ace-hitl 0.10.0 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 765d5a3ec0942bb25b92c9e16bf325bc60f5f9c58e72da56e8b62f8c716817e2
-  data.tar.gz: b3c1015a2037ac173be8cae4ce7527fc0b099bbdf5acd419572c30992a874424
+  metadata.gz: 579408795de68b05baeeb590eac46687706134301423cb6114874c377d8183ed
+  data.tar.gz: ba4f300554670fb40acd58c470183d70342626b170889bda9944468aa54df6e8
 SHA512:
-  metadata.gz: a54fd6f1fc8ac167b6ccd87bb724cd469c733df2a37006e2066a5123f875365ee65ef7d91132cf284167ea359bb57df6147ecc6e75f3f9cab264a9377c31809d
-  data.tar.gz: 11bd3b6c7a553d5372b9cb2ee10ac87b1586e82ca90ab470e6216f041410db987842605ce7dca8595eed31e07c17c05b0453374e0cf14b2131bd65d9982aa516
+  metadata.gz: f421f0a4df5ea2eb782766c259336f1298844b3e8ebcefad34885c446865538f02d4d7da3bedcbc84c254464e8a589ff4d3007de8fbe14d0158ad23edf6118d3
+  data.tar.gz: 5102b14720d671f3252eae1b37b942620128f33df90983877e25354958b147bda0545b86ff946aa35f973210abdea603a342547acf11621b4baf2829c0372a65

data/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.11.0] - 2026-10-04
+
+### Added
+- **Scoped privilege boundary for multi-user HITL state (spec 8wq.t.34i)**: the lifecycle store is now the PRIVATE state of one authenticated boundary service. `ace-hitl serve` runs the boundary over a peer-credential-authenticated UNIX socket (`Ace::Hitl::Lifecycle::Service`): every connection is identified from kernel peer credentials (`getpeereid` — payload fields and environment variables are never authority), clients authenticate the endpoint back (socket must be owned by the trusted service uid from the grants document, not world-writable, connected peer must BE the service uid), and the store root is service-owned (`0711` traverse-only root, `0700` private directories, `0755` public projections with `0440` non-secret records — no chmod-to-world workaround anywhere). Bounded newline-JSON protocol (`Lifecycle::Protocol`) with classified errors: `PermissionError`, `BindingError`, `StateError`, `AnswerError`, and the new `TransportError` for boundary unavailability — transport failures are visible and recoverable, never silent.
+- **Managed assignment binding**: requests bind to the exact ACTIVE MANAGED attempt of the calling actor through the ace-assign coordinator (`Providers::Lab::AssignmentBinding`). `ace-assign` gained `AttemptCoordinator#with_verified_attempt`, which holds the assignment `LifecycleExclusion` (shared side) across the caller's whole locked transition while `finish`/`reconcile` hold the exclusive side — stale, ended, replaced, or unproven (uncertain) attempts cannot acquire authority, and terminal commits can never interleave with a liveness check. CLI: `ace-hitl ask --assignment ID --attempt ID --project ID`.
+- **Transport authorization from trusted grants** (`Lifecycle::GrantsPolicy` + `TrustedFile`): transport uids and the service identity come only from the deployment-owned grants document (same file and traversal trust rules as ace-lab's `GrantResolver`: root-owned, no group/world-writable components, symlink-verified). ace-lab ships the matching `Molecules::HitlAuthorizer` for the lab-side delivery path.
+- **Idempotent terminal receipts**: every consume/cancel commits a durable receipt under the stable per-request lock (lock files live in `locks/` and survive id reuse); retries report the committed outcome instead of failing, conflicting transitions stay classified errors.
+- **OTP exact-operation challenges**: an `otp` request exists only with its non-secret publisher evidence (`{operation, result_ref, input_digest, expires_at}`, bounded to 24h); consumption requires the challenge's authorized operation; duplicate consumes replay the receipt WITHOUT the secret bytes. OTP effects are forbidden (the authorized operation consumes the OTP transiently). The service holds OTP bytes in a bounded, TTL-bound memory vault (`OtpVault::MemoryVault`) — secret bytes persist nowhere, transfer exactly once, and a restart deliberately loses the challenge (prompt again).
+
+### Changed
+- **BREAKING (pre-1.0, ADR-024)**: `ace-hitl ask/deliver/consume/cancel/pending/states/duty` run through the boundary client — the CLI no longer touches shared store files directly, and broker operations no longer require root (the configured transport identity from the grants document does). The admin binding bypass is removed: EVERY request validates against its live attempt. The `LAB_ATTEMPT_ID` environment default is gone (environment is never attempt authority); `--attempt` is required, and binding requires `--assignment` (managed) or `--work` (legacy path, kept until vs2 switches consumers). Answers and store files are service-owned `0600` — requesters receive bytes over the authenticated boundary, not through file ownership. The multi-UID acceptance fixture (`test/edge/lifecycle/`) proves requester isolation, protected ownership, forged-identity rejection, and one-terminal-transition races under real distinct OS accounts (requires root; CI records the run as advisory evidence).
+
+
 ## [0.10.0] - 2026-09-27
 
