ace-git 0.28.1 → 0.30.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a04e2b991b72c03f9af0851e5711166bcec92951a56854e43b6e5626899e187f
-  data.tar.gz: cc1f74fa8cbce7147362c5061f34aeec2e175d99ca9d81476edc14e2be786892
+  metadata.gz: ecccf931f808308fde6ab00654e43fdcbe7b90e0f0c929ade43a25a427302756
+  data.tar.gz: 03af540433b453863a3d399a67565724c68288c0a4a2b283462f613293a4a6a0
 SHA512:
-  metadata.gz: f3786c335ec374eec39be2e754c1525882dacbaf0ca88f22d42419f15c2284cd45ff3d1f5fd4f59e9dc86597451aeb967a85c6d4f0aede71009253ab42eb82b8
-  data.tar.gz: b49568593c0725d5df0c726b3ecfef68cba8c9e0a57fd7fdd9d29cbec8c27132e331192d407efe507b2d5c04abf793a71bf81d43945d67401b958375906202d3
+  metadata.gz: c999f3855347dda4bfac0ce490ec94666f1e9e2cf00b2907d0ad72fa5c083e00495e0f4296036770d106bb1decddca02a37b495e71d87552344899a4321cba08
+  data.tar.gz: 0decf0ad84220579f16b3606d9c6ee3d6193e0a4dfbee22474cd4ee8008b5a75c6fc4bfc9f77bb8d27ae14fbdf65a3c95c957644ac318e08caffe03f7d0e768c

data/CHANGELOG.md

@@ -7,6 +7,39 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.30.0] - 2026-10-08
+
+### Added
+
+- Execute protected draft create/update, ready and merge through named forge providers, binding exact repository provenance, candidate SHA, input and current campaign acceptance.
+
+### Fixed
+
+- Resolve receiver provider identity from the authenticated PR URL and preserve uncertain effects without replay.
+
+- Verify protected request, status and delivery refuse actual authority endpoint loss without replacing the original claim or dispatching another effect.
+
+- Restore process-wide provider registrations and loader state after registry test fixtures, preserving real adapter tests across randomized single-batch execution.
+
+- Resolve receiver-side merge provider identity from the authenticated PR URL when the prepared candidate has no remote, refusing mismatched or changed pinned servers.
+
+- Route protected delivery through original worker merge request, canonical status and exact result consumption while preserving ordinary delivery and unresolved protected PR policy.
+
+
+### Added
+
+- Fixed receiver-side `service merge` validates the claimed candidate/input, uses the selected neutral provider once, and publishes bounded evidence only for a verified exact-head merged outcome.
+
+## [0.29.0] - 2026-10-05
+
+### Removed
+
+- Remove the obsolete GitHub PR workflow and skill sources; canonical PR creation/update use only `git/pr` and `as-git-pr-*`, with no forwarding aliases.
+
+### Added
+
+- PR lifecycle selection can use an explicit repository and pinned forge identity; exact create reconciliation is read-only. Neutral PR workflow and skill sources are prepared for coordinated canonical adoption.
+
 ## [0.28.1] - 2026-10-04
 
 ### Technical

data/README.md

@@ -32,7 +32,7 @@
 
 **Rebase with changelog-safe workflow guardrails** - use the `as-git-rebase` agent workflow to run structured rebase flows that preserve package release metadata and reduce manual conflict-prone steps.
 
-**Prepare clean review history before publishing** - run the `as-git-reorganize-commits` workflow to reorganize commit stacks, then use `as-github-pr-create` or `as-github-pr-update` to manage PR metadata in a predictable workflow sequence. See [Handbook](docs/handbook.md) for the full skill and workflow catalog.
+**Prepare clean review history before publishing** - run the `as-git-reorganize-commits` workflow to reorganize commit stacks, then use `as-git-pr-create` or `as-git-pr-update` to manage PR metadata in a predictable workflow sequence. See [Handbook](docs/handbook.md) for the full skill and workflow catalog.
 
