ace-assign 0.68.0 → 0.70.0

data/lib/ace/assign/molecules/proposal_journal.rb

@@ -11,7 +11,7 @@ module Ace
         PROPOSAL_REFERENCE = /\Aproposal-[0-9a-f]{24}-r[1-9][0-9]*\z/
         PROPOSAL_BINDING = %w[operation project_id assignment_id attempt_id input_digest target candidate_head caller_uid].freeze
 
-        PROPOSAL_IMMUTABLE = (PROPOSAL_BINDING + %w[schema proposal_id revision revision_id request_id requester content_digest created_at authorization context options recommendation rationale prerequisites lifecycle_request revision_operation_id expected_source_revision]).freeze
+        PROPOSAL_IMMUTABLE = (PROPOSAL_BINDING + %w[schema proposal_id revision revision_id request_id requester content_digest created_at authorization context options recommendation rationale prerequisites lifecycle_request revision_operation_id expected_source_revision silence_delegated]).freeze
 
         def proposal_history(id)
           assignment_ids.flat_map do |assignment|
@@ -110,8 +110,7 @@ module Ace
             valid &&= updated["revision_operation_id"].nil? && updated["expected_source_revision"].nil?
           end
           unresolved = previous && proposal_claims(previous["revision_id"]).any? do |claim|
-            claim["state"] != "succeeded" &&
-              !(claim["state"] == "failed-settled" && settlement_evidence_intact?(claim))
+            claim["state"] != "succeeded" && !proposal_no_effect?(claim)
           end
           raise AttemptErrors::ReceiptRejected, "Claimed proposal cannot be revised; reconcile the existing effect" if unresolved
           raise AttemptErrors::ReceiptRejected, "Proposal revision must begin with exact immutable delivery scope" unless valid
@@ -119,10 +118,39 @@ module Ace
         private :validate_proposal_revision!
 
         def proposal_claims(reference)
-          service_request_records.select do |request|
+          claims = (service_request_records + fixed_merge_request_records).select do |request|
             request["authorization"] == reference &&
               !(request["state"] == "rejected" && request["consumed"] == false)
           end
+          return claims if claims.empty?
+          events = read_events(claims.first.fetch("assignment_id"))
+          claims.sort_by do |claim|
+            kind = claim.key?("queue_entry") ? "merge_admission" : "service_claim"
+            events.index do |event|
+              event["type"] == kind && event["attempt_id"] == claim.fetch("attempt_id") &&
+                event.dig("payload", "request_id") == claim.fetch("request_id")
+            end || raise(AttemptErrors::EvidenceUnavailable, "Proposal claim has no canonical admission event")
+          end
+        end
+
+        # Request IDs are scoped by record family. A same-text ID in the other
+        # family is another effect, never an idempotent replay.
+        def proposal_claim_conflict(reference, request_id:, fixed:)
+          [[service_request_records, false], [fixed_merge_request_records, true]].each do |records, family|
+            conflict = records.find do |claim|
+              claim["authorization"] == reference &&
+                !(family == fixed && claim["request_id"] == request_id) &&
+                !(claim["state"] == "rejected" && claim["consumed"] == false) &&
+                !proposal_no_effect?(claim)
+            end
+            return conflict if conflict
+          end
+          nil
+        end
+
+        def proposal_no_effect?(claim)
+          (claim["state"] == "failed-settled" && settlement_evidence_intact?(claim)) ||
+            (claim["state"] == "failed" && claim.key?("queue_entry") && fixed_no_effect_intact?(claim))
         end
 
         def proposal_authorize!(reference, binding)

data/lib/ace/assign/organisms/attempt_coordinator.rb

@@ -37,7 +37,10 @@ module Ace
         # @param identity_resolver [Molecules::ExecutionIdentityResolver, nil] Trust boundary
         # @param verifier [Molecules::ReceiptVerifier, nil] Receipt verifier
         def initialize(cache_base: nil, repo_root: nil, journal: nil, identity_resolver: nil, verifier: nil,
-          lifecycle_exclusion: nil)
+          lifecycle_exclusion: nil, recorded_binding_observer: nil)
+          unless recorded_binding_observer.nil? || recorded_binding_observer.respond_to?(:call)
+            raise ArgumentError, "recorded native binding observer must be callable"
+          end
           @manager = Molecules::AssignmentManager.new(cache_base: cache_base)
           @store = @manager.attempt_store
           @repo_root = repo_root || Ace::Support::Fs::Molecules::ProjectRootFinder.find_or_current
@@ -45,6 +48,7 @@ module Ace
           @identity_resolver = identity_resolver || Molecules::ExecutionIdentityResolver.new
           @verifier = verifier || Molecules::ReceiptVerifier.new(identity_resolver: @identity_resolver)
           @lifecycle_exclusion = lifecycle_exclusion
+          @recorded_binding_observer = recorded_binding_observer
         end
 
