ace-coworker 0.6.0 → 0.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 288508c14f62358d53a0fe59f3a772ea024fa370201285151439e5ab93de88ff
-  data.tar.gz: 84e997a0876ad657f0caf39502c65e4d553110306f8b9fd63d83e6c7e5623fc8
+  metadata.gz: 7420999db530cb82bcb5ec29ec372684ec0f60561b84c230a8e5bb3ac0200843
+  data.tar.gz: 7acd12950816f9ec0d9f034ff7f68e7667c5c9eeac94989f8dbd4238a7290c6c
 SHA512:
-  metadata.gz: f73a2ccd21437dc1f44525ada59476246c7668abc4f9bfa26ca8356b8505447fd7bfc498a28baa8ad1ced52109f10b3871e53641e85cab4c249f1d0c8ed633b4
-  data.tar.gz: 4756deff6b2f919b3dfd307e17354605e4e5e5e4449a1a562f014d03045e26f083280efcb69598d49375c114775875a7f3d74e11c233721beabab78cac8a6642
+  metadata.gz: b602e3377b4396d3e990fdfb5c3f79cb42b0b82522460039199866afee03e59dfd4cbb41d4069e4a128bfe88aec7b78648985c48ef561095d912f97d77452378
+  data.tar.gz: f3aa2e8c21ee006eb2b83326c33deb24f94a39318b509c264dba26ed3520c636981c8ad9e0df5198ef643db51d201d2ac10f4358cabc6432d1fde62d17281da2

data/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.2] - 2026-10-23
+
+### Added
+
+- Formal reviewer-owned, exact-head provider approval and read-only approval verification through the forge-neutral review flow; comments do not substitute for approval.
+
+
+## [0.6.1] - 2026-10-20
+
+### Fixed
+- Honor `ACE_TOOLCHAIN=installed` for published-gem execution and context propagation without source-runtime fallback; retain default auto development behavior.
+
 
 ## [0.6.0] - 2026-10-20
 

data/docs/usage.md

@@ -562,3 +562,14 @@ would-be outcome.
 - Reporting via `ace-hitl` and resume-after-interruption ship with
   `ace-coworker` 0.4.0+; role presets resolve their `wfi://` instruction
   sources through `ace-nav` (runtime dependency since 0.5.0).
+
+
+For commissioned PR work the reviewer publishes formal approval only after the
+accepted review-round verdict and executed tests, using `ace-git pr approve`.
+Its receipt stays with the existing report. The integrator verifies that receipt
+against read-only `ace-git pr approval` and the current candidate before the
+existing integration gate. A comment, local verdict or draft-ready transition
+does not substitute for provider approval. Accounts and credentials come from
+deployment, independently of the role preset; no identity switching or token
+borrowing is performed by coworker. Missing permission or uncertain publication
+blocks successful integration handoff.

data/handbook/workflow-instructions/coworker/integrator.wf.md

@@ -93,7 +93,21 @@ the exact candidate head. Otherwise WITHHOLD the merge and report/escalate.
      invalidates the review: the gate reports a stale review even when the
      verdict says accept.
 
-4. **Merge only a ready candidate.**
+4. **Consume formal approval, then merge only a ready candidate.**
+   - For PR integration, read the reviewer's receipt from the existing report
+     and verify current provider evidence without minting another approval:
+     `ace-git pr approval PR --expected-head SHA --review-id REVIEW_ID
+     --server SERVER --format json` (or the retained `--default-server`). Here
+     REVIEW_ID is the numeric provider review ID, not the publication correlation.
+   - Require effective `approved` evidence and compare repository, PR, full head,
+     reviewer identity, correlation and evidence SHA256 with the accepted
+     reviewer report/receipt. The authenticated reviewer must differ from the
+     PR author. A stale/dismissed/nonofficial review, comment, unavailable
+     evidence or missing account permissions withholds integration. Return to
+     the reviewer/overseer; do not issue approval on the reviewer's behalf,
+     copy their token or bypass branch protection. This read does not replace
+     the dependency/test/current-head gate or authorize a merge by itself.
+
    - Verdict `ready`: perform the project-defined integration with the
      existing tools (`git` / `ace-git`, scoped to the commissioned paths;
      never force-push; fetch first and resolve conflicts explicitly).

data/handbook/workflow-instructions/coworker/reviewer.wf.md

@@ -162,7 +162,27 @@ product decision is escalated to the overseer instead.
      outcome from the ace-assign verdict and refuses a forced success on an
      incomplete assignment - the tool floor, not a courtesy.
 