 **Coordinate with commit and worktree tools** - pair with [ace-git-commit](../ace-git-commit) for scoped commit authoring, [ace-git-worktree](../ace-git-worktree) for task-oriented worktree management, and [ace-bundle](../ace-bundle) for loading workflow instructions.
 

data/docs/handbook.md

@@ -17,8 +17,8 @@ Reference for package-owned handbook resources in `ace-git/handbook/`.
 |-------|--------------|
 | `as-git-rebase` | Guide changelog-preserving rebases |
 | `as-git-reorganize-commits` | Rework commit history into reviewable logical groups |
-| `as-github-pr-create` | Create pull requests with the package templates and workflow |
-| `as-github-pr-update` | Refresh an existing PR body from current branch context |
+| `as-git-pr-create` | Create an attempt-bound draft on the selected forge |
+| `as-git-pr-update` | Update the exact attempt-bound PR and consume current evidence |
 | `as-github-release-publish` | Publish a GitHub release from the ACE workflow |
 
 ## Workflow Instructions
@@ -27,8 +27,8 @@ Reference for package-owned handbook resources in `ace-git/handbook/`.
 |--------------|---------|------------|
 | `wfi://git/rebase` | Rebase a branch while preserving changelog/version files | `as-git-rebase` |
 | `wfi://git/reorganize-commits` | Consolidate or regroup commit history before review | `as-git-reorganize-commits` |
-| `wfi://github/pr/create` | Create a PR with the package templates | `as-github-pr-create` |
-| `wfi://github/pr/update` | Update a PR description from current state | `as-github-pr-update` |
+| `wfi://git/pr/create` | Create or reconcile the exact attempt-bound draft | `as-git-pr-create` |
+| `wfi://git/pr/update` | Update the recorded PR and retain delivery identity | `as-git-pr-update` |
 | `wfi://github/release-publish` | Publish a GitHub release | `as-github-release-publish` |
 
 ## Guides

data/docs/usage.md

@@ -289,6 +289,23 @@ Note: `test/**/*` and `spec/**/*` are NOT excluded by default - test changes are
 
 ## Provider Packages
 
+`ace-git service create`, `service update`, `service ready` and `service merge`
+are fixed protected receiver handlers. It accepts no
+options; the receiver supplies its claimed JSON envelope on stdin and its
+private materialized candidate directory as the working directory. The handler
+checks the exact input digest, executor, candidate and forge provenance, calls
+the selected neutral operation once, and emits the existing bounded evidence
+response only after verifying the exact PR outcome (and merge commit for merge). An unverified or lost
+outcome emits no success and never retries. This command does not authorize a
+operation or replace the protected worker's canonical receipt acceptance.
+Create/update use an exact `{target,delivery,title,body}` input and remain draft;
+ready uses `{target,delivery}`, merge uses `{target,delivery,method}`. Create targets
+the base repository; all other operations target the exact PR URL. The original
+title remains part of the accepted input; the provider owns its draft encoding
+(Forgejo's WIP prefix). Updating a draft preserves that encoding. Each handler
+publishes the fixed `pr-result.txt` evidence only after its observed content,
+identity, head and draft/merge outcome agree.
+
 `ace-git` is forge-neutral. It defines the server registry (`Ace::Git::ServerRegistry`),
 the provider contract (`Ace::Git::Providers::Base`), and normalized evidence types;
 provider packages own all forge CLI behavior:

data/handbook/guides/version-control-system-git.g.md

@@ -183,13 +183,19 @@ git remote prune origin
    git push -u origin feature/your-feature
    ```
 
-2. **Create PR through GitHub interface** or CLI:
+2. **Create an attempt-bound draft on the selected forge**:
 
    ```bash
-   gh pr create --title "feat(feature): add new functionality" \
-                --body "Description of changes..."
+   ace-bundle wfi://git/pr/create
    ```
 
+   Use the managed assignment and active delivery attempt with explicit
+   fork/canonical repository and ref provenance. The canonical operation is
+   `ace-assign delivery --assignment ID --attempt ATTEMPT --operation create --title TITLE --body-file DESCRIPTION`.
+   Preserve the resolved forge and exact candidate SHA. Continue through
+   `wfi://git/pr/update` only with accepted current test and independent review
+   receipts; CI status remains advisory. Inside ACE use source `bin/ace-*`.
+
 3. **Link to relevant issues/tasks**:
 
    ```markdown
@@ -219,7 +225,8 @@ git push --force-with-lease origin feature/your-feature
 
