ace-hitl 0.11.1 → 0.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2529e6b24197617c3554da5d1ff7348b19681769562259b05f6d88f469527cf1
-  data.tar.gz: 76b205cac4da0c4d7a34f391ebf569b8c997af87d47edf8b607d602727f82582
+  metadata.gz: 2e0e3e52b0322d7e5b585bf30728ebaae32337e06b4a8be12e96dcba1c0d498b
+  data.tar.gz: 4b79e7e2d5efd486c794be95cf515d147b17f322227d3cd6d6583382f3e6fb7e
 SHA512:
-  metadata.gz: 977f6398c3f1e6a10e198c267c9b65af6f6d3ff0a2e668c3e80e4a0ad79a0fc332b9f03081fd0f4bfcd7f995a8c6b3458d5afc1bb39063dafaa4516f2b51d04c
-  data.tar.gz: be81c083da2b5af0a5c97646b621ec2b71a6950025e0da4a608c25a2d28142ec67bba8dab032ccf06c004c3021d1e3d660a2c384a58f4925f4b4690895ea53cb
+  metadata.gz: a7abb0c60530c467efbb7a2b99d514e23a716bd61fce8d67c65966d629bb70969785043d63dd36e60eabd1d708d7d850b58eca6b31e5135c071e2791147c3bd7
+  data.tar.gz: 339b0dee9be68ff3ef82b4de954e6642a58b4ccdf8cad109524b66991423f39f543a59f75e8e957c1be23e263975a3448009a3558aa3e622415059d14ad036bd

data/CHANGELOG.md

@@ -7,6 +7,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.13.0] - 2026-10-08
+
+### Added
+
+- Bind scoped publication to the original canonical HITL challenge and authorization; keep OTP material out of agent messages and ordinary transport.
+
+### Changed
+
+- Read delivery history from the original Inbox owner. Complete human attention on terminal submission without requiring an agent-read receipt or querying recovery caches.
+
+### Fixed
+
+- Route proposals through the retained project journal and preserve exact protected attempt identity across lifecycle calls.
+- Exercise concurrent creation under the actual lifecycle lock.
+
+### Fixed
+
+- Accept exact protected launch attempt identifiers for HITL requests while preserving assignment syntax and authoritative binding checks.
+
+## [0.12.0] - 2026-10-05
+
+### Added
+
+- Add an opt-in installed proposal scenario with an isolated local gem closure, real Unix and tmux owner binding, controlled sixteen-hour restart, technical refusal, and one verified service effect/receipt.
+- Resolve immutable second-commander proposals through confirmed-delivery sixteen-hour policy and canonical Assign authorization.
+
+### Changed
+
+- Declare the required direct dependencies and minimum producer versions for this coordinated release: `ace-assign ~> 0.64`, `ace-herdr ~> 0.4`, `ace-hitl-contract ~> 0.2`.
+
+- Replace daemon/Work bindings with the managed assignment envelope and kernel-attributed exact native reverse owner. Add explicit in-process delivery/watch, authenticated pane-less wait, visible pending recovery, and existing signed Inbox reconciliation; keep native transport and business effect receipts separate.
+
+### Fixed
+
+- Recover revision operations by explicit source revision and stable operation identity without resetting delivery; require current project authority for proposal reads, refuse generic proposal creation, and preserve ordinary question character limits.
+
+- Recover stable-ID proposal creation from canonical prepared requests, retain exact reply deduplication across retry ordering, and queue proposer reconciliation wakes for the existing transport actor.
+- Bound pending IPC pages by encoded frame size while retaining all native recovery claims and project authorization; Ruby callers traverse keyset pages.
+- Preserve the accepted native incarnation through answer consumption and require explicit signed-supersession retry before another submission.
+
 ## [0.11.1] - 2026-10-04
 