-8. **Record and hand off.**
+8. **Publish formal approval, then hand off.**
+   - For a commissioned PR review, only AFTER the review-round verdict is
+     `accept`, required executed tests pass, and the accepted report binds the
+     current full head, publish through the configured reviewer account:
+     `ace-git pr approve PR --expected-head SHA --body-file REVIEW_REPORT
+     --correlation REVIEW_ID --server SERVER --format json` (or the retained
+     `--default-server` selection). Keep the report and returned receipt in the
+     existing task/review/assignment artifacts. Use one stable REVIEW_ID for
+     this repository/PR publication; changed report/head needs a new publication.
+   - A comment, local acceptance or `pr ready` is not formal approval. Confirm
+     the receipt's exact repo/PR/head/reviewer/evidence digest and effective
+     approval. Missing permission, unsupported capability or unknown outcome
+     blocks successful integration handoff; report the concrete cause via the
+     existing HITL/report path. Resume by reconciling the same publication,
+     never blindly repeating a POST or switching credentials.
+   - Reviewer purpose and provider permissions are independent: deployment
+     selects the OS/provider identity. Never borrow worker/admin credentials;
+     the PR author cannot approve their own PR. Local-only reviews have no
+     remote approval to publish and must not claim one.
+
+8a. **Record and hand off.**
    - `ace-coworker report` writes the durable record
      (`<task>/coworker/<assignment>.md`) and delivers the HITL report.
    - The final report names: the exact candidate head, executed checks,
@@ -209,3 +229,12 @@ and reported. Anything less is an error outcome with the cause named.
   `.ace-local/review/` to ace-review, `.ace-local/hitl/` to ace-hitl.
 - Inside the ACE repository itself, invoke every tool as `bin/ace-*` (the
   binstubs pin the checkout's bundle).
+
+
+Deployment must provide a dedicated automation reviewer identity and one writer
+per actor/repository/PR before formal publication. Missing evidence of that
+mapping/ownership blocks live use; a role name grants no account permission.
+Do not share that identity with manual clients or another host writer. Preserve
+and report unrelated pending reviews/comments instead of publishing over them.
+Resume only when the provider's path preserves the accepted commit/content;
+unsafe or unsupported pending recovery remains blocked with retained evidence.

data/lib/ace/coworker/atoms/brief_formatter.rb

@@ -9,6 +9,11 @@ module Ace
           h = brief.to_h
           lines = []
           lines << "Coworker brief"
+          lines << "  toolchain:         #{h.dig('toolchain', 'mode')}"
+          if h.dig("toolchain", "mode") == "installed"
+            lines << "  runtime rule:      keep ACE_TOOLCHAIN=installed; use installed ACE commands and packaged generic instructions, never project binstubs or bundle exec"
+            lines << "  project context:   retain domain instructions/tasks/config; source-development launch advice does not select this runtime"
+          end
           lines << "  role:              #{h['role']}"
           lines << "  instructions:      #{h['instructions']}"
           lines << "  instructions src:  #{h['instructions_source']}"

data/lib/ace/coworker/atoms/config_schema.rb

@@ -27,6 +27,9 @@ module Ace
             end
           end
 
+          if raw.key?("toolchain") && !%w[auto installed].include?(raw["toolchain"])
+            errors << "toolchain must be auto or installed"
+          end
           errors.concat(prompt_errors(raw))
           errors.concat(nested_mapping_errors(raw, "reporting"))
           errors.concat(nested_mapping_errors(raw, "errors"))
@@ -41,6 +44,7 @@ module Ace
         #   by the loader (IO does not belong in this pure atom).
         def self.normalize(raw)
           {
+            "toolchain" => raw["toolchain"],
             "role" => str(raw["role"]),
             "instructions" => str(raw["instructions"]),
             "start_prompt" => str(raw["start_prompt"]),
@@ -50,7 +54,7 @@ module Ace
             "overseer" => str(raw["overseer"]),
             "reporting" => {"channel" => nested_str(raw, "reporting", "channel").empty? ? "hitl" : nested_str(raw, "reporting", "channel")},
             "errors" => {"on_failure" => nested_str(raw, "errors", "on_failure").empty? ? "report" : nested_str(raw, "errors", "on_failure")}
-          }
+          }.compact
         end
 