 #### Fork-Based Workflow
 
-For external contributors:
+Provider-specific GitHub clone example for external contributors; canonical
+assignment delivery above uses the explicitly selected forge and provenance:
 
 ```bash
 # Fork repository on GitHub, then:

data/handbook/skills/as-git-pr-create/SKILL.md

@@ -0,0 +1,23 @@
+---
+name: as-git-pr-create
+description: Create an attempt-bound forge-neutral pull request
+user-invocable: true
+source: ace-git
+allowed-tools:
+  - Bash(ace-assign:*)
+  - Bash(ace-git:*)
+  - Bash(ace-bundle:*)
+  - Read
+assign:
+  steps:
+    - name: create-pr
+      description: Create the exact assignment pull request
+      produces: [pull-request]
+      consumes: [code-changes, execution-attempt]
+skill:
+  kind: workflow
+  execution:
+    workflow: wfi://git/pr/create
+---
+
+Load and run `ace-bundle wfi://git/pr/create` in the current project, then execute its complete workflow. Use source `bin/ace-*` entrypoints inside the ACE repository.

data/handbook/skills/as-git-pr-update/SKILL.md

@@ -0,0 +1,23 @@
+---
+name: as-git-pr-update
+description: Update an attempt-bound forge-neutral pull request
+user-invocable: true
+source: ace-git
+allowed-tools:
+  - Bash(ace-assign:*)
+  - Bash(ace-git:*)
+  - Bash(ace-bundle:*)
+  - Read
+assign:
+  steps:
+    - name: update-pr-desc
+      description: Update the exact assignment pull request
+      produces: [pull-request]
+      consumes: [code-changes, execution-attempt]
+skill:
+  kind: workflow
+  execution:
+    workflow: wfi://git/pr/update
+---
+
+Load and run `ace-bundle wfi://git/pr/update` in the current project, then execute its complete workflow. Use source `bin/ace-*` entrypoints inside the ACE repository.

data/handbook/workflow-instructions/git/pr/create.wf.md

@@ -0,0 +1,70 @@
+---
+doc-type: workflow
+title: Create an attempt-bound draft pull request
+purpose: Create or reconcile a forge-neutral draft for the exact candidate
+---
+
+# Create an attempt-bound draft pull request
+
+## Goal
+
+Create one draft PR on the selected forge and retain its exact source/base identity in the assignment attempt journal.
+
+## Prerequisites
+
+A reviewed task, managed assignment, active delivery attempt, committed candidate, and pushed source ref. Credentials permit transport only; they grant no integration authority.
+
+## Inputs
+
+Use `forge_server` or `forge_default: true`, mutually exclusive. Neither means resolve this repository's configured remote. Provide `pr_provenance` containing `mode` (`fork` or `canonical`), `head_repository_url`, `head_ref`, `base_repository_url`, and `base_ref`. Canonical repositories must match; fork mode explicitly names its source even when owners coincide. Inputs contain no credentials.
+
+```json
+{"forge_server":"forge-lab","pr_provenance":{"mode":"canonical","head_repository_url":"https://forge.example/team/repo","head_ref":"feature","base_repository_url":"https://forge.example/team/repo","base_ref":"main"}}
+```
+
+## Protected worker boundary
+
+The steps below are ordinary managed delivery only. An installed protected
+participant uses the configured receiver and the original canonical authority,
+with no caller-local journal or direct-provider fallback.
+
+The authenticated worker may create/update a draft before independent review.
+Save a nonsecret input object with exactly `target`, `delivery`, `title`, `body`;
+`delivery` is the normalized original forge/provenance mapping. `target` has
+`resource` and nullable `artifact_digest`: the selected base repository URL for
+create, the exact recorded PR URL for update. Title/body are bounded UTF-8 text.
+Request the installed receiver with:
+
+```sh
+ace-lab service request --project PROJECT --assignment ID --attempt ATTEMPT \
+  --mapping MAPPING --scope SCOPE --service SERVICE --operation OPERATION \
+  --candidate-head SHA --candidate-generation CANDIDATE-GENERATION \
+  --expected-generation AUTHORITY-GENERATION --authorization AUTHORIZATION \
+  --request-id REQUEST --input INPUT.json
+```
+
+Use `create` or `update` as OPERATION; each requires its own exact scoped grant.
+The receiver runs the fixed `ace-git service create` or `service update` handler.
+A claim acknowledges admission, not PR success. Retain its complete selection
+and observe `ace-lab service status` as described in
+`wfi://handbook/perform-delivery`. Lost replies stay uncertain; status does not
+repeat an effect. Only canonical completion supplies the created PR URL.
+
+For ready, use the same request with OPERATION `ready` and input containing only
+`target` and `delivery`. Ready and merge require executed checks, accepted
+independent review for the current revision and the matching authorization.
+Local report/reference files cannot replace those canonical proofs. Draft