 ### Added

data/README.md

@@ -10,15 +10,22 @@ Canonical workflow and skill for agents:
 ## Commands
 
 - `ace-hitl create` creates a HITL event
-- `ace-hitl ask` asks a human via HITL and forwards the request through a provider adapter (`--provider`, default `lab`); ONE operation: local event + relay request through the native lifecycle store (`--work`, effect callback flags)
+- `ace-hitl ask` asks a human via HITL and forwards the request through a provider adapter (`--provider`, default `lab`); ONE operation: local event + relay request through the authenticated boundary (`--assignment/--attempt/--project` managed binding, `--work` legacy, effect callback flags)
 - `ace-hitl list` lists HITL events with filters (`--scope current|all`, all statuses by default)
 - `ace-hitl show` renders event details, path, or raw content (`--scope current|all`)
 - `ace-hitl update` updates frontmatter, answer content, and folder location
 - `ace-hitl wait` polls a specific HITL event until answered (`--poll-every`, `--timeout`)
-- `ace-hitl deliver` answers a pending relay request from stdin (host-broker operation); executes the declared effect callback as the requester
+- `ace-hitl deliver` answers a pending relay request from stdin (configured transport operation through the boundary); executes the declared effect callback (non-OTP kinds)
 - `ace-hitl consume` consumes one own relay request's answer (indefinite by default; `--timeout` bounds only the local wait)
 - `ace-hitl cancel` cancels with an audited reason (the only way to abandon a request)
-- `ace-hitl pending` / `ace-hitl states` / `ace-hitl duty` host-broker projections (pending, public lifecycle records, pending + escalated)
+- `ace-hitl pending` / `ace-hitl states` / `ace-hitl duty` transport projections (pending, public lifecycle records, pending + escalated)
+- `ace-hitl serve` runs the authenticated store boundary service (peer-credential UNIX socket; trusted grants authorize the transport)
+
+Multi-user HITL state (spec 8wq.t.34i) is the PRIVATE state of the
+`ace-hitl serve` boundary: identity comes from kernel peer
+credentials, transport authority from the trusted grants document,
+and OTP secrets are held in service memory only — never in files,
+logs, or projections.
 - `ace-hitl overseer-send` / `ace-hitl overseer-pending` / `ace-hitl overseer-ack` the Overseer reverse-address response channel
 
 `ace-hitl` is a blocker-resolution tool, not a global dashboard:

data/docs/usage.md

@@ -144,17 +144,82 @@ ace-hitl ask "Proceed with deploy?" \
   is declared by the adapter interface; provider `lab` reports it as
   unsupported until the ace-herdr push-delivery integration lands.
 