         # Protocol instructions reference an external resource; plain paths

data/lib/ace/coworker/models/brief.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "ace/support/cli/toolchain"
+
 module Ace
   module Coworker
     module Models
@@ -17,6 +19,7 @@ module Ace
 
         def to_h
           {
+            "toolchain" => Ace::Support::Cli::Toolchain.evidence,
             "role" => config.role,
             "instructions" => config.instructions,
             "instructions_source" => instructions_source,

data/lib/ace/coworker/models/config.rb

@@ -6,10 +6,11 @@ module Ace
       # Immutable validated coworker run configuration.
       class Config
         attr_reader :role, :instructions, :start_prompt, :start_prompt_file, :task, :assignment,
-          :overseer, :reporting_channel, :on_failure, :source_path
+          :overseer, :reporting_channel, :on_failure, :source_path, :toolchain
 
         def initialize(role:, instructions:, start_prompt:, task:, assignment:, overseer:,
-          start_prompt_file: nil, reporting_channel: "hitl", on_failure: "report", source_path: nil)
+          start_prompt_file: nil, reporting_channel: "hitl", on_failure: "report", source_path: nil, toolchain: nil)
+          @toolchain = toolchain&.freeze
           @role = role.freeze
           @instructions = instructions.freeze
           @start_prompt = start_prompt.freeze
@@ -32,11 +33,12 @@ module Ace
             start_prompt: start_prompt, start_prompt_file: start_prompt_file,
             task: task, assignment: assignment, overseer: overseer,
             reporting_channel: reporting_channel, on_failure: on_failure,
-            source_path: source_path)
+            source_path: source_path, toolchain: toolchain)
         end
 
         def to_h
           {
+            "toolchain" => toolchain,
             "role" => role,
             "instructions" => instructions,
             "start_prompt" => start_prompt,

data/lib/ace/coworker/molecules/assignment_probe.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "ace/support/cli/toolchain"
+
 require "open3"
 require "json"
 
@@ -9,7 +11,7 @@ module Ace
       # Probes assignment truth via `ace-assign status --assignment <id> --format json`
       # with an injectable runner (ADR-031: argv array + explicit cwd).
       class AssignmentProbe
-        DEFAULT_RUNNER = ->(argv, cwd) { Open3.capture3(*argv, chdir: cwd) }
+        DEFAULT_RUNNER = ->(argv, cwd) { Open3.capture3(Ace::Support::Cli::Toolchain.child_environment, *argv, chdir: cwd) }
 
         def initialize(project_root:, runner: DEFAULT_RUNNER)
           @project_root = project_root
@@ -48,6 +50,8 @@ module Ace
         # Prefer the repo binstub when present (agent shells do not activate
         # mise, so bare ace-* may resolve to stale installed gems).
         def assign_binary
+          return Ace::Support::Cli::Toolchain.executable("ace-assign") if Ace::Support::Cli::Toolchain.installed?
+
           binstub = File.join(@project_root, "bin", "ace-assign")
           File.executable?(binstub) ? binstub : "ace-assign"
         end

data/lib/ace/coworker/molecules/config_loader.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "ace/support/cli/toolchain"
+
 require "yaml"
 
 module Ace
@@ -46,6 +48,10 @@ module Ace
             raise Error, "invalid config #{relativize(target)}: #{errors.join('; ')}"
           end
 
+          if raw["toolchain"] == "installed" && !Ace::Support::Cli::Toolchain.installed?
+            raise Error, "this coworker run requires ACE_TOOLCHAIN=installed; restart through the installed executable"
+          end
+          Ace::Support::Cli::Toolchain.verify_loaded! if raw["toolchain"] == "installed"
           build_config(Atoms::ConfigSchema.normalize(raw), target)
         end
 
@@ -86,7 +92,7 @@ module Ace
             overseer: normalized["overseer"],
             reporting_channel: normalized.dig("reporting", "channel"),
             on_failure: normalized.dig("errors", "on_failure"),
-            source_path: target
+            source_path: target, toolchain: normalized["toolchain"]
           )
         end
 

data/lib/ace/coworker/molecules/hitl_reporter.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "ace/support/cli/toolchain"
+
 require "open3"
 
 module Ace
@@ -9,7 +11,7 @@ module Ace
       # argv contract, ADR-031; injectable runner). ace-hitl owns its files;
       # this molecule never writes HITL state directly.
       class HitlReporter
-        DEFAULT_RUNNER = ->(argv, cwd) { Open3.capture3(*argv, chdir: cwd) }
+        DEFAULT_RUNNER = ->(argv, cwd) { Open3.capture3(Ace::Support::Cli::Toolchain.child_environment, *argv, chdir: cwd) }
 
         Failure = Struct.new(:stage, :message, keyword_init: true)
 