+creation/update does not grant readiness, merge or publication.
+
+## Steps
+
+1. Read the task and actual committed diff; prepare a concrete title and description explaining behavior and executed validation. Save the description as a local file.
+2. Use the existing managed assignment and active delivery attempt IDs. If needed, start the delivery step with `ace-assign attempt start --assignment ID --step STEP --project PROJECT` (numeric step scope). The execution boundary supplies actor identity; do not impersonate a reviewer or integrator.
+3. Supply the assignment source's `delivery` mapping, or save the explicit input JSON and pass `--parameters FILE`. For task-mode creation, `ace-assign create --task TASK --delivery-parameters FILE` retains these inputs in the generated job.
+4. Execute `ace-assign delivery --assignment ID --attempt ATTEMPT --operation create --title TITLE --body-file DESCRIPTION`. Add `--parameters FILE` only when supplying an explicit file. In this repository invoke the source `bin/ace-assign` entrypoint.
+5. Read the structured result. Verify the retained server/provider/base and head repository/ref, draft PR number/URL, candidate SHA, base_head, evidence_git_ref, and separate journal_commit. The pushed ref must equal the candidate; journal commits never advance it.
+6. On interruption or unknown create outcome, repeat the delivery command to perform exact-selector reconciliation reads. One matching draft at the exact head is adopted without a second create. Zero remains unresolved; multiple matches conflict. Never bypass uncertainty with a direct provider command.
+
+## Success criteria
+
+The journal records exact identity, intent before the write, and proven draft outcome afterward. A report or shell exit alone proves nothing. Continue with actual tests and independent current-head review; keep the PR draft until those receipts are accepted. CI is visible and advisory. Publication is a separate authorized operation and is not required for delivery.

data/handbook/workflow-instructions/git/pr/update.wf.md

@@ -0,0 +1,62 @@
+---
+doc-type: workflow
+title: Update an attempt-bound pull request
+purpose: Update the exact forge-neutral PR and consume current delivery evidence
+---
+
+# Update an attempt-bound pull request
+
+## Goal
+
+Update the recorded PR description for the current candidate and preserve provider identity through readiness and integration handoff.
+
+## Prerequisites
+
+A managed assignment with a recorded PR and active delivery attempt. Reuse the original forge selection and complete fork/canonical provenance; changed configuration or identity is a conflict. A new committed candidate, including task-only changes, requires renewed tests and independent review.
+
+## Protected worker boundary
+
+The steps below are ordinary managed delivery only. An installed protected
+participant uses the configured receiver and the original canonical authority,
+with no caller-local journal or direct-provider fallback.
+
+The authenticated worker may create/update a draft before independent review.
+Save a nonsecret input object with exactly `target`, `delivery`, `title`, `body`;
+`delivery` is the normalized original forge/provenance mapping. `target` has
+`resource` and nullable `artifact_digest`: the selected base repository URL for
+create, the exact recorded PR URL for update. Title/body are bounded UTF-8 text.
+Request the installed receiver with:
+
+```sh
+ace-lab service request --project PROJECT --assignment ID --attempt ATTEMPT \
+  --mapping MAPPING --scope SCOPE --service SERVICE --operation OPERATION \
+  --candidate-head SHA --candidate-generation CANDIDATE-GENERATION \
+  --expected-generation AUTHORITY-GENERATION --authorization AUTHORIZATION \
+  --request-id REQUEST --input INPUT.json
+```
+
+Use `create` or `update` as OPERATION; each requires its own exact scoped grant.
+The receiver runs the fixed `ace-git service create` or `service update` handler.
+A claim acknowledges admission, not PR success. Retain its complete selection
+and observe `ace-lab service status` as described in
+`wfi://handbook/perform-delivery`. Lost replies stay uncertain; status does not
+repeat an effect. Only canonical completion supplies the created PR URL.
+
+For ready, use the same request with OPERATION `ready` and input containing only
+`target` and `delivery`. Ready and merge require executed checks, accepted
+independent review for the current revision and the matching authorization.
+Local report/reference files cannot replace those canonical proofs. Draft
+creation/update does not grant readiness, merge or publication.
+
+## Steps
+