         attr_reader :store
@@ -59,16 +63,17 @@ module Ace
           {events: [{type: "attempt_stopped", payload: payload}], blobs: {}}
         end
 
-        # The protected result owner authenticates imported bytes, candidate,
+        # The source-selected result owner authenticates imported bytes, candidate,
         # closure and independent settlements at the same CAS prefix.
-        def self.finished_transition_plan(events:, receipt:)
+        def self.finished_transition_plan(events:, receipt:, authority:)
+          raise ArgumentError, "unknown result authority" unless %i[ordinary protected].include?(authority)
           state = Molecules::CanonicalAttemptState.derive(events)
           unless state == "running" && %w[succeeded failed].include?(receipt.fetch("verdict"))
             raise AttemptErrors::Conflict, "Result finish requires a running attempt"
           end
           Atoms::AttemptStateMachine.transition!(state, receipt.fetch("verdict"))
           {events: [{type: "receipt_accepted", payload: {"receipt" => receipt}},
-            {type: "transition", payload: {"from" => state, "to" => receipt.fetch("verdict"), "reason" => "protected_result_accepted"}}], blobs: {}}
+            {type: "transition", payload: {"from" => state, "to" => receipt.fetch("verdict"), "reason" => "#{authority}_result_accepted"}}], blobs: {}}
         end
 
         def self.protected_recovery_decision(state:, effects_pending:, bound:, live:, checkpoint:)
@@ -113,21 +118,13 @@ module Ace
             raise AttemptErrors::ReceiptRejected, "Native reverse requires an active managed attempt"
           end
           binding = reconciler.recorded_binding(attempt)
-          observation = reconciler.observation(attempt)
-          unless binding && observation["liveness"] == "live" &&
-              binding["process_identity"] == observation["identity"] &&
-              %w[runtime session pane].all? { |key| binding[key].is_a?(String) && !binding[key].empty? }
+          unless binding && %w[runtime session pane].all? { |key| binding[key].is_a?(String) && !binding[key].empty? }
             raise AttemptErrors::ReceiptRejected, "Exact native owner binding is unavailable or changed"
           end
-          unless caller_pid.nil?
-            unless caller_pid.is_a?(Integer) && caller_pid.positive?
-              raise AttemptErrors::UnauthorizedIdentity, "Kernel caller process is unavailable"
-            end
-            caller = Ace::Runtime.resolve(binding["runtime"]).process_binding(pane: binding["pane"], caller_pid: caller_pid)
-            unless caller == binding
-              raise AttemptErrors::UnauthorizedIdentity, "Caller does not descend from the recorded native owner"
-            end
+          unless caller_pid.nil? || (caller_pid.is_a?(Integer) && caller_pid.positive?)
+            raise AttemptErrors::UnauthorizedIdentity, "Kernel caller process is unavailable"
           end
+          observe_runtime_binding!(attempt, binding, caller_pid)
           latest = recover_managed_attempt(attempt.binding.assignment_id, attempt_id)
           unless latest&.active? && latest.binding.to_h == attempt.binding.to_h && reconciler.recorded_binding(latest) == binding
             raise AttemptErrors::ReceiptRejected, "Native owner changed during observation"
@@ -137,6 +134,28 @@ module Ace
           raise AttemptErrors::ReceiptRejected, "Native owner observation unavailable (#{e.class})"
         end
 