+## Scoped Store Boundary (spec 8wq.t.34i)
+
+The relay request store is the PRIVATE state of one authenticated
+boundary service. `ace-hitl serve` owns the store and speaks a bounded
+JSON protocol over a UNIX socket; every client operation
+(`ask`/`deliver`/`consume`/`cancel`/`pending`/`states`/`duty`/`read`)
+runs through the authenticated boundary client — the CLI never touches
+shared store files directly.
+
+Identity is a kernel fact: the service resolves each connection's peer
+uid from the OS (`getpeereid`), and payload fields or environment
+variables can never name a requester. Clients authenticate the
+endpoint back: the socket must be owned by the trusted service uid,
+must not be world-writable, and the connected peer must BE the service
+uid. Authorization facts (service uid, transport uids, per-project
+Captain visibility) come only from the trusted deployment grants
+document — the same file and traversal trust rules as ace-lab
+(default `ACE_HITL_GRANTS_PATH`, `/etc/lab/ace-lab/authorization.yml`).
+
+```bash
+# Deployment (root runs the service under its own account):
+ace-hitl serve                      # ACE_HITL_SOCKET, ACE_HITL_STORE_ROOT,
+                                    # ACE_HITL_GRANTS_PATH override paths
+```
+
+Store layout (all service-owned): `0711` traverse-only root;
+`requests/ answers/ secrets/ effects/ locks/ terminals/` are `0700`;
+`public/` is `0755` with `0440` non-secret projections. There is no
+chmod-to-world-writable mode: requesters receive answer bytes over the
+authenticated connection, never through file ownership.
+
+Roles:
+
+- requester: create, consume and cancel its OWN requests (request
+  facts come back from `ask`/`consume`; the boundary `read` protocol
+  operation is available to library clients);
+- configured transport (grants `hitl.transport_uids` + principals):
+  `deliver`, `pending`, `states`, `duty`;
+- unknown identity is an error, never permission.
+
+Failures are classified end to end: `PermissionError`,
+`BindingError`, `StateError`, `AnswerError`, and `TransportError`
+(unavailable/untrusted boundary, deadline, malformed frame) — transport
+failures are visible and recoverable, and duplicate consume/cancel are
+idempotent (the committed receipt replays; a conflicting transition is
+an error).
+
 ## Relay Lifecycle (Generic HITL Request Store)
 
 The generic relay request lifecycle is native to the gem
-(`Ace::Hitl::Lifecycle`; migration spec 8wm.t.y21). Requests are
-file-backed, never expire on a timer, and every terminal transition
-shares one per-request lock. The store root is `ACE_HITL_STORE_ROOT`
-(default `/run/lab/hitl`); the Overseer channel root is
-`ACE_HITL_OVERSEER_CHANNEL_ROOT` (default `/lab/state/overseer-channel`).
-Machine output is one JSON line.
+(`Ace::Hitl::Lifecycle`; migration spec 8wm.t.y21, scoped by
+8wq.t.34i). Requests never expire on a timer, every terminal
+transition shares one stable per-request lock, and the store root is
+`ACE_HITL_STORE_ROOT` (default `/run/lab/hitl`); the Overseer channel
+root is `ACE_HITL_OVERSEER_CHANNEL_ROOT` (default
+`/lab/state/overseer-channel`). Machine output is one JSON line.
+
+Managed binding (the default authority):
+
+```bash
+ace-hitl ask "Choose the next scope" \
+  --assignment 8x3abc --attempt a1b2c3 --project ace
+```
+
+The request binds to the exact ACTIVE MANAGED attempt of the calling
+identity, verified through the ace-assign coordinator under the
+assignment exclusion: a stale, ended, replaced, or uncertain attempt
+cannot acquire authority, and the exclusion is HELD across every
+consume/deliver transition so an attempt cannot end between the
+liveness check and the commit. `--work W... --attempt A-...` remains
+the legacy binding until the provider=lab integration (vs2) switches
+consumers; the two authorities are mutually exclusive and
+`--attempt` is always required (environment variables are never
+attempt identity).
 
-Operator/broker side (host-broker operations are root-only):
+Transport side:
 
 ```bash
 ace-hitl pending                    # answerable requests
@@ -163,15 +228,16 @@ ace-hitl duty                       # pending + escalated projection
 ace-hitl deliver hitl-0a1b2c3d4e5f6708 <<< "approved"
 ```
 
-`deliver` reads the answer from stdin, relays it unchanged (0400,
-owner = requester) into `secrets/` for OTP kinds or `answers/` for
-everything else, re-verifies attempt liveness under the request lock,
-and then executes the declared effect callback AS THE REQUESTER:
+`deliver` reads the answer from stdin and relays it unchanged. OTP
+bytes go to the service's memory vault; plain answers to the
+service-owned `0600` answers file. Liveness is re-verified under the
+lock, and the declared effect callback (non-OTP kinds only) executes:
 exec-style argv (never a shell), `{answer}` substituted once per
 element, optional fullmatch regex gate, bounded timeout, attempts
-logged redacted in the root-only effects log, and one deduped
-escalation with `effect_state: callback-escalated` in the public
-projection on failure (`callback-ok` on success).
+logged redacted in the effects log, and one deduped escalation with
+`effect_state: callback-escalated` in the public projection on failure
+(`callback-ok` on success). Duplicate deliveries are idempotent: the
+committed answer is reported without re-running any effect.
 