+1. Inspect the committed changes and accepted test/review evidence. Prepare the final description with the concrete behavior, executed test results, independent verdict, and actual limitations. Save it as a local file; do not put credentials or terminal dumps in the attempt journal.
+2. Execute `ace-assign delivery --assignment ID --attempt ATTEMPT --operation update --body-file DESCRIPTION`. Supply `--parameters FILE` only if the assignment source lacks the original `delivery` mapping. In this repository use `bin/ace-assign`.
+3. On interrupted update, repeat the delivery command. It reads the exact remote title/body and compares the requested field digest before accepting; an unmatched or unreadable outcome remains unresolved. Never blindly resend a mutation.
+4. To mark ready, supply two JSON reference files, each containing only `attempt_id` and `receipt_digest`, from coordinator-accepted current-head test and independent review attempts in this assignment/project. Execute `ace-assign delivery --assignment ID --attempt ATTEMPT --operation ready --tests TEST-REF --review REVIEW-REF`. Missing, fabricated, stale, or self-approved evidence cannot authorize readiness. Red CI alone does not veto valid executed tests and review.
+5. Merge is an integrator/service operation under the existing exact qjx authorization policy. The authorized executor calls `ace-git pr merge IDENTIFIER --server NAME --expected-head CANDIDATE-SHA --method METHOD --format json` with the retained selection (or `--default-server`, otherwise remote resolution). Both expected SHA and the authorized squash/merge/rebase method are required; there is no default method. It does not recursively request its own future receipt. The worker consumes the completed, verified service receipt using `ace-assign delivery --assignment ID --attempt ATTEMPT --operation merge --tests TEST-REF --review REVIEW-REF --service-request REQUEST`. The request must bind this assignment, attempt, project, candidate and PR URL. No completed receipt means a routed blocker; credentials or caller assertions grant no authority.
+6. Unknown merge remains pending service reconciliation and is never automatically retried. Inspect the authoritative selected remote and verified executor evidence. Changed head or scope blocks acceptance. Merge does not authorize publication, deployment or synchronization.
+
+## Success criteria
+
+The exact remote outcome and existing qjl evidence agree. Real artifacts, current executed tests, independent verdict and required authorization gate completion. Preserve unresolved history and distinct candidate_head/journal_commit. qkb.1 supplies installed charter/proposal/service adoption; this workflow does not fabricate that acceptance.

data/lib/ace/git/atoms/delivery_parameters.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+require_relative "server_url"
+
+module Ace
+  module Git
+    module Atoms
+      # Explicit non-secret remote delivery inputs; local recipes need not call this validator.
+      module DeliveryParameters
+        PROVENANCE_FIELDS = %w[mode head_repository_url head_ref base_repository_url base_ref].freeze
+        def self.validate(input)
+          raise ArgumentError, "Delivery parameters must be a mapping" unless input.is_a?(Hash)
+          unless (input.keys - %w[forge_server forge_default pr_provenance]).empty?
+            raise ArgumentError, "Unexpected delivery parameter fields"
+          end
+          default = input.fetch("forge_default", false)
+          raise ArgumentError, "forge_default must be boolean" unless [true, false].include?(default)
+          server = input["forge_server"]
+          if server && (!server.is_a?(String) || !server.match?(/\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/))
+            raise ArgumentError, "Invalid forge_server"
+          end
+          raise ArgumentError, "forge_server and forge_default are mutually exclusive" if server && default
+          provenance = input["pr_provenance"]
+          unless provenance.is_a?(Hash) && provenance.keys.sort == PROVENANCE_FIELDS.sort &&
+              %w[fork canonical].include?(provenance["mode"])
+            raise ArgumentError, "Explicit complete fork or canonical PR provenance is required"
+          end
+          %w[head_repository_url base_repository_url].each { |key| validate_url!(provenance[key]) }
+          %w[head_ref base_ref].each do |key|
+            ref = provenance[key]
+            unless ref.is_a?(String) && ref.match?(/\A[a-zA-Z0-9][a-zA-Z0-9_\/.\-]{0,255}\z/) &&
+                !ref.include?("..") && !ref.include?("//") && !ref.end_with?("/", ".", ".lock")
+              raise ArgumentError, "Invalid PR ref"
+            end
+          end
+          if provenance["mode"] == "canonical" && !Ace::Git::Atoms::ServerUrl.match?(
+              provenance["head_repository_url"], provenance["base_repository_url"])