+        # An installed consumer selects its own bounded native reader. It must
+        # never fall back to the service process's ambient runtime on failure.
+        def observe_runtime_binding!(attempt, binding, caller_pid)
+          if @recorded_binding_observer
+            actual = @recorded_binding_observer.call(binding: binding, caller_pid: caller_pid)
+            unless actual == binding
+              raise AttemptErrors::UnauthorizedIdentity, "Installed native owner observation differs"
+            end
+            return
+          end
+          observation = reconciler.observation(attempt)
+          unless observation["liveness"] == "live" && binding["process_identity"] == observation["identity"]
+            raise AttemptErrors::ReceiptRejected, "Exact native owner binding is unavailable or changed"
+          end
+          return if caller_pid.nil?
+          caller = Ace::Runtime.resolve(binding["runtime"]).process_binding(pane: binding["pane"], caller_pid: caller_pid)
+          unless caller == binding
+            raise AttemptErrors::UnauthorizedIdentity, "Caller does not descend from the recorded native owner"
+          end
+        end
+        private :observe_runtime_binding!
+
         # Claim an external service effect before dispatch. Only a managed,
         # active attempt for the exact project and candidate may own it. The
         # guard re-runs inside the journal lock per CAS attempt, so a
@@ -174,7 +193,10 @@ module Ace
         end
 
         def service_attempt(binding)
-          attempt = authoritative_attempt(binding)
+          # An effect can never acquire authority from a requester cache, even
+          # when the assignment definition is missing from this consumer.
+          attempt = journal_for.derived_attempts(binding.fetch("assignment_id"))
+            .find { |candidate| candidate.attempt_id == binding.fetch("attempt_id") }
           raise AttemptErrors::NotFound, "Attempt not found" unless attempt
           unless attempt.managed? && attempt.active? &&
               attempt.binding.assignment_id == binding["assignment_id"] &&
@@ -306,28 +328,29 @@ module Ace
           # never need message-string discrimination: replay/binding conflicts
           # stay Conflict, a consumed authorization is AuthorizationConflict.
           guard = lambda do
-            conflict = @journal.fixed_authorization_conflict(record)
+            conflict = journal_for.fixed_authorization_conflict(record)
             if conflict
               raise AttemptErrors::AuthorizationConflict,
                 "Authorization reference is not currently valid"
             end
             nil
           end
-          @journal.admit_fixed_merge_request(record, guard: guard)
+          journal_for.admit_fixed_merge_request(record, guard: guard)
         end
 
         # Begin the fixed effect (pending -> uncertain). The single CAS
         # transition is the at-most-one-merge proof: a restarted receiver
-        # replays "already started" and must not dispatch again.
+        # refuses an already-started claim and must not dispatch again.
         def begin_fixed_merge_effect(request_id)
-          @journal.begin_fixed_merge_request(request_id)
+          journal_for.begin_fixed_merge_request(request_id)
         end
 
         # Settle the fixed effect with the exact terminal receipt. The
         # journal validates the closed receipt schema and its binding to the
         # admitted record before the transition lands.
-        def settle_fixed_merge_effect(request_id, terminal_status:, receipt:)
-          @journal.settle_fixed_merge_request(request_id, terminal_status: terminal_status, receipt: receipt)
+        def settle_fixed_merge_effect(request_id, terminal_status:, receipt:, attestation: nil)
+          journal_for.settle_fixed_merge_request(request_id, terminal_status: terminal_status,
+            receipt: receipt, attestation: attestation)
         end
 
         # Read-only canonical record lookup by request ID: lets the producer
@@ -337,6 +360,13 @@ module Ace
           journal_for.fixed_merge_request(request_id)
         end
 
+        # Read-only listing of every canonical fixed merge record: lets the
+        # receiver restart reconciliation find its own still-pending records
+        # by binding. Read-only; performs no dispatch and owns no state.
+        def fixed_merge_records
+          journal_for.fixed_merge_request_records
+        end
+
         # Read-only status: resolve the opaque reference against the
         # canonical record and verify every selector. Performs no dispatch,
         # retry, authorization refresh or selector repair. Returns the
@@ -345,7 +375,7 @@ module Ace
         # without revealing whether another project holds the reference.
         def fixed_merge_status(reference:, request_id:, project_id:, assignment_id:, attempt_id:,
           queue_entry:, input_digest:)
-          record = @journal.fixed_merge_request(request_id)
+          record = journal_for.fixed_merge_request(request_id)
           return nil unless record
           matches = reference == record["reference"] && input_digest == record["input_digest"] &&
             [project_id, assignment_id, attempt_id, queue_entry].zip(
@@ -596,7 +626,7 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
 
