :attempt, desc: "Original attempt"
+          option :head, desc: "Exact candidate head"
+          option :candidate_generation, desc: "Positive candidate generation"
+          option :expected_generation, desc: "Persisted authority generation"
+          option :mutation, desc: "Stable original mutation"
+          option :receipt, desc: "Bounded local byte file"
+          option :artifact, type: :array, desc: "Ordered artifact byte files"
+
+          def call(**options)
+            usage = "submit-result with original selectors, generation, mutation and --receipt FILE"
+            client, params, mutation = submission_request(options, usage)
+            head = require_option(options, :head, usage)
+            raise Ace::Support::Cli::Error, "Head must be an exact SHA-1" unless head.match?(/\A[0-9a-f]{40}\z/)
+            params.merge!("head" => head, "candidate_generation" => integer_option(options, :candidate_generation, usage, positive: true))
+            bytes = input_bytes(require_option(options, :receipt, usage), limit: 16 * 1024)
+            receipt = input_json(bytes)
+            raise Ace::Support::Cli::Error, "Receipt must be an object" unless receipt.is_a?(Hash)
+            allowed = Models::ExecutionReceipt.from_h(receipt).to_h.keys
+            if (receipt.keys - allowed).any? || Models::ExecutionReceipt.forbidden_field?(receipt)
+              raise Ace::Support::Cli::Error, "Receipt contains unsupported fields"
+            end
+            unless receipt.values_at("assignment_id", "attempt_id", "head") == params.values_at("assignment_id", "attempt_id", "head") &&
+                Models::ExecutionReceipt::VERDICTS.include?(receipt["verdict"])
+              raise Ace::Support::Cli::Error, "Receipt identity or verdict differs"
+            end
+            files = options.fetch(:artifact, [])
+            unless files.is_a?(Array) && files.size <= 16 && !(receipt["verdict"] == "succeeded" && files.empty?)
+              raise Ace::Support::Cli::Error, "Receipt artifact declarations are invalid"
+            end
+            artifacts = files.map { |path| input_bytes(path, limit: 64 * 1024, nonempty: false) }
+            parts = [bytes, *artifacts]
+            digest = Digest::SHA256.hexdigest(bytes)
+            input = Struct.new(:parts) do
+              def count = parts.length
+              def bytes(index: 0) = parts.fetch(index)
+            end.new(parts)
+            # Reuse the maintained ordered artifact validator. This is input
+            # checking only; canonical result/producer admission remains Endcap's.
+            Ace::Assign::Authority::ReceiptTransfer.decode(input: input, receipt_sha256: digest,
+              artifact_field: "artifacts", reference_key: "path")
+            params["receipt_sha256"] = digest
+            emit_json(upload_call(client, "submit_result", params, mutation, parts, :receipt_artifacts))
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/assign/cli.rb

@@ -55,11 +55,15 @@ require_relative "organisms/attempt_coordinator"
 
 # Commands
 require_relative "cli/commands/delivery"
-require_relative "cli/commands/create"
 require_relative "cli/commands/assignment_target"
+require_relative "cli/commands/create"
 require_relative "cli/commands/status"
 require_relative "cli/commands/resume"
-require_relative "cli/commands/inbox_reconcile"
+require_relative "cli/commands/inbox_bind"
+require_relative "cli/commands/submit_candidate"
+require_relative "cli/commands/submit_result"
+require_relative "cli/commands/campaign_record_round"
+require_relative "cli/commands/campaign_export_result"
 require_relative "cli/commands/step"
 require_relative "cli/commands/start"
 require_relative "cli/commands/finish"
@@ -74,6 +78,12 @@ require_relative "cli/commands/authority/serve"
 require_relative "cli/commands/authority/launch"
 require_relative "cli/commands/authority/status"
 require_relative "cli/commands/authority/terminate"
+require_relative "cli/commands/authority/worker"
+require_relative "cli/commands/authority/task_context"
+require_relative "cli/commands/authority/task_context_principal"
+require_relative "cli/commands/authority/task_context_selection"
+require_relative "cli/commands/authority/inbox_context_principal"
+require_relative "cli/commands/authority/inbox_context_selection"
 require_relative "cli/commands/attempt/base"
 require_relative "cli/commands/attempt/start"
 require_relative "cli/commands/attempt/status"
@@ -96,7 +106,17 @@ module Ace
         ["authority launch", "Launch one mapped native gated worker"],
         ["authority status", "Inspect protected launch ownership"],
         ["authority terminate", "Terminate the original native gated child"],
+        ["authority worker", "Consume original authenticated prepared work"],
+        ["authority task-context", "Read captured original task context through the fixed entry"],
+        ["authority task-context-principal", "Classify the actual caller through retained protected owners"],
+        ["authority task-context-selection", "Read the authenticated original context entry selection"],
+        ["authority inbox-context-principal", "Classify the actual caller through every retained protected owner"],
+        ["authority inbox-context-selection", "Read the fixed installed inbox context selection"],
         ["delivery", "Execute or reconcile attempt-bound forge delivery"],
+        ["submit-candidate", "Submit original protected worker candidate bytes"],
+        ["submit-result", "Submit original protected worker receipt and artifact bytes"],
+        ["campaign-export-result", "Download the original parent campaign's verified accepted result"],
+        ["campaign-record-round", "Consume canonical settled children into the original campaign store"],
         ["status", "Show assignment status"],
         ["step", "Show step instructions"],
         ["start", "Start next workable step"],
@@ -110,8 +130,9 @@ module Ace
         ["attempt start", "Start a scoped attempt for an assignment step"],
         ["attempt status", "Show attempt status for an assignment"],
         ["attempt evidence", "Read accepted current-head check evidence"],
-        ["attempt finish", "Finish an attempt with a structured execution receipt"],
-        ["attempt reconcile", "Reconcile an interrupted or uncertain attempt"]
+        ["attempt finish", "Finish a protected canonical result or an ordinary local receipt"],
+        ["attempt reconcile", "Recover an exact protected attempt or reconcile an ordinary attempt"],
+        ["inbox-bind", "Bind an original protected Inbox registration"],
       ].freeze
 
