ace-herdr 0.3.0 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a3c3149a40374844ef590a17e1ff5908daf08153ebf64f3d82f776efb22985b8
-  data.tar.gz: 5c8ba6b8316a3c5f3808a138e7b4e543006107286edefa6d9b5fc12403a975d8
+  metadata.gz: c6c7f32e364c4df76447fd6d4356f2117007cf920dc3f2f420bd4dd1e21f8242
+  data.tar.gz: 783dd62904dd12e952528d80d9956511c052fcf23a53551b390f5817bbe93c8c
 SHA512:
-  metadata.gz: ffd4b11b53a480492c625a3f43bab4710a732ef0dda2dae9d84bf5caa9a15aba156c4f9484abf47ac0f36c2caed0c8f36947c3788999b8e21a4070c8c3790e21
-  data.tar.gz: '03794e613cbce4ea3edcfdc06e8e04bff70d0e75afa8e3cc0755b85eceddbed6f79a2a2f1f245b6171dc140569b63353b9646746d1fdec78df2922d08558ccc5'
+  metadata.gz: bd865086e653b9f8bed7434073707fb733f0f9f0f08c6d979046476ee955a65a2938e7efbad966942fe2a55b68b80c7bbc6a53076601bdaac4cb0ff94029e099
+  data.tar.gz: '08c29e0f0cfb5fa1857959c1fd0ef05376ce3dcc895e6ee6a056e2b3be58c00311e5d0b397e07f063bc94151bb3567441c9e1213bf11e6ea16ea570e8e3fa010'

data/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.2] - 2026-10-04
+
+### Changed
+
+- Depend on the leaf `ace-hitl-contract` provider vocabulary instead of full HITL orchestration, removing the assignment adapter dependency cycle.
+
+## [0.3.1] - 2026-10-04
+
+### Fixed
+- Replacing a dead prepared pane updates only the recorded pane pointer: a foreign tab's pointer-only identity record stays pointer-only instead of gaining invented `root`/`preset` ownership keys, so the live replacement pane is reused across adapter and process restarts and `ensure_window` at the verified native root still adopts the tab. Records with genuine provenance keep their exact root and preset, and wrong ids, conflicting provenance, corrupt records, and stale pointers still cannot bypass the ownership guards.
+- `ace-herdr tab` reports a failed preset materialization (native tab created, later step failed) through the standard CLI error boundary — non-zero exit, actionable message, no success payload, and no stack trace in ordinary mode. The runtime adapter keeps its documented runtime classification and exact-id rollback; this entrypoint never closes tabs.
+
 ## [0.3.0] - 2026-10-02
 
 ### Added

data/docs/usage.md

@@ -3,8 +3,8 @@ doc-type: user
 title: ace-herdr Usage
 purpose: Full CLI and configuration reference for ace-herdr: push delivery, agent bootstrap, the terminal-control surface (list, send, capture, wait, presets), and tidy cleanup.
 ace-docs:
-  last-updated: 2026-10-02
-  last-checked: 2026-10-02
+  last-updated: 2026-10-04
+  last-checked: 2026-10-04
 ---
 
 # Usage
@@ -38,6 +38,8 @@ Install `ace-herdr` alongside `ace-runtime`, then resolve the adapter with `Ace:
 
 The adapter implements `context`, `ensure_window`, `prepare_pane`, `focus`, ordered `send` and its convenience methods, `capture`, `wait_output`, `wait_agent`, `wait_lifecycle`, `close_window`, `list_windows`, and `list_panes`. `ensure_window` scopes the sanitized tab label to the caller workspace. It records the tab's root, preset, and prepared pane under `~/.ace/local/herdr/runtime-tabs/` — keyed by workspace and label, so adapter instances from any working directory or requested root share one record, create through the same lock, and serialize prepared-pane creation through it. Later instances verify an idempotent request and reject a conflicting one; a tab whose ownership cannot be proven is never closed or replaced (a failed create rolls back only tabs the same attempt created). `prepare_pane` splits a retained shell target and returns the native pane ID after verifying it exists and has a shell process.
 
+Replacing a dead prepared pane updates only the recorded pane pointer: a foreign tab's pointer-only record stays pointer-only (no root/preset keys are invented, so it never becomes ownership evidence), and an owned record keeps its exact root and preset. A prepared-pane pointer to a dead pane is replaced by the next split; a pointer-only record never satisfies `ensure_window` by itself -- adoption still requires the tab's verified native root.
+
 Sends probe for a live agent. Plain panes receive raw text and keys in order; agent panes receive one self-submitting `agent prompt`, with one trailing Enter dropped and reported. Agent waits use native `agent wait` states (`idle`, `working`, `blocked`, `done`). Contract timeout values are seconds and are converted to Herdr milliseconds. Lifecycle waits observe `tab get`, focused tab state, `pane get`, and `pane process-info`; a missing pane keeps `pane-exists` waiting but immediately satisfies `pane-exited`. A pane with only its retained shell also satisfies `pane-exited` because no submitted foreground command remains. This observation does not prove assignment success or authorize cleanup.
 