 Requester side:
 
@@ -182,9 +248,12 @@ ace-hitl cancel hitl-0a1b2c3d4e5f6708 --reason "operator stopped the work"
 ```
 
 A consume timeout bounds ONLY the local wait — the request stays
-pending and answerable. Cancel is the ONLY way to abandon a request;
+pending and answerable. OTP consumption requires the challenge's
+authorized operation (`--operation <name>`); the secret transfers
+exactly once and a consumed retry replays the receipt WITHOUT the
+bytes. Cancel is the ONLY way to abandon a request, requester-only;
 it records `cancelled_by` and the `reason` in the public projection,
-and a late answer fails closed.
+and late answers/consumes fail closed against the committed receipt.
 
 Overseer reverse address (bounded, type-tagged responses):
 

data/lib/ace/hitl/cli/commands/ask.rb

@@ -18,8 +18,16 @@ module Ace
 
           option :title, type: :string, desc: "Local HITL event title (defaults to the question)"
           option :provider, type: :string, desc: "HITL provider adapter (default: ACE_HITL_PROVIDER or lab)"
-          option :work, type: :string, desc: "Lab Work id (W...)"
-          option :attempt, type: :string, desc: "Lab Attempt id (A-...); defaults to LAB_ATTEMPT_ID"
+          # Managed binding (spec 8wq.t.34i): the request binds to the
+          # exact active managed attempt of the calling identity.
+          option :assignment, type: :string, desc: "Managed assignment id (compact id)"
+          option :kind, type: :string, desc: "Request kind (default: text; otp requires the challenge evidence)"
+          option :"otp-operation", type: :string, desc: "OTP challenge: the ONE authorized operation name"
+          option :"otp-result-ref", type: :string, desc: "OTP challenge: OTP-required publisher result reference"
+          option :"otp-input-digest", type: :string, desc: "OTP challenge: sha256 input digest of the authorized input"
+          option :"otp-expires-at", type: :string, desc: "OTP challenge: expiry as unix seconds (<= 24h ahead)"
+          option :work, type: :string, desc: "Lab Work id (W...) - legacy binding until vs2 switches consumers"
+          option :attempt, type: :string, desc: "Attempt id of the exact active attempt"
           option :project, type: :string, desc: "Lab project label (default: ace)"
           option :harness, type: :string, desc: "Lab harness label (default: lab-admin)"
           option :plan, type: :string, desc: "Lab plan label (default: ace-hitl ask)"
@@ -37,8 +45,9 @@ module Ace
             effect = build_effect(options)
             validate_effect!(effect)
 
-            work = require_work!(options)
+            work, assignment = require_binding!(options)
             attempt = require_attempt!(options)
+            otp = build_otp_challenge!(options)
             provider = resolve_provider(options[:provider])
             ref = capture_ref
 
@@ -47,7 +56,10 @@ module Ace
               title: options[:title],
               ref: ref,
               work: work,
+              assignment: assignment,
               attempt: attempt,
+              kind: options[:kind] || "text",
+              otp: otp,
               project: options[:project] || Providers::Lab::DEFAULT_PROJECT,
               harness: options[:harness] || Providers::Lab::DEFAULT_HARNESS,
               plan: options[:plan] || Providers::Lab::DEFAULT_PLAN,
@@ -78,17 +90,48 @@ module Ace
             raise_cli_error(e.message)
           end
 
-          def require_work!(options)
+          # The binding is authority: exactly one of the managed
+          # assignment binding or the legacy Work binding. An
+          # environment variable never supplies attempt identity
+          # (spec 8wq.t.34i).
+          def require_binding!(options)
             work = options[:work]
-            raise_cli_error("--work required (Lab Work id, e.g. W685)") if work.nil? || work.strip.empty?
+            assignment = options[:assignment]
+            if work && assignment
+              raise_cli_error("--assignment and --work are mutually exclusive binding authorities")
+            end
+            if work.nil? && assignment.nil?
+              raise_cli_error("--assignment required (managed binding), or --work for the legacy Work binding")
+            end
+            return [work, nil] unless work.nil?
+
+            [nil, assignment]
+          end
 
-            work
+          # The OTP challenge evidence is non-secret, structurally
