ace-coworker 0.6.1 → 0.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6901776c6bcef11b2bfb48ddaeb2377dd830f352d01c79bddc59254a4f799849
-  data.tar.gz: 604583cbbb6eab225faccd01025cc5efdce6cad789bc7faca87091713cdf7a7b
+  metadata.gz: 7420999db530cb82bcb5ec29ec372684ec0f60561b84c230a8e5bb3ac0200843
+  data.tar.gz: 7acd12950816f9ec0d9f034ff7f68e7667c5c9eeac94989f8dbd4238a7290c6c
 SHA512:
-  metadata.gz: be41301547584600fba77e414d603bed84caa025bdae72601644bbbd6b62569167ed72cb20da61ecb45c8c6deeefcb5367beb11f5914f1e3471f2180d847bea6
-  data.tar.gz: 8e29e8818c437ae80ffd3de61976dafe166db7c215d47003176e3e5ae43ea995d4db969aa8e7168be44c8207db3a93a41e1052760d9b6be6f6a49eed184dbfa4
+  metadata.gz: b602e3377b4396d3e990fdfb5c3f79cb42b0b82522460039199866afee03e59dfd4cbb41d4069e4a128bfe88aec7b78648985c48ef561095d912f97d77452378
+  data.tar.gz: f3aa2e8c21ee006eb2b83326c33deb24f94a39318b509c264dba26ed3520c636981c8ad9e0df5198ef643db51d201d2ac10f4358cabc6432d1fde62d17281da2

data/CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.6.2] - 2026-10-23
+
+### Added
+
+- Formal reviewer-owned, exact-head provider approval and read-only approval verification through the forge-neutral review flow; comments do not substitute for approval.
+
+
 ## [0.6.1] - 2026-10-20
 
 ### Fixed

data/docs/usage.md

@@ -562,3 +562,14 @@ would-be outcome.
 - Reporting via `ace-hitl` and resume-after-interruption ship with
   `ace-coworker` 0.4.0+; role presets resolve their `wfi://` instruction
   sources through `ace-nav` (runtime dependency since 0.5.0).
+
+
+For commissioned PR work the reviewer publishes formal approval only after the
+accepted review-round verdict and executed tests, using `ace-git pr approve`.
+Its receipt stays with the existing report. The integrator verifies that receipt
+against read-only `ace-git pr approval` and the current candidate before the
+existing integration gate. A comment, local verdict or draft-ready transition
+does not substitute for provider approval. Accounts and credentials come from
+deployment, independently of the role preset; no identity switching or token
+borrowing is performed by coworker. Missing permission or uncertain publication
+blocks successful integration handoff.

data/handbook/workflow-instructions/coworker/integrator.wf.md

@@ -93,7 +93,21 @@ the exact candidate head. Otherwise WITHHOLD the merge and report/escalate.
      invalidates the review: the gate reports a stale review even when the
      verdict says accept.
 
-4. **Merge only a ready candidate.**
+4. **Consume formal approval, then merge only a ready candidate.**
+   - For PR integration, read the reviewer's receipt from the existing report
+     and verify current provider evidence without minting another approval:
+     `ace-git pr approval PR --expected-head SHA --review-id REVIEW_ID
+     --server SERVER --format json` (or the retained `--default-server`). Here
+     REVIEW_ID is the numeric provider review ID, not the publication correlation.
+   - Require effective `approved` evidence and compare repository, PR, full head,
+     reviewer identity, correlation and evidence SHA256 with the accepted
+     reviewer report/receipt. The authenticated reviewer must differ from the
+     PR author. A stale/dismissed/nonofficial review, comment, unavailable
+     evidence or missing account permissions withholds integration. Return to
+     the reviewer/overseer; do not issue approval on the reviewer's behalf,
+     copy their token or bypass branch protection. This read does not replace
+     the dependency/test/current-head gate or authorize a merge by itself.
+
    - Verdict `ready`: perform the project-defined integration with the
      existing tools (`git` / `ace-git`, scoped to the commissioned paths;
      never force-push; fetch first and resolve conflicts explicitly).

data/handbook/workflow-instructions/coworker/reviewer.wf.md

@@ -162,7 +162,27 @@ product decision is escalated to the overseer instead.
      outcome from the ace-assign verdict and refuses a forced success on an
      incomplete assignment - the tool floor, not a courtesy.
 
-8. **Record and hand off.**
+8. **Publish formal approval, then hand off.**
+   - For a commissioned PR review, only AFTER the review-round verdict is
+     `accept`, required executed tests pass, and the accepted report binds the
+     current full head, publish through the configured reviewer account:
+     `ace-git pr approve PR --expected-head SHA --body-file REVIEW_REPORT
+     --correlation REVIEW_ID --server SERVER --format json` (or the retained
+     `--default-server` selection). Keep the report and returned receipt in the
+     existing task/review/assignment artifacts. Use one stable REVIEW_ID for
+     this repository/PR publication; changed report/head needs a new publication.
+   - A comment, local acceptance or `pr ready` is not formal approval. Confirm
+     the receipt's exact repo/PR/head/reviewer/evidence digest and effective
+     approval. Missing permission, unsupported capability or unknown outcome
+     blocks successful integration handoff; report the concrete cause via the
+     existing HITL/report path. Resume by reconciling the same publication,
+     never blindly repeating a POST or switching credentials.
+   - Reviewer purpose and provider permissions are independent: deployment
+     selects the OS/provider identity. Never borrow worker/admin credentials;
+     the PR author cannot approve their own PR. Local-only reviews have no
+     remote approval to publish and must not claim one.
+
+8a. **Record and hand off.**
    - `ace-coworker report` writes the durable record
      (`<task>/coworker/<assignment>.md`) and delivers the HITL report.
    - The final report names: the exact candidate head, executed checks,
@@ -209,3 +229,12 @@ and reported. Anything less is an error outcome with the cause named.
   `.ace-local/review/` to ace-review, `.ace-local/hitl/` to ace-hitl.
 - Inside the ACE repository itself, invoke every tool as `bin/ace-*` (the
   binstubs pin the checkout's bundle).
+
+
+Deployment must provide a dedicated automation reviewer identity and one writer
+per actor/repository/PR before formal publication. Missing evidence of that
+mapping/ownership blocks live use; a role name grants no account permission.
+Do not share that identity with manual clients or another host writer. Preserve
+and report unrelated pending reviews/comments instead of publishing over them.
+Resume only when the provider's path preserves the accepted commit/content;
+unsafe or unsupported pending recovery remains blocked with retained evidence.

data/lib/ace/coworker/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Coworker
-    VERSION = "0.6.1"
+    VERSION = "0.6.2"
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-coworker
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 0.6.2
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-20 00:00:00.000000000 Z
+date: 2026-10-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-support-cli
@@ -159,14 +159,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.62'
+        version: 0.62.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.62'
+        version: 0.62.2
 - !ruby/object:Gem::Dependency
   name: ace-support-test-helpers
   requirement: !ruby/object:Gem::Requirement