               active_scopes = @store.list(assignment_id).select(&:active?).map(&:binding)
               active_scopes.concat(journal_actives.map(&:binding))
-              blocker = active_scopes.find { |binding| scopes_overlap?(binding.scope, scope) }
+              blocker = active_scopes.find { |binding| Atoms::AssignmentScope.overlap?(binding.scope, scope) }
               if blocker
                 raise AttemptErrors::Conflict,
                   "Active attempt scope #{blocker.scope} overlaps requested scope #{scope} on #{assignment_id}; " \
@@ -835,9 +865,9 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
           unless %w[check review-collection review-approval].include?(kind) && check_name.is_a?(String) && !check_name.strip.empty?
             raise AttemptErrors::ReceiptRejected, "Invalid evidence kind or check name"
           end
-          if !historical_head.nil? && (!%w[review-collection review-approval].include?(kind) || !historical_head.is_a?(String) ||
+          if !historical_head.nil? && (!historical_head.is_a?(String) ||
               !historical_head.match?(/\A[0-9a-f]{40,64}\z/))
-            raise AttemptErrors::ReceiptRejected, "Historical evidence requires review collection/approval and an exact recorded head"
+            raise AttemptErrors::ReceiptRejected, "Historical evidence requires an exact recorded head"
           end
           unless attempt_id.to_s.match?(/\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/) &&
               receipt_digest.to_s.match?(/\A[0-9a-f]{64}\z/)
@@ -987,14 +1017,6 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
           raise Error, "Failed to generate a unique attempt ID for #{assignment_id} after 100 attempts"
         end
 
-        # Ancestors and descendants overlap: an active attempt for 010 owns
-        # its 010.01 subtree, and vice versa.
-        def scopes_overlap?(left, right)
-          return true if Atoms::AssignmentScope.equal?(left, right)
-
-          left.start_with?("#{right}.") || right.start_with?("#{left}.")
-        end
-
         # Active attempts derived from the authoritative journal, used when
         # the local record may be missing (lost or wiped cache). Derivation
         # lives in the journal (owner of attempt-state interpretation).
@@ -1052,7 +1074,7 @@ input:#{Regexp.escape(request.fetch("input_digest"))} outcome:(\S+)( no-effect:(
         # merges both). The loser records a stopped transition and refuses.
         def yield_lost_ownership_race(attempt, assignment_id, scope)
           rival = journal_for.active_attempts(assignment_id).find do |other|
-            other.attempt_id != attempt.attempt_id && scopes_overlap?(other.binding.scope, scope)
+            other.attempt_id != attempt.attempt_id && Atoms::AssignmentScope.overlap?(other.binding.scope, scope)
           end
           return attempt if rival.nil?
 

data/lib/ace/assign/organisms/ordinary_merge_consumer.rb

@@ -212,7 +212,7 @@ module Ace
             return {state: "accepted", reference: ack.fetch("reference"),
                     request_id: ack.fetch("request_id"), input_digest: ack.fetch("input_digest")}
           end
-          handle_refusal(binding, identity, branch[:payload], expected_digest: digest)
+          handle_refusal(binding, identity, branch[:payload], expected_digest: digest, request_id: selectors.fetch(:request_id))
         end
 
         # Closed outer envelope for admission responses: exactly {status,
@@ -241,7 +241,7 @@ module Ace
           end
         end
 
-        def handle_refusal(binding, identity, error, expected_digest:)
+        def handle_refusal(binding, identity, error, expected_digest:, request_id:)
           refusal = begin
             Molecules::OrdinaryMergeContract.validate_refusal!(error)
           rescue ArgumentError
@@ -249,9 +249,9 @@ module Ace
               "ordinary merge refusal is not the maintained contract; admission stays unconfirmed"
           end
           echo = refusal.fetch("input_digest")
-          if echo && echo != expected_digest
+          if refusal.fetch("request_id") != request_id || (echo && echo != expected_digest)
             raise AttemptErrors::EvidenceUnavailable,
-              "ordinary merge refusal echoes a different input digest; admission stays unconfirmed"
+              "ordinary merge refusal echoes a different request; admission stays unconfirmed"
           end
           if refusal.fetch("code") == Molecules::OrdinaryMergeContract::UNAVAILABLE_CODE
             raise AttemptErrors::EvidenceUnavailable,
@@ -259,7 +259,7 @@ module Ace
           end
           record_event(binding, identity, {"stage" => RESULT_STAGE, "outcome" => "refused_no_effect",
             "code" => refusal.fetch("code"), "message" => refusal.fetch("message"),
-            "request_id" => refusal.fetch("request_id"), "input_digest" => refusal.fetch("input_digest")})
+            "request_id" => request_id, "input_digest" => expected_digest})
           {state: "refused", code: refusal.fetch("code"), message: refusal.fetch("message")}
         end
 