+          # validated store-side; the CLI only assembles it (spec
+          # 8wq.t.34i: no publisher result, no OTP request).
+          def build_otp_challenge!(options)
+            kind = options[:kind] || "text"
+            return nil unless kind == "otp"
+
+            operation = options[:"otp-operation"]
+            result_ref = options[:"otp-result-ref"]
+            input_digest = options[:"otp-input-digest"]
+            expires_at = options[:"otp-expires-at"]
+            missing = %w[--otp-operation --otp-result-ref --otp-input-digest --otp-expires-at]
+              .zip([operation, result_ref, input_digest, expires_at])
+              .select { |_flag, value| value.nil? || value.to_s.strip.empty? }
+              .map(&:first)
+            raise_cli_error("OTP requests require #{missing.join(", ")} (the OTP-required publisher evidence)") unless missing.empty?
+
+            {operation: operation, result_ref: result_ref, input_digest: input_digest, expires_at: expires_at}
           end
 
           def require_attempt!(options)
-            attempt = options[:attempt] || ENV["LAB_ATTEMPT_ID"]
+            attempt = options[:attempt]
             unless attempt && !attempt.strip.empty?
-              raise_cli_error("--attempt required (or set LAB_ATTEMPT_ID)")
+              raise_cli_error("--attempt required (the exact active attempt id)")
             end
 
             attempt

data/lib/ace/hitl/cli/commands/cancel.rb

@@ -23,8 +23,8 @@ module Ace
           option :quiet, type: :boolean, aliases: %w[-q], desc: "Suppress non-essential output"
 
           def call(id:, **options)
-            emit(lifecycle_store.cancel(id, reason: options[:reason] || ""))
-          rescue Lifecycle::Error => e
+            emit(lifecycle_client.cancel(id, reason: options[:reason] || ""))
+          rescue Lifecycle::Error, Providers::ProviderUnavailableError => e
             raise_lifecycle_error(e.message)
           end
         end

data/lib/ace/hitl/cli/commands/consume.rb

@@ -9,7 +9,9 @@ module Ace
       module Commands
         # Requester-side answer consumption. A positive timeout bounds
         # ONLY the local wait and never cancels the request (W651);
-        # without it the wait is indefinite (spec 8wm.t.y21 §3).
+        # without it the wait is indefinite (spec 8wm.t.y21 §3). OTP
+        # answers require the challenge's authorized operation
+        # (spec 8wq.t.34i).
         class Consume < Ace::Support::Cli::Command
           include Ace::Support::Cli::Base
           include LifecycleCommand
@@ -19,12 +21,13 @@ module Ace
           argument :id, required: true, desc: "HITL relay request id"
 
           option :timeout, type: :integer, desc: "Local wait bound in seconds; 0 (default) waits indefinitely"
+          option :operation, type: :string, desc: "Authorized operation (required for OTP challenges)"
 
           option :quiet, type: :boolean, aliases: %w[-q], desc: "Suppress non-essential output"
 
           def call(id:, **options)
-            emit(lifecycle_store.consume(id, timeout: options[:timeout] || 0))
-          rescue Lifecycle::Error => e
+            emit(lifecycle_client.consume(id, timeout: options[:timeout] || 0, operation: options[:operation]))
+          rescue Lifecycle::Error, Providers::ProviderUnavailableError => e
             raise_lifecycle_error(e.message)
           end
         end

data/lib/ace/hitl/cli/commands/deliver.rb

@@ -21,8 +21,9 @@ module Ace
           option :quiet, type: :boolean, aliases: %w[-q], desc: "Suppress non-essential output"
 
           def call(id:, **options)
-            emit(lifecycle_store.deliver(id, LifecycleCommand::STDIN_READER))
-          rescue Lifecycle::Error => e
+            answer = $stdin.read(Lifecycle::Store::MAX_ANSWER_BYTES + 1).to_s
+            emit(lifecycle_client.deliver(id, answer))
+          rescue Lifecycle::Error, Providers::ProviderUnavailableError => e
             raise_lifecycle_error(e.message)
           end
         end

data/lib/ace/hitl/cli/commands/duty.rb

@@ -13,13 +13,13 @@ module Ace
           include Ace::Support::Cli::Base
           include LifecycleCommand
 
-          desc "Project pending and escalated HITL requests (host-broker operation)"
+          desc "Project pending and escalated HITL requests (transport operation)"
 
           option :quiet, type: :boolean, aliases: %w[-q], desc: "Suppress non-essential output"
 
           def call(**options)
-            emit(Lifecycle::Duty.project(lifecycle_store))