       HELP_EXAMPLES = [
@@ -164,6 +185,12 @@ module Ace
 register "authority launch", wrap_command(Commands::Authority::Launch)
 register "authority status", wrap_command(Commands::Authority::Status)
 register "authority terminate", wrap_command(Commands::Authority::Terminate)
+register "authority worker", wrap_command(Commands::Authority::Worker)
+register "authority task-context", wrap_command(Commands::Authority::TaskContext)
+register "authority task-context-principal", wrap_command(Commands::Authority::TaskContextPrincipal)
+register "authority task-context-selection", wrap_command(Commands::Authority::TaskContextSelection)
+register "authority inbox-context-principal", wrap_command(Commands::Authority::InboxContextPrincipal)
+register "authority inbox-context-selection", wrap_command(Commands::Authority::InboxContextSelection)
       register "create", wrap_command(Commands::Create)
       register "delivery", wrap_command(Commands::Delivery)
       register "status", wrap_command(Commands::Status)
@@ -183,7 +210,11 @@ register "authority terminate", wrap_command(Commands::Authority::Terminate)
       register "attempt finish", wrap_command(Commands::Attempt::Finish)
       register "attempt reconcile", wrap_command(Commands::Attempt::Reconcile)
       register "resume", wrap_command(Commands::Resume)
-      register "inbox-reconcile", wrap_command(Commands::InboxReconcile)
+      register "inbox-bind", wrap_command(Commands::InboxBind)
+      register "submit-candidate", wrap_command(Commands::SubmitCandidate)
+      register "submit-result", wrap_command(Commands::SubmitResult)
+      register "campaign-export-result", wrap_command(Commands::CampaignExportResult)
+      register "campaign-record-round", wrap_command(Commands::CampaignRecordRound)
 