 ### Fixed

data/README.md

@@ -10,7 +10,7 @@ Canonical workflow and skill for agents:
 ## Commands
 
 - `ace-hitl create` creates a HITL event
-- `ace-hitl ask` asks a human via HITL and forwards the request through a provider adapter (`--provider`, default `lab`); ONE operation: local event + relay request through the authenticated boundary (`--assignment/--attempt/--project` managed binding, `--work` legacy, effect callback flags)
+- `ace-hitl ask` asks a human via HITL and forwards the request through a provider adapter (`--provider`, default `lab`); ONE operation: local event + relay request through the authenticated boundary (`--assignment/--attempt/--project` managed binding, effect callback flags)
 - `ace-hitl list` lists HITL events with filters (`--scope current|all`, all statuses by default)
 - `ace-hitl show` renders event details, path, or raw content (`--scope current|all`)
 - `ace-hitl update` updates frontmatter, answer content, and folder location
@@ -37,29 +37,23 @@ Use `ace-overseer status` for a global worktree dashboard.
 
 ## Provider adapters
 
-`ace-hitl ask` dispatches through the `Ace::Hitl::Providers` registry
-(selection: `--provider` flag → `ACE_HITL_PROVIDER` env → `lab`).
-
-- `ask` is ONE operation: it creates the local HITL event and the relay
-  request through the NATIVE generic lifecycle store
-  (`Ace::Hitl::Lifecycle`; migration spec 8wm.t.y21), then persists
-  `provider`, `ref_schema`, `ref_session`, `ref_pane` plus the existing
-  `lab_request_*` fields.
-- The asker's reverse address (`ref`, versioned schema
-  `ace.hitl.ref/v1`: herdr session + pane) is captured fail-closed from
-  `HERDR_SESSION` / `HERDR_PANE`; absent or invalid values abort the ask
-  before any event is created or store state changes.
-- Error model: `UnknownProviderError`, `InvalidRefError`,
-  `ProviderUnavailableError` (store-create failure; surfaces the orphan
-  event id when one was already created), `UnsupportedOperationError`.
-- `deliver(ref, answer)` (push the answer back to the asker's pane) is
-  declared by the interface; provider `lab` raises
-  `UnsupportedOperationError` until the ace-herdr push-delivery
-  integration lands. `ace-hitl wait` stays the pane-less script path and
-  does not go through a provider.
-- The generic lifecycle is provider-agnostic; all lab coupling lives in
-  the provider=lab seams (the `Providers::Lab::DaemonBinding` labd
-  binding client and the store factory), enforced by guard tests.
+`ace-hitl ask --question ... --assignment ... --attempt ...` creates a scoped
+request through authenticated IPC. The managed coordinator verifies the exact
+active native owner and reverse address; caller environment variables cannot
+supply authority. No Lab daemon or Work binding is used.
+
+`Ace::Hitl::LiveClient` provides explicit in-process `deliver`, `watch`, `wait`,
+`status`, `pending`, and signed `reconcile`. `watch` returns a thread owned by
+its calling agent. Native delivery commits an incarnation-bound event through
+Herdr Inbox and registers it through Assign. Queue acceptance and wake do not
+prove consumption. Only an event-bound signed native observation verified by
+Herdr and journaled by Assign completes delivery. Business callbacks have
+separate authorization and receipts and are never rerun by native retries.
+
+Pane-less `wait --request ID` consumes an existing authorized request over IPC;
+it neither creates a native target nor proves a business effect. OTP answers
+use that protected path with their authorized operation; no OTP bytes or OTP
+hash enter the shared envelope, folder or native inbox.
 