-          rescue Lifecycle::Error => e
+            emit(Lifecycle::Duty.project(pending: lifecycle_client.pending, states: lifecycle_client.states))
+          rescue Lifecycle::Error, Providers::ProviderUnavailableError => e
             raise_lifecycle_error(e.message)
           end
         end

data/lib/ace/hitl/cli/commands/lifecycle_command.rb

@@ -6,15 +6,17 @@ module Ace
   module Hitl
     module CLI
       module Commands
-        # Shared plumbing for the operator/broker lifecycle commands
-        # (spec 8wm.t.y21 §8): the store is built through the provider=lab
-        # seam and machine outputs are one JSON line, byte-compatible
-        # with the migrated CLI contract.
+        # Shared plumbing for the lifecycle commands (spec 8wm.t.y21 §8,
+        # scoped by 8wq.t.34i): every lifecycle operation reaches the
+        # store through the AUTHENTICATED BOUNDARY CLIENT — direct
+        # shared-store access is not a CLI option — and machine outputs
+        # are one JSON line, byte-compatible with the migrated CLI
+        # contract.
         module LifecycleCommand
           STDIN_READER = ->(limit) { $stdin.read(limit) }.freeze
 
-          def lifecycle_store(store: nil)
-            Providers::Lab.lifecycle_store(store: store)
+          def lifecycle_client
+            Providers::Lab.boundary_client
           end
 
           def overseer

data/lib/ace/hitl/cli/commands/pending.rb

@@ -13,13 +13,13 @@ module Ace
           include Ace::Support::Cli::Base
           include LifecycleCommand
 
-          desc "List answerable HITL relay requests (host-broker operation)"
+          desc "List answerable HITL relay requests (transport operation)"
 
           option :quiet, type: :boolean, aliases: %w[-q], desc: "Suppress non-essential output"
 
           def call(**options)
-            emit(lifecycle_store.pending)
-          rescue Lifecycle::Error => e
+            emit(lifecycle_client.pending)
+          rescue Lifecycle::Error, Providers::ProviderUnavailableError => e
             raise_lifecycle_error(e.message)
           end
         end

data/lib/ace/hitl/cli/commands/serve.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "ace/support/cli"
+require_relative "../../lifecycle"
+require_relative "../../providers/providers"
+
+module Ace
+  module Hitl
+    module CLI
+      module Commands
+        # The installed scoped store boundary (spec 8wq.t.34i): serves
+        # the private HITL store over a peer-authenticated UNIX socket.
+        # Authorization facts come only from the trusted grants
+        # document; the store root and socket paths come from the
+        # deployment (options/environment), never from caller payloads.
+        class Serve < Ace::Support::Cli::Command
+          include Ace::Support::Cli::Base
+
+          desc "Run the authenticated HITL store boundary service (peer-credential access)"
+
+          option :socket, type: :string, desc: "Boundary socket path (default: ACE_HITL_SOCKET or /run/lab/hitl.sock)"
+          option :store_root, type: :string, desc: "Private store root (default: ACE_HITL_STORE_ROOT or /run/lab/hitl)"
+          option :grants_path, type: :string, desc: "Trusted grants document (default: ACE_HITL_GRANTS_PATH or /etc/lab/ace-lab/authorization.yml)"
+          option :repo_root, type: :string, desc: "Candidate repository for the managed attempt authority"
+
+          option :quiet, type: :boolean, aliases: %w[-q], desc: "Suppress non-essential output"
+          option :verbose, type: :boolean, aliases: %w[-v], desc: "Show verbose output"
+
+          def call(**options)
+            policy = Providers::Lab.grants_policy(grants_path: grants_path(options))
+            unless policy.service_uid
+              raise_cli_error(
+                "the HITL service requires trusted grants with hitl.service_uid " \
+                "(#{grants_path(options)}); serving without a trusted service identity would " \
+                "fail every client endpoint verification"
+              )
+            end
+            binding_policy = Providers::Lab::CompositeBinding.new(
+              assignment: Providers::Lab.assignment_binding(repo_root: options[:repo_root]),
+              work: Providers::Lab::DaemonBinding.new
+            )
+            service = Lifecycle::Service.new(
+              root: store_root(options),
+              binding: binding_policy,
+              policy: policy,
+              socket_path: socket_path(options),