+            raise ArgumentError, "Canonical provenance requires matching head and base repositories"
+          end
+          {"forge_server" => server, "forge_default" => default,
+           "pr_provenance" => provenance.transform_values(&:dup)}
+        end
+
+        def self.validate_url!(url)
+          unless url.is_a?(String) && url.length <= 512 &&
+              (url.match?(%r{\Ahttps?://[a-zA-Z0-9.:-]+/[a-zA-Z0-9_./-]+\z}) ||
+               url.match?(%r{\Agit@[a-zA-Z0-9.-]+:[a-zA-Z0-9_./-]+\z}) ||
+               url.match?(%r{\Assh://git@[a-zA-Z0-9.:-]+/[a-zA-Z0-9_./-]+\z}))
+            raise ArgumentError, "PR repository URL must contain a repository and no credentials or query"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/git/atoms/service_merge_evidence.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+require "json"
+require_relative "delivery_parameters"
+require_relative "pr_reference"
+require_relative "../providers/evidence"
+
+module Ace
+  module Git
+    module Atoms
+      # Parse executor-owned evidence; authority supplies the original binding
+      # and separately checks the reconstructed input's canonical digest.
+      module ServiceMergeEvidence
+        MAX_BYTES = 64 * 1024
+        def self.validate(bytes, request_id:, input_digest:, target:, head:)
+          unless bytes.is_a?(String) && bytes.bytesize.between?(1, MAX_BYTES) &&
+              bytes.dup.force_encoding(Encoding::UTF_8).valid_encoding? && !bytes.include?("\0")
+            raise ArgumentError, "merge evidence is invalid or oversized"
+          end
+          marker, payload = bytes.split("\n", 2)
+          unless marker == "ace-service-attestation request:#{request_id} input:#{input_digest} outcome:succeeded"
+            raise ArgumentError, "merge evidence original marker differs"
+          end
+          value = JSON.parse(payload.to_s, max_nesting: 16, create_additions: false,
+            allow_duplicate_key: false, allow_comments: false, allow_nan: false)
+          closed!(value, %w[server delivery method candidate_head receipt])
+          delivery = DeliveryParameters.validate(value.fetch("delivery"))
+          unless value["delivery"] == delivery && value["delivery"].keys.sort == %w[forge_default forge_server pr_provenance] &&
+              %w[squash merge rebase].include?(value["method"]) && value["candidate_head"] == head
+            raise ArgumentError, "merge evidence selection/method/head differs"
+          end
+          server, receipt = value.values_at("server", "receipt")
+          closed!(server, %w[name provider url])
+          closed!(receipt, %w[server_name operation pull_request idempotency])
+          unless server["name"].is_a?(String) && server["name"].match?(/\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/) &&
+              server["provider"].is_a?(String) && server["provider"].match?(/\A[a-zA-Z0-9_-]{1,128}\z/) &&
+              receipt["server_name"] == server["name"] && receipt["operation"] == "merge"
+            raise ArgumentError, "merge evidence provider receipt differs"
+          end
+          DeliveryParameters.validate_url!(server["url"])
+          pr = receipt.fetch("pull_request")
+          closed!(pr, ProviderPullRequest.members.map(&:to_s))
+          provenance = delivery.fetch("pr_provenance")
+          reference = target.is_a?(Hash) && PrReference.parse(target["resource"])
+          unless reference && reference.repository_url && pr["number"].is_a?(Integer) && pr["number"].positive? &&
+              pr["number"] == reference.number && pr["url"] == target["resource"] && pr["server_name"] == server["name"] &&
+              pr["head_sha"] == head && head.is_a?(String) && head.match?(/\A[0-9a-f]{40}\z/) &&
+              pr["state"] == "merged" && [true, false].include?(pr["draft"]) &&
+              pr.except("number", "draft").values.all? { |value| value.nil? || value.is_a?(String) } &&
+              pr["merge_commit_sha"].is_a?(String) && pr["merge_commit_sha"].match?(/\A[0-9a-f]{40}\z/) &&
+              pr["head_ref"] == provenance["head_ref"] && pr["base_ref"] == provenance["base_ref"] &&
+              ServerUrl.match?(reference.repository_url, provenance["base_repository_url"]) &&
+              ServerUrl.match?(server["url"], provenance["base_repository_url"]) &&
+              ServerUrl.match?(pr["head_repository_url"], provenance["head_repository_url"]) &&
+              ServerUrl.match?(pr["base_repository_url"], provenance["base_repository_url"]) &&
+              (!delivery["forge_server"] || delivery["forge_server"] == server["name"])
+            raise ArgumentError, "merge evidence PR identity or outcome differs"
+          end
+          {input: {"target" => target, "delivery" => delivery, "method" => value.fetch("method")},