 ## Examples
 
@@ -67,8 +61,8 @@ Use `ace-overseer status` for a global worktree dashboard.
 ace-hitl list
 ace-hitl list --scope all
 ace-hitl create "Which auth strategy?" --kind decision --question "JWT or sessions?"
-ace-hitl ask "Proceed with deploy?" --work W685 --effect-arg /bin/false --effect-cwd /tmp
-ace-hitl ask "Proceed with deploy?" --provider lab --work W685
+ace-hitl ask --question "Proceed with deploy?" --assignment assign685 --attempt attempt685 --effect-arg /bin/false --effect-cwd /tmp
+ace-hitl ask --question "Proceed with deploy?" --provider lab --assignment assign685 --attempt attempt685
 ace-hitl show abc123 --content
 ace-hitl show abc123 --scope current
 ace-hitl update abc123 --answer "Use JWT with server-side refresh tokens."
@@ -78,7 +72,7 @@ ace-hitl update abc123 --answer "Use JWT with server-side refresh tokens." --res
 
 ## Testing
 
-This package is **fast-only** in the ACE testing model.
+This package has deterministic fast and scoped integration tests.
 
 - Deterministic test coverage lives under `test/fast/`.
 - This migration does not introduce `test/feat/` or `test/e2e/` for this package.

data/docs/usage.md

@@ -19,7 +19,7 @@ Runtime store default: `.ace-local/hitl/` (legacy `.ace-hitl/` is no longer used
 
 ## Testing
 
-`ace-hitl` is currently a **fast-only** package in the ACE testing model.
+`ace-hitl` includes isolated fast tests and deterministic scoped integration tests.
 
 - Deterministic coverage lives under `test/fast/`.
 - This package does not introduce `test/feat/` or `test/e2e/` in this migration.
@@ -102,47 +102,52 @@ ace-hitl update abc123 --move-to next
 ace-hitl update abc123 --answer "close the assignment" --resume
 ```
 
-## Ask (Provider adapter with effect callback)
-
-`ace-hitl ask` dispatches through the provider adapter registry
-(`--provider`, default: `ACE_HITL_PROVIDER` env, then `lab`). ONE
-operation: it creates the local HITL event, forwards the question through
-the provider transport bound to the event via `--ace-hitl-id`, and prints
-both ids. Effect declarations are validated client-side (exact bounds)
-and passed through verbatim into the native relay request store.
+## Ask and scoped live client
 