       # Register version command
       version_cmd = Ace::Support::Cli::VersionCommand.build(

data/lib/ace/assign/errors.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+require "ace/support/cli/error"
+
+module Ace
+  module Assign
+    # Base error class for all ace-assign exceptions.
+    # Inherits from Ace::Support::Cli::Error to support exception-based
+    # exit code pattern (per ADR-023).
+    #
+    # Subclasses should call super with appropriate exit_code.
+    class Error < Ace::Support::Cli::Error
+      def initialize(message, exit_code: 1)
+        super
+      end
+    end
+
+    # Assignment-related errors
+    module AssignmentErrors
+      class NotFound < Error
+        def initialize(message = "Assignment not found")
+          super(message, exit_code: 2)
+        end
+      end
+
+      class NoActive < Error
+        def initialize(message = "No active assignment")
+          super(message, exit_code: 2)
+        end
+      end
+    end
+
+    # Config-related errors
+    module ConfigErrors
+      class NotFound < Error
+        def initialize(message = "Configuration not found")
+          super(message, exit_code: 3)
+        end
+      end
+    end
+
+    # Step-related errors
+    module StepErrors
+      class NotFound < Error
+        def initialize(message = "Step not found")
+          super(message, exit_code: 4)
+        end
+      end
+
+      class InvalidState < Error; end
+    end
+
+    # Attempt/evidence-related errors (exit code 5)
+    module AttemptErrors
+      class InvalidTransition < Error
+        def initialize(message = "Illegal attempt state transition")
+          super(message, exit_code: 5)
+        end
+      end
+
+      class InvalidScope < Error
+        def initialize(message = "Invalid attempt scope")
+          super(message, exit_code: 5)
+        end
+      end
+
+      # Duplicate start with a conflicting binding for an owned subtree
+      class Conflict < Error
+        def initialize(message = "Conflicting active attempt for scope")
+          super(message, exit_code: 5)
+        end
+      end
+
+      class NotFound < Error
+        def initialize(message = "Attempt not found")
+          super(message, exit_code: 5)
+        end
+      end
+
+      # Untrusted or unknown execution identity; authority fails closed
+      class UnauthorizedIdentity < Error
+        def initialize(message = "Unknown or unauthorized execution identity")
+          super(message, exit_code: 5)
+        end
+      end
+
+      # Receipt failed verification (binding, head, digest, artifacts, review)
+      class ReceiptRejected < Error
+        def initialize(message = "Receipt rejected")
+          super(message, exit_code: 5)
+        end
+      end
+
+      # Byte framing failed before any business receipt could be admitted.
+      class MalformedTransfer < ReceiptRejected; end
+
+      # Recovery settled a prior effect, but did not perform this request.
+      class CurrentEffectRequired < ReceiptRejected
+        def initialize(operation:, recovered_operation:)
+          super("Recovered #{recovered_operation}; requested #{operation} still needs execution")
+        end
+      end
+
+      # Attempt state forbids the requested effect (terminal, uncertain, blocked)
+      class InvalidState < Error
+        def initialize(message = "Attempt state forbids the requested operation")
+          super(message, exit_code: 5)
+        end
+      end
+
+      # Evidence storage is missing or unwritable; external effects are blocked
+      class EvidenceUnavailable < Error
+        def initialize(message = "Evidence storage unavailable")
+          super(message, exit_code: 5)
+        end
+      end
+
+      # Complete maintenance exclusions are busy or their admission deadline expired.
+      class MaintenanceBusy < EvidenceUnavailable
+      end
+
+      # One canonical inventory row cannot fit the fixed protocol frame.
+      class BoundedResultUnavailable < EvidenceUnavailable
+      end
+
+      # Exhaustively authenticated service inventory remains unsettled.
+      class ServiceSettlementPending < EvidenceUnavailable
+      end
+
+      # Exhaustively authenticated current Inbox claims remain queued.
+      class InboxSettlementPending < EvidenceUnavailable
+      end
+
+      # Positively admitted original Inbox work remains pending, not corrupt.
+      class InboxContextPending < EvidenceUnavailable
+      end
+    end
+
+  end
+end

data/lib/ace/assign/models/assignment.rb

@@ -20,7 +20,7 @@ module Ace
       # but tests would need to be updated to provide all required fields.
       class Assignment
         attr_reader :id, :name, :description, :created_at, :updated_at, :source_config, :cache_dir, :parent,
-          :task_id, :project_id
+          :task_id, :project_id, :campaign_execution, :review_campaign
 
         # @param id [String] Unique assignment ID (6-char compact timestamp)
         # @param name [String] Human-readable assignment name
@@ -33,7 +33,7 @@ module Ace
         # @param task_id [String, nil] Source task ID attached to this assignment (nil = taskless)
         # @param project_id [String, nil] Project ID this assignment executes in
         def initialize(id:, name:, created_at:, source_config:, description: nil, updated_at: nil, cache_dir: nil,
-          parent: nil, task_id: nil, project_id: nil)
+          parent: nil, task_id: nil, project_id: nil, campaign_execution: nil, review_campaign: nil)
           @id = id.freeze
           @name = name.freeze
           @description = description&.freeze
@@ -44,6 +44,24 @@ module Ace
           @parent = parent&.freeze
           @task_id = task_id&.freeze
           @project_id = project_id&.freeze
+          if !campaign_execution.nil? && !review_campaign.nil?
+            raise ArgumentError, "assignment cannot own both parent campaign and child execution"
+          end
+          @campaign_execution = immutable_campaign_execution(campaign_execution) unless campaign_execution.nil?
+          @review_campaign = immutable_campaign_execution(review_campaign) unless review_campaign.nil?
+        end
+
+        # Keep registered definition bytes stable without retaining caller-owned
+        # mutable objects. Authority validates the closed linkage and provenance.
+        private def immutable_campaign_execution(value)
+          case value
+          when Hash
+            value.to_h { |key, item| [immutable_campaign_execution(key), immutable_campaign_execution(item)] }.freeze
+          when Array then value.map { |item| immutable_campaign_execution(item) }.freeze
+          when String then value.dup.freeze
+          when Integer, NilClass, TrueClass, FalseClass then value
+          else raise ArgumentError, "invalid campaign execution value"
+          end
         end
 
         # @return [Boolean] True when a source task is attached; taskless
@@ -65,7 +83,9 @@ module Ace
             "source_config" => source_config,
             "parent" => parent,
             "task_id" => task_id,
-            "project_id" => project_id
+            "project_id" => project_id,
+            "campaign_execution" => campaign_execution,
+            "review_campaign" => review_campaign
           }.compact
         end
 
@@ -84,7 +104,9 @@ module Ace
             cache_dir: cache_dir,
             parent: data["parent"],
             task_id: data["task_id"],
-            project_id: data["project_id"]
+            project_id: data["project_id"],
+            campaign_execution: data["campaign_execution"],
+            review_campaign: data["review_campaign"]
           )
         end