+              logger: options[:verbose] ? ->(message) { warn message } : nil
+            )
+            service.run
+          rescue Lifecycle::Error, Providers::ProviderUnavailableError => e
+            raise_cli_error(e.message)
+          end
+
+          private
+
+          def socket_path(options)
+            options[:socket] || ENV[Providers::Lab::SOCKET_PATH_ENV] || Providers::Lab::DEFAULT_SOCKET_PATH
+          end
+
+          def store_root(options)
+            options[:store_root] || ENV[Providers::Lab::STORE_ROOT_ENV] || Providers::Lab::DEFAULT_STORE_ROOT
+          end
+
+          def grants_path(options)
+            options[:grants_path] || ENV[Providers::Lab::GRANTS_PATH_ENV] || Providers::Lab::DEFAULT_GRANTS_PATH
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/hitl/cli/commands/states.rb

@@ -12,13 +12,13 @@ module Ace
           include Ace::Support::Cli::Base
           include LifecycleCommand
 
-          desc "List public HITL lifecycle projections (host-broker operation)"
+          desc "List public HITL lifecycle projections (transport operation)"
 
           option :quiet, type: :boolean, aliases: %w[-q], desc: "Suppress non-essential output"
 
           def call(**options)
-            emit(lifecycle_store.states)
-          rescue Lifecycle::Error => e
+            emit(lifecycle_client.states)
+          rescue Lifecycle::Error, Providers::ProviderUnavailableError => e
             raise_lifecycle_error(e.message)
           end
         end

data/lib/ace/hitl/cli.rb

@@ -14,6 +14,7 @@ require_relative "cli/commands/cancel"
 require_relative "cli/commands/pending"
 require_relative "cli/commands/states"
 require_relative "cli/commands/duty"
+require_relative "cli/commands/serve"
 require_relative "cli/commands/overseer_send"
 require_relative "cli/commands/overseer_pending"
 require_relative "cli/commands/overseer_ack"
@@ -35,9 +36,9 @@ module Ace
         ["deliver", "Deliver an answer (stdin) to a pending HITL relay request"],
         ["consume", "Wait for and consume the answer of one own HITL relay request"],
         ["cancel", "Cancel one HITL relay request with an audited reason"],
-        ["pending", "List answerable HITL relay requests (host-broker)"],
-        ["states", "List public HITL lifecycle projections (host-broker)"],
-        ["duty", "Project pending and escalated HITL requests (host-broker)"],
+        ["pending", "List answerable HITL relay requests (transport)"],
+        ["states", "List public HITL lifecycle projections (transport)"],
+        ["duty", "Project pending and escalated HITL requests (transport)"],
         ["overseer-send", "Queue a bounded, type-tagged Overseer response (stdin)"],
         ["overseer-pending", "List queued Overseer responses (host-broker)"],
         ["overseer-ack", "Acknowledge one relayed Overseer response"]
@@ -64,6 +65,7 @@ module Ace
       register "pending", CLI::Commands::Pending
       register "states", CLI::Commands::States
       register "duty", CLI::Commands::Duty
+      register "serve", CLI::Commands::Serve
       register "overseer-send", CLI::Commands::OverseerSend
       register "overseer-pending", CLI::Commands::OverseerPending
       register "overseer-ack", CLI::Commands::OverseerAck

data/lib/ace/hitl/lifecycle/binding.rb

@@ -12,7 +12,7 @@ module Ace
       class Binding
         # Validate a request creation against the requester's exact live
         # attempt. Raises BindingError on any violation or unavailability.
-        def validate_request(work:, attempt:, project:, requester:)
+        def validate_request(work: nil, assignment: nil, attempt:, project:, requester:)
           raise NotImplementedError
         end
 
@@ -21,6 +21,17 @@ module Ace
         def require_active(work:, attempt:)
           raise NotImplementedError
         end
+
+        # Hold verified live authority across ONE whole transition: the
+        # check and the caller's locked commit happen inside the same
+        # exclusion, so a concurrent attempt termination cannot land
+        # between them (spec 8wq.t.34i). The yielded value is opaque.
+        # Implementations without a holdable exclusion verify and yield
+        # (the legacy gap); the assignment authority holds its lock.
+        def with_active(work: nil, assignment: nil, attempt:, project: nil, requester: nil)
+          require_active(work: work, attempt: attempt)
+          yield
+        end
       end
     end
   end