 ```bash
-ace-hitl ask "Proceed with deploy?" \
-  --work W685 \
-  --effect-arg /usr/bin/notify-send "{answer}" \
-  --effect-cwd /tmp
+ace-hitl ask --question "Proceed with deploy?" \
+  --assignment assign685 --attempt attempt685 --project ace \
+  --effect-arg /usr/bin/notify-send --effect-arg "{answer}" --effect-cwd /tmp
+```
+
+Assignment and attempt are required compact managed IDs. The coordinator verifies
+an active owner and its exact native reverse binding, using the kernel peer PID
+and Runtime's existing process ancestry/birth authority. Missing peer PID or
+native evidence refuses an exact-owner claim. Darwin uses LOCAL_PEERPID; Linux
+uses SO_PEERCRED. UID equality alone never selects another attempt. There is no
+Work binding, Lab daemon socket or environment-derived reverse target.
+
+An agent explicitly hosts its watcher in its own process:
+
+```ruby
+client = Ace::Hitl::LiveClient.new(root: checkout_root)
+watcher = client.watch(request: request_id) { |delivery| handle_queue_result(delivery) }
+watcher.value
+client.status(request: request_id)
 ```
 
-- `--attempt` defaults to `LAB_ATTEMPT_ID`; `--project` to `ace`;
-  `--harness` to `lab-admin`; `--plan` to `ace-hitl ask`.
-- Reverse address (fail closed): the asker's herdr session + pane are
-  read from `HERDR_SESSION` / `HERDR_PANE` and persisted on the event as
-  `ref_session` / `ref_pane` with `ref_schema: ace.hitl.ref/v1` and
-  `provider: lab`. Absent or invalid values abort the ask before any
-  event is created or transport is called — an ask must always know
-  where its answer can be delivered.
-- Effect flags: `--effect-match` (regex, <= 200 chars, must compile),
-  `--effect-arg` (repeatable, 1..16 x 1..512 chars after the lab's
-  strip-then-bounds check; whitespace-only elements fail fast, valid
-  values pass through verbatim; `{answer}` substituted lab-side),
-  `--effect-cwd` (absolute, must exist), `--effect-timeout-s` (1..600).
-- Whether an effect was declared is recorded on the event as
-  `lab_request_effect: declared|none` so `wait` can apply the right
-  terminal semantics.
-- The answer is always relayed unchanged; consumption stays on the
-  operator side via `ace-hitl consume`.
-- If the transport send fails after the local event was created, the
-  error surfaces the event id as an orphan (created but never bound to a
-  relay request); inspect it with `ace-hitl show <id>` and delete or
-  re-ask as needed.
-- `deliver(ref, answer)` — pushing the answer back to the asker's pane —
-  is declared by the adapter interface; provider `lab` reports it as
-  unsupported until the ace-herdr push-delivery integration lands.
+`deliver` consumes an authorized ordinary answer, enqueues one incarnation-bound
+Herdr event, registers its original assignment/attempt attribution with Assign,
+and sends to the exact selected terminal. The accepted owner's terminal, agent
+and native session ID are checked against the live Herdr pane before sending.
+A replaced agent in the same pane refuses rather than selecting another target.
+Repeated calls reuse the same event; uncertain sends are not automatically
+repeated. The configured Hermes transport owns Telegram request/reply routing.
+
+A delivered acknowledgement means submitted to the terminal, not read by the
+agent. LiveClient.status reads delivery history from the original Inbox owner;
+delivered answers no longer appear as pending human attention. Current agent
+progress/output comes from direct Herdr/tmux panel capture when needed.
+
+Business effects still run through their scoped owner with their own result
+and authorization. Neither a sent message nor panel output replaces verification
+of those effects. No dedicated Codex app-server, message-read signer/key or
+signed consumption/supersession reconciliation API is required.
+
+The shared versioned envelope is semantically owned by HITL and packaged in
+`ace-hitl-contract` to preserve the acyclic HITL → Assign → Herdr → contract
+graph. Its nested Hermes message and reverse reference are distinct schemas.
+OTP answers and their hashes are excluded from the envelope and native delivery.
 
 ## Scoped Store Boundary (spec 8wq.t.34i)
 
@@ -204,7 +209,7 @@ root is `ACE_HITL_OVERSEER_CHANNEL_ROOT` (default
 Managed binding (the default authority):
 
 ```bash
-ace-hitl ask "Choose the next scope" \
+ace-hitl ask --question "Choose the next scope" \
   --assignment 8x3abc --attempt a1b2c3 --project ace
 ```
 
@@ -213,11 +218,8 @@ identity, verified through the ace-assign coordinator under the
 assignment exclusion: a stale, ended, replaced, or uncertain attempt
 cannot acquire authority, and the exclusion is HELD across every
 consume/deliver transition so an attempt cannot end between the
-liveness check and the commit. `--work W... --attempt A-...` remains
-the legacy binding until the provider=lab integration (vs2) switches
-consumers; the two authorities are mutually exclusive and
-`--attempt` is always required (environment variables are never
-attempt identity).
+liveness check and the commit. Assignment and attempt identity are always explicit;
+there is no legacy Work-only contract.
 
 Transport side:
 
@@ -285,25 +287,24 @@ ace-hitl wait abc123 --poll-every 600 --timeout 14400
 ace-hitl wait abc123 --scope current
 ```
 