+            pr: pr, server: server}
+        rescue JSON::ParserError, KeyError, TypeError
+          raise ArgumentError, "merge evidence is malformed"
+        end
+
+        def self.closed!(value, fields)
+          raise ArgumentError, "merge evidence fields differ" unless value.is_a?(Hash) && value.keys.sort == fields.sort
+        end
+        private_class_method :closed!
+      end
+    end
+  end
+end

data/lib/ace/git/atoms/service_pr_evidence.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+require "json"
+require_relative "service_pr_input"
+require_relative "../providers"
+require_relative "../server_registry"
+
+module Ace
+  module Git
+    module Atoms
+      module ServicePrEvidence
+        def self.validate(bytes, operation:, request_id:, input_digest:, target:, head:)
+          unless ServicePrInput::DRAFT_OPERATIONS.include?(operation) || operation == "ready"
+            raise ArgumentError, "unsupported PR evidence operation"
+          end
+          unless bytes.is_a?(String) && bytes.bytesize.between?(1, 64 * 1024) &&
+              bytes.dup.force_encoding(Encoding::UTF_8).valid_encoding? && !bytes.include?("\0")
+            raise ArgumentError, "PR evidence is invalid or oversized"
+          end
+          marker, payload = bytes.split("\n", 2)
+          unless marker == "ace-service-attestation request:#{request_id} input:#{input_digest} outcome:succeeded"
+            raise ArgumentError, "PR evidence original marker differs"
+          end
+          value = JSON.parse(payload.to_s, max_nesting: 16, create_additions: false,
+            allow_duplicate_key: false, allow_comments: false, allow_nan: false)
+          closed!(value, %w[server operation input candidate_head receipt])
+          input = ServicePrInput.validate(value.fetch("input"), operation: operation)
+          unless value["operation"] == operation && value["candidate_head"] == head && input["target"] == target
+            raise ArgumentError, "PR evidence operation/input/head differs"
+          end
+          server, receipt = value.values_at("server", "receipt")
+          closed!(server, %w[name provider url])
+          closed!(receipt, %w[server_name operation pull_request idempotency])
+          pr = receipt.fetch("pull_request")
+          closed!(pr, ProviderPullRequest.members.map(&:to_s))
+          delivery = input.fetch("delivery")
+          provenance = delivery.fetch("pr_provenance")
+          reference = PrReference.parse(pr["url"])
+          unless server["name"].is_a?(String) && server["provider"].is_a?(String) && server["url"].is_a?(String)
+            raise ArgumentError, "PR evidence provider identity is malformed"
+          end
+          selected = ResolvedServer.new(name: server["name"], provider: server["provider"], url: server["url"])
+          expected_title = Providers.for(selected).class.pull_request_title(title: input["title"], draft: true) if ServicePrInput::DRAFT_OPERATIONS.include?(operation)
+          unless reference && reference.repository_url && pr["number"] == reference.number &&
+              pr["number"].is_a?(Integer) && pr["number"].positive? &&
+              server["name"].is_a?(String) && server["name"].match?(/\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/) &&
+              server["provider"].is_a?(String) && server["provider"].match?(/\A[a-zA-Z0-9_-]{1,128}\z/) &&
+              receipt["server_name"] == server["name"] && receipt["operation"] == operation &&
+              pr["server_name"] == server["name"] && pr["head_sha"] == head &&
+              head.is_a?(String) && head.match?(/\A[0-9a-f]{40}\z/) && pr["state"] == "open" &&
+              pr["draft"] == ServicePrInput::DRAFT_OPERATIONS.include?(operation) &&
+              pr.except("number", "draft").values.all? { |item| item.nil? || item.is_a?(String) } &&
+              (operation == "create" ? %w[created existing].include?(receipt["idempotency"]) : receipt["idempotency"].nil?) &&
+              pr["head_ref"] == provenance["head_ref"] && pr["base_ref"] == provenance["base_ref"] &&
+              ServerUrl.match?(reference.repository_url, provenance["base_repository_url"]) &&
+              ServerUrl.match?(server["url"], provenance["base_repository_url"]) &&
+              ServerUrl.match?(pr["head_repository_url"], provenance["head_repository_url"]) &&
+              ServerUrl.match?(pr["base_repository_url"], provenance["base_repository_url"]) &&
+              (!delivery["forge_server"] || delivery["forge_server"] == server["name"]) &&
+              (operation == "create" || pr["url"] == target["resource"]) &&
+              (operation == "ready" || pr["title"] == expected_title && pr["body"] == input["body"])