 Native `agent_blocked` becomes `SendRejectedError`; `agent_prompt_stalled` becomes `SendStalledError` and must not be automatically resent. Native wait timeouts become `WaitTimeoutError`, missing targets become `TargetNotFoundError`, and an unavailable binary or socket becomes `RuntimeUnavailableError`.
@@ -239,6 +241,8 @@ Output: `{"workspace":"w2","tabs":[{"tab":"w2:t1","panes":["w2:p1","w2:p2"],"com
 
 Unknown preset: CLI error listing the available names (ace-tmux `--list-presets` parity), for example `Error: Unknown workspace preset 'nope' (available: development)`.
 
+Failed tab materialization: when a preset's native tab is created but a later materialization step fails (split, command, or agent start), both `ace-herdr tab` and `ace-herdr workspace` report a standard CLI error -- the process exits non-zero with the underlying failure on stderr, prints no success payload on stdout, and shows no stack trace in ordinary mode. These entrypoints never close tabs (rollback of the failed tab is the runtime adapter's exact-id policy).
+
 ## `ace-herdr deliver`
 
 Push an answer to an agent pane.
@@ -355,6 +359,7 @@ Commands raise a CLI error (non-zero exit) carrying herdr's machine code where o
 - herdr binary or socket unavailable: explicit CLI error, no partial output
 - Blocked agent: `agent_blocked: ...` (terminal -- never silently dropped); stalled prompt: `agent_prompt_stalled: ...` (transient)
 - Output wait timeout: `timeout: ...`
+- Failed tab materialization: CLI error carrying the underlying failure (`ace-herdr tab`, `ace-herdr workspace`); never a false success or a stack trace
 - Unknown preset: usage error listing the available preset names
 - Invalid send shapes: usage error **before any transport call** (nothing is sent)
 

data/lib/ace/herdr/cli/commands/support.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "ace/hitl/contract"
+
 require "json"
 require "ace/support/cli"
 require "ace/core"
@@ -58,6 +60,7 @@ module Ace
             Ace::Herdr::ValidationError,
             Ace::Herdr::TargetResolutionError,
             Ace::Herdr::WaitTimeoutError,
+            Ace::Herdr::TabMaterializationError,
             Ace::Herdr::ExecutorError => e
             raise Ace::Support::Cli::Error, e.message
           end

data/lib/ace/herdr/organisms/deliverer.rb

@@ -2,7 +2,7 @@
 
 require "shellwords"
 require "time"
-require "ace/hitl"
+require "ace/hitl/contract"
 
 module Ace
   module Herdr

data/lib/ace/herdr/organisms/dispatcher.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require "shellwords"
-require "ace/hitl"
+require "ace/hitl/contract"
 
 module Ace
   module Herdr

data/lib/ace/herdr/organisms/inbox.rb

@@ -5,7 +5,7 @@ require "json"
 require "time"
 require "securerandom"
 require "openssl"
-require "ace/hitl"
+require "ace/hitl/contract"
 
 module Ace
   module Herdr

data/lib/ace/herdr/organisms/runtime_adapter.rb

@@ -362,8 +362,12 @@ module Ace
             recorded = :corrupt
           end
           if recorded.is_a?(Hash) && recorded["id"] == tab[:id]
-            write_identity(path, id: recorded["id"], root: recorded["root"], preset: recorded["preset"],
-              prepared_pane: pane_id)
+            # Preserve the record's exact provenance shape: a pointer-only
+            # record stays pointer-only (no invented root/preset keys), an
+            # owned record keeps its verified values — only the pointer moves.
+            updated = recorded.dup
+            updated["prepared_pane"] = pane_id
+            atomic_write_json(path, updated)
           else
             # Foreign tab (not created through ensure_window) or corrupt
             # record: persist a pointer-only record so later instances

data/lib/ace/herdr/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Herdr
-    VERSION = "0.3.0"
+    VERSION = "0.3.2"
   end
 end

metadata

@@ -1,28 +1,28 @@
 --- !ruby/object:Gem::Specification
 name: ace-herdr
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.2
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-02 00:00:00.000000000 Z
+date: 2026-10-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: ace-hitl
+  name: ace-hitl-contract
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.10'
+        version: '0.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.10'
+        version: '0.1'
 - !ruby/object:Gem::Dependency
   name: ace-runtime
   requirement: !ruby/object:Gem::Requirement