-When the event carries a Lab request (`lab_request_id`), wait also observes
-the Lab public projection instead of hanging blind. Both projection fields
-are observed: the lifecycle `state` (created / answer-delivered / consumed /
-cancelled) and the separate `effect_state` (callback-pending-with-answer /
-callback-ok / callback-escalated). Terminal semantics are effect-aware:
-
-- Requests without a declared effect terminate on lifecycle states
-  (`answer-delivered`, `consumed`, `cancelled`).
-- Effect-declaring requests keep waiting until the callback verdict
-  (`callback-ok` or `callback-escalated`) appears — they never end
-  silently at answer delivery; `callback-escalated` output points at
-  the lab duty projection for the escalation.
-- The event's `lab_request_state` records the effective state, so it
-  never claims plain `answer-delivered` while an effect outcome exists.
-
-Relay consumption stays on the operator side via `ace-hitl consume`.
-`wait` is the pane-less script path: agents with a herdr pane ask
-through the provider adapter and receive answers delivered back to
-their pane.
+Managed event waits resolve `lab_request_id` and consume through authenticated
+IPC. They never read folder projections or persist returned answers into the
+local event. Explicit pane-less scripts can wait without any local event:
+
+```bash
+ace-hitl wait --request hitl001 --timeout 30
+ace-hitl wait --request otp001 --operation gem-push
+```
+
+The default managed wait is indefinite; a positive timeout bounds only this
+call. It never expires the request. OTP consumption requires the authorized
+operation and returns its bytes only over protected IPC. Local event polling
+remains available for ordinary unbound local events. Managed events cannot use
+`update --resume` to launch unscoped session/shell delivery.
+
+Installed acceptance uses actual registered Telegram ingress, the selected
+live Herdr/tmux terminal and the real scoped users in Lab. Controlled local
+transport tests do not replace launching and observing the actual task.
 