+            raise ArgumentError, "PR evidence selected identity or outcome differs"
+          end
+          DeliveryParameters.validate_url!(server["url"])
+          {input: input, pr: pr, server: server}
+        rescue JSON::ParserError, KeyError, TypeError, Ace::Git::Error
+          raise ArgumentError, "PR evidence is malformed"
+        end
+
+        def self.closed!(value, fields)
+          raise ArgumentError, "PR evidence fields differ" unless value.is_a?(Hash) && value.keys.sort == fields.sort
+        end
+        private_class_method :closed!
+      end
+    end
+  end
+end

data/lib/ace/git/atoms/service_pr_input.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+require_relative "delivery_parameters"
+require_relative "pr_reference"
+
+module Ace
+  module Git
+    module Atoms
+      # Fixed receiver input vocabulary; draft is source policy, not a flag.
+      module ServicePrInput
+        OPERATIONS = %w[create update ready merge].freeze
+        DRAFT_OPERATIONS = %w[create update].freeze
+
+        def self.validate(input, operation:)
+          fields = case operation
+          when "create", "update" then %w[target delivery title body]
+          when "ready" then %w[target delivery]
+          when "merge" then %w[target delivery method]
+          else raise ArgumentError, "unsupported protected PR operation"
+          end
+          unless input.is_a?(Hash) && input.keys.sort == fields.sort &&
+              input["target"].is_a?(Hash) && input["target"].keys.sort == %w[artifact_digest resource]
+            raise ArgumentError, "protected PR input fields differ"
+          end
+          parameters = DeliveryParameters.validate(input.fetch("delivery"))
+          unless input["delivery"].keys.sort == %w[forge_default forge_server pr_provenance] && input["delivery"] == parameters
+            raise ArgumentError, "protected PR selection must be normalized"
+          end
+          resource = input.fetch("target").fetch("resource")
+          if operation == "create"
+            DeliveryParameters.validate_url!(resource)
+            unless ServerUrl.match?(resource, parameters.fetch("pr_provenance").fetch("base_repository_url"))
+              raise ArgumentError, "draft create target differs from base repository"
+            end
+          else
+            reference = resource.is_a?(String) && PrReference.parse(resource)
+            raise ArgumentError, "protected PR target requires an exact URL" unless reference && reference.repository_url
+          end
+          digest = input.fetch("target").fetch("artifact_digest")
+          unless digest.nil? || digest.is_a?(String) && /\A[0-9a-f]{64}\z/.match?(digest)
+            raise ArgumentError, "protected PR target artifact digest differs"
+          end
+          if DRAFT_OPERATIONS.include?(operation)
+            unless input["title"].is_a?(String) && input["title"].bytesize.between?(1, 1024) &&
+                input["body"].is_a?(String) && input["body"].bytesize <= 32 * 1024 &&
+                [input["title"], input["body"]].all? { |text| text.dup.force_encoding(Encoding::UTF_8).valid_encoding? && !text.include?("\0") }
+              raise ArgumentError, "draft PR requires bounded UTF-8 title/body"
+            end
+          elsif operation == "merge" && !%w[squash merge rebase].include?(input["method"])
+            raise ArgumentError, "protected merge requires an exact method"
+          end
+          input
+        end
+      end
+    end
+  end
+end

data/lib/ace/git/cli/commands/service_merge.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+require_relative "../../organisms/service_merge"
+
+module Ace
+  module Git
+    module CLI
+      module Commands
+        class ServiceMerge < Ace::Support::Cli::Command
+          desc "Execute a fixed receiver-owned exact-head PR envelope"
+
+          def initialize(input: nil, producer: nil, root: nil, operation: "merge")
+            @input, @producer, @root, @operation = input, producer, root, operation
+          end
+
+          def call(**options)
+            raise ArgumentError, "fixed PR entry accepts no options" unless options.empty?
+            bytes = (@input || $stdin).read(Organisms::ServiceMerge::MAX_INPUT + 1)
+            result = (@producer || Organisms::ServiceMerge.new(operation: @operation)).call(bytes: bytes, root: @root || Dir.pwd)
+            puts JSON.generate(result)
+          rescue Ace::Git::Error, ArgumentError, SystemCallError, IOError => error
+            # No stdout receipt on an unverified/uncertain effect. The existing
+            # receiver retains its original dispatch instead of retrying it.
+            raise Ace::Support::Cli::Error, error.message
+          end
+        end
+      end
+    end
+  end
+end