@@ -118,6 +120,8 @@ module Ace
         # Prefer the repo binstub when present (agent shells do not activate
         # mise, so bare ace-* may resolve to stale installed gems).
         def hitl_binary
+          return Ace::Support::Cli::Toolchain.executable("ace-hitl") if Ace::Support::Cli::Toolchain.installed?
+
           binstub = File.join(@project_root, "bin", "ace-hitl")
           File.executable?(binstub) ? binstub : "ace-hitl"
         end

data/lib/ace/coworker/molecules/instruction_resolver.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "ace/support/cli/toolchain"
+
 require "open3"
 
 module Ace
@@ -9,7 +11,7 @@ module Ace
       # project root, or a protocol URI (wfi://, prompt:// tmpl://) resolved
       # through ace-nav.
       class InstructionResolver
-        DEFAULT_NAV_RUNNER = ->(argv, cwd) { Open3.capture3(*argv, chdir: cwd) }
+        DEFAULT_NAV_RUNNER = ->(argv, cwd) { Open3.capture3(Ace::Support::Cli::Toolchain.child_environment, *argv, chdir: cwd) }
 
         # The ace-nav CLI itself is missing (ENOENT on exec): the resolver
         # never ran, so no verdict exists. Prepare treats this distinctly
@@ -72,6 +74,8 @@ module Ace
         # executes the repository-controlled binstub — PATH only
         # (trust-posture parity with ace-lab Verify#nav_binary).
         def nav_binary
+          return Ace::Support::Cli::Toolchain.executable("ace-nav") if Ace::Support::Cli::Toolchain.installed?
+
           binstub = File.join(@project_root, "bin", "ace-nav")
           use_binstub = !Process.uid.zero? && File.executable?(binstub)
           use_binstub ? binstub : "ace-nav"

data/lib/ace/coworker/molecules/worktree_executor_probe.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "ace/support/cli/toolchain"
+
 require "open3"
 require "json"
 require "yaml"
@@ -16,7 +18,7 @@ module Ace
       # `ace-assign list --all --format json` (subprocess argv contract
       # with explicit cwd, ADR-031).
       class WorktreeExecutorProbe
-        DEFAULT_RUNNER = ->(argv, cwd) { Open3.capture3(*argv, chdir: cwd) }
+        DEFAULT_RUNNER = ->(argv, cwd) { Open3.capture3(Ace::Support::Cli::Toolchain.child_environment, *argv, chdir: cwd) }
         # Coworker config cascade files that may carry a `config_path`
         # override for the probed worktree (project `.ace` and user tiers;
         # the gem-defaults tier equals the loader's built-in default).
@@ -130,6 +132,8 @@ module Ace
         # mise, so bare ace-* may resolve to stale installed gems); the
         # subprocess still runs with cwd = the probed worktree.
         def assign_binary
+          return Ace::Support::Cli::Toolchain.executable("ace-assign") if Ace::Support::Cli::Toolchain.installed?
+
           binstub = File.join(@project_root, "bin", "ace-assign")
           File.executable?(binstub) ? binstub : "ace-assign"
         end

data/lib/ace/coworker/organisms/commission_orchestrator.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "ace/support/cli/toolchain"
+
 require "fileutils"
 require "tmpdir"
 
@@ -103,6 +105,7 @@ module Ace
             "assignment" => assignment,
             "overseer" => overseer
           }
+          config["toolchain"] = "installed" if Ace::Support::Cli::Toolchain.installed?
           config["reporting"] = {"channel" => preset["reporting"]} unless preset["reporting"].to_s.empty?
           config["errors"] = {"on_failure" => preset["errors"]} unless preset["errors"].to_s.empty?
           config

data/lib/ace/coworker/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Coworker
-    VERSION = "0.6.0"
+    VERSION = "0.6.2"
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-coworker
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.6.2
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-20 00:00:00.000000000 Z
+date: 2026-10-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-support-cli
@@ -16,6 +16,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.6'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.6.10
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -23,6 +26,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.6'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.6.10
 - !ruby/object:Gem::Dependency
   name: ace-support-core
   requirement: !ruby/object:Gem::Requirement
@@ -72,6 +78,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.28'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.28.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -79,6 +88,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.28'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.28.8
 - !ruby/object:Gem::Dependency
   name: ace-task
   requirement: !ruby/object:Gem::Requirement
@@ -100,6 +112,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.72'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.73.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -107,6 +122,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.72'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.73.1
 - !ruby/object:Gem::Dependency
   name: ace-hitl
   requirement: !ruby/object:Gem::Requirement
@@ -141,14 +159,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.62'
+        version: 0.62.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.62'
+        version: 0.62.2
 - !ruby/object:Gem::Dependency
   name: ace-support-test-helpers
   requirement: !ruby/object:Gem::Requirement