 ## Lifecycle Event Names
 
@@ -317,3 +318,151 @@ Canonical namespace for HITL lifecycle signaling:
 - `hitl.event.resume_skipped_waiter_active`
 - `hitl.event.resume_failed`
 - `hitl.event.archived`
+
+## Pending recovery history across bounded IPC pages
+
+`ace-hitl pending --project ace` continues to show unresolved native delivery
+claims even after their answers have been consumed. A large retained history
+must not prevent newly created questions from reaching Telegram.
+
+The lifecycle wire `pending` operation returns `{items, next}`. `next` is an
+exclusive request-ID cursor; send it as `after` with the same project for the
+next page. Each response, including framing, fits the IPC byte limit. Every
+page rechecks transport/project authorization. `Lifecycle::Client#pending`
+collects the pages for existing Ruby/CLI callers; `pending_page(project:, after:)`
+exposes a single bounded page. `read(id)` remains available for exact recovery.
+No consumed claim is deleted to make the list fit. A record too large for one
+page produces a classified error, never a successful truncated list.
+
+This is a live keyset scan, not a frozen snapshot: a newly inserted ID before
+the current cursor appears on the next scan. Repeated polling therefore remains
+required; a cursor is not proof of delivery or native consumption.
+
+## Immutable second-commander proposals
+
+`ace-hitl proposal create proposal-0123456789abcdef01234567 --assignment ID --attempt ID --project ID --file proposal.json`
+returns persisted immutable proposal/revision/request IDs and current awaiting-delivery state immediately, even with unavailable transport. delivered_at and deadline are absent until acknowledged submission; show exposes them afterward. The sole Hermes
+polling actor publishes the full precise proposal and records confirmed submission before
+HITL persists delivered_at and a deadline exactly sixteen hours later. Failed or uncertain
+submission cannot arm the window. A Telegram Reply `approve [rationale]`, `veto [rationale]`
+or `clarify [rationale]` applies only to the correlated immutable revision; other replies
+stop automatic approval and require revision. Missing rationale remains absent.
+
+The JSON proposal requires operation, target (`resource` and optional `artifact_digest`),
+candidate_head, input_digest, context, options, recommendation and prerequisites; rationale
+is optional. Contents are bounded and non-secret. Input digest uses the canonical service
+input digest. Candidate head is separate from base head and the evidence journal commit.
+Every precisely presented operation is eligible for sixteen-hour silence, including
+publishing, deployment and access/privilege expansion. Fixed service scope, current head,
+independently executed review/tests, bound running attempt and operation-specific OTP gates
+still apply at execution. Proposal authorization never supplies credentials or runs a callback.
+
+All proposal reads, revisions and transport acknowledgements/replies carry an explicit project.
+The authority selects that project's canonical Assign journal; a proposal ID does not select a journal.
+The managed request's existing project supplies this selector for ordinary `read`; Hermes uses the
+accepted envelope's project for acknowledgement, reply and reconciliation. Missing selectors are
+rejected, and an ID from another project's journal cannot be read or changed through the selected project.
+
+`ace-hitl proposal show ID --project PROJECT --format json` shows decision, deadline, actual Assign claim/outcome
+and a bounded history page; continue with `--history-after HISTORY_NEXT`.
+`ace-hitl proposal history --project ID --query TEXT` retrieves relevant prior decisions;
+continue with `--after NEXT`. Current project grants and exact requester identity gate history and show; losing project access refuses reads and excludes history, including lifecycle proposal request reads.
+`ace-hitl proposal revise ID --project PROJECT --expected-revision N --operation-id revision-abcdef0123456789abcdef01 --file changed.json` supersedes the prior decision and creates a
+new request with a fresh full window after acknowledgement. An unresolved claimed effect
+must be reconciled before revision; known successful or proven no-effect settlement can be
+followed by a new revision. Persist the proposal ID, expected source revision, stable revision operation ID and exact file before invocation. The operation ID is `revision-` followed by 24 lowercase hex digits and is unique across proposals. Exact retry returns that committed revision, including after acknowledged delivery, approval or a later revision, without creating another request or resetting the window. Changed proposal/source/content/caller bindings and stale-source new operations are refused. Supersession and new prepared revision commit atomically against effect claims. Generic lifecycle `create` rejects proposal kind; use this canonical proposal interface.
+
+Set ACE_HITL_SOCKET and ACE_HITL_PROJECT for the living overseer. It calls
+`ace-hitl proposal resolve-due --project PROJECT` on start/status/watch ticks.
+The authenticated proposer queues an idempotent reconciliation wake in the
+canonical Assign proposal; the command returns `queued-for-transport`, never an
+approval claim. The existing installed Hermes `serve` loop polls Telegram under
+its own configured transport UID and reconciles queued deadlines after polling.
+No proposer subprocess opens transport configuration or impersonates transport.
+Hermes holds its ingress lock across checkpoint and HITL decision transition;
+unknown health/backlog defers resolution. Failed ticks remain visible while