data/lib/ace/assign/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Assign
-    VERSION = "0.68.0"
+    VERSION = "0.70.0"
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-assign
 version: !ruby/object:Gem::Version
-  version: 0.68.0
+  version: 0.70.0
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-14 00:00:00.000000000 Z
+date: 2026-10-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-llm-providers-cli
@@ -175,42 +175,42 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.60.1
+        version: 0.60.3
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.60.1
+        version: 0.60.3
 - !ruby/object:Gem::Dependency
   name: ace-task
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.37'
+        version: '0.40'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.37'
+        version: '0.40'
 - !ruby/object:Gem::Dependency
   name: ace-bundle
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.45'
+        version: 0.45.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.45'
+        version: 0.45.1
 - !ruby/object:Gem::Dependency
   name: ace-runtime
   requirement: !ruby/object:Gem::Requirement
@@ -245,14 +245,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.1
+        version: '0.6'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.5.1
+        version: '0.6'
 - !ruby/object:Gem::Dependency
   name: ace-support-test-helpers
   requirement: !ruby/object:Gem::Requirement
@@ -418,6 +418,7 @@ files:
 - lib/ace/assign/atoms/step_numbering.rb
 - lib/ace/assign/atoms/step_sorter.rb
 - lib/ace/assign/atoms/tree_formatter.rb
+- lib/ace/assign/authority/assignment_definition.rb
 - lib/ace/assign/authority/assignment_inventory.rb
 - lib/ace/assign/authority/campaign_consumer_policy.rb
 - lib/ace/assign/authority/campaign_execution.rb
@@ -460,6 +461,16 @@ files:
 - lib/ace/assign/authority/launch_steering.rb
 - lib/ace/assign/authority/launch_stop.rb
 - lib/ace/assign/authority/maintenance_workspace_retirement.rb
+- lib/ace/assign/authority/ordinary_attempt_start.rb
+- lib/ace/assign/authority/ordinary_client.rb
+- lib/ace/assign/authority/ordinary_completion.rb
+- lib/ace/assign/authority/ordinary_effect_settlement.rb
+- lib/ace/assign/authority/ordinary_lifecycle.rb
+- lib/ace/assign/authority/ordinary_peer.rb
+- lib/ace/assign/authority/ordinary_progress.rb
+- lib/ace/assign/authority/ordinary_queue.rb
+- lib/ace/assign/authority/ordinary_results.rb
+- lib/ace/assign/authority/ordinary_server.rb
 - lib/ace/assign/authority/original_inbox_selection.rb
 - lib/ace/assign/authority/posix_acl.rb
 - lib/ace/assign/authority/prepared_input.rb
@@ -478,6 +489,7 @@ files:
 - lib/ace/assign/authority/service_delivery_evidence.rb
 - lib/ace/assign/authority/service_evidence.rb
 - lib/ace/assign/authority/service_publication_evidence.rb
+- lib/ace/assign/authority/socket_server.rb
 - lib/ace/assign/authority/task_context_entry.rb
 - lib/ace/assign/authority/transfer_codec.rb
 - lib/ace/assign/cli.rb
@@ -533,6 +545,7 @@ files:
 - lib/ace/assign/molecules/attempt_store.rb
 - lib/ace/assign/molecules/canonical_attempt_state.rb
 - lib/ace/assign/molecules/canonical_evidence.rb
+- lib/ace/assign/molecules/canonical_read_commands.rb
 - lib/ace/assign/molecules/canonical_read_snapshot.rb
 - lib/ace/assign/molecules/evidence_calculator.rb
 - lib/ace/assign/molecules/evidence_journal.rb
@@ -540,6 +553,7 @@ files:
 - lib/ace/assign/molecules/execution_scope_lineage.rb
 - lib/ace/assign/molecules/fixed_effect_reference.rb
 - lib/ace/assign/molecules/fork_session_launcher.rb
+- lib/ace/assign/molecules/installed_journal_read.rb
 - lib/ace/assign/molecules/journal_input_inhibition.rb
 - lib/ace/assign/molecules/journal_mutation.rb
 - lib/ace/assign/molecules/journal_prompt_mutation.rb