+watch/status continues. Production `--now` is rejected.
+
+Creation requires an explicit stable ID (`proposal-` followed by 24 lowercase
+hex digits). Persist that ID before invocation and retry the exact same ID,
+assignment, attempt, caller and document after failure or a lost reply. Changed
+binding/content is refused. Assign commits the immutable prepared lifecycle
+request first; exact retry or the transport pending scan materializes it after
+restart. No pending lifecycle orphan exists before canonical commit. Concurrent
+materialization creates once and preserves current delivered/answered state.
+
+Unresolved earlier same-request ingress blocks later approval delivery. Exact
+reply sequence/content/time deduplication uses canonical decision history;
+unseen lower sequence is applied, and changed duplicate content is refused.
+History grows in the existing canonical event chain, while public responses use
+bounded pages. Hermes metadata never stores message bodies.
+
+The immutable authorization reference is the revision ID, passed to `ace-lab service request`.
+Assign atomically checks the canonical proposal under its sole journal claim lock/CAS;
+a forged prefix/YAML string or changed operation/target/head/input/caller cannot authorize.
+A late veto before claim denies execution. After claim it records stop_requested without
+rewriting performed effects; the service rechecks it before safely stoppable invocation.
+An uncertain claim remains uncertain on restart and is never automatically dispatched again.
+Canonical sanitized decision history shares the qjl evidence ref; no parallel executor or
+execution ledger exists in HITL. This source workflow is not installed/native/Telegram or
+multi-UID acceptance proof.
+
+### Proposal admission configuration
+
+The protected HITL service reads proposer admission from the same trusted grants
+policy as transport and project authorization. For example:
+
+```yaml
+hitl:
+  service_uid: 1200
+  transport_uids: [1201]
+  proposal_uids: [1202]
+authorization:
+  principals:
+    "1201":
+      projects: [ace]
+    "1202":
+      projects: [ace]
+```
+
+`proposal_uids` admits authenticated kernel peers to create and revise proposals
+only for their configured projects. Transport admission alone cannot create a
+proposal; proposer admission cannot acknowledge delivery, fabricate ingress, or
+resolve silence. Missing role or project admission refuses the operation,
+including direct library calls. This is a source configuration contract;
+installed deployment adoption remains part of gad.8 acceptance.
+
+### Controlled installed proposal verification
+
+From an ACE checkout with Ruby, tmux and the complete dependency archives cached locally:
+
+```bash
+bin/ace-test ace-hitl edge --filter installed_proposal_test --config-path "$PWD/ace-hitl/test/support/installed_proposal/runner.yml"
+```
+
+The explicit fixture configuration activates the installed scenario without changing
+test deadlines. Default package runs skip it. The run builds the current runtime
+gem closure and installs it into an empty GEM_HOME, using local archives only.
+It prints `Installed SC3 artifacts: /tmp/ace-installed-sc3/run-...`; read the
+reported test receipt and that directory's `result.json`, `artifacts.json`,
+`build-provenance.json`, `processes.jsonl` and `canonical-evidence.json`. A manifest/result pointer is
+retained under checkout `.ace-local/installed-sc3/`.
+
+The expected terminal result is one passing test with no failures/errors. Its
+consumer asserts confirmed submission + sixteen hours, actual service/actor
+process restarts, one effective authorization and one executor invocation with
+a canonical verified receipt. Failed submission does not arm a deadline; lost
+poll coverage stays blocked, including after fresh polling. Changed technical
+scope remains refused after approval. No inbox record is manually inserted.
+
+UTC and Telegram are test-only injected adapters. Assignment binding, kernel peer
+authentication, policy, claim, execution and receipt verification remain real.
+The fixture uses one host and the current UID, with an isolated tmux process and
+the existing local service mode. It does not prove live Telegram, protected Herdr
+launch, installed root-owned grants, or multiUID privilege separation. There is
+no production `--now` or transport-override option.
+
+Missing local dependency archives fail visibly without network fallback. A failed
+consumer retains diagnostic artifacts; inspect `result.json` and `service.log`
+before retrying. Each invocation retains a new run directory and requires a new
+empty GEM_HOME.

data/lib/ace/hitl/cli/commands/ask.rb

@@ -14,7 +14,7 @@ module Ace
 
           desc "Ask a human via HITL and forward the request through a provider adapter"
 
-          argument :question, required: true, desc: "Question text for the human"
+          option :question, type: :string, required: true, desc: "Question text for the human"
 
           option :title, type: :string, desc: "Local HITL event title (defaults to the question)"
           option :provider, type: :string, desc: "HITL provider adapter (default: ACE_HITL_PROVIDER or lab)"
@@ -26,7 +26,6 @@ module Ace
           option :"otp-result-ref", type: :string, desc: "OTP challenge: OTP-required publisher result reference"
           option :"otp-input-digest", type: :string, desc: "OTP challenge: sha256 input digest of the authorized input"
           option :"otp-expires-at", type: :string, desc: "OTP challenge: expiry as unix seconds (<= 24h ahead)"
-          option :work, type: :string, desc: "Lab Work id (W...) - legacy binding until vs2 switches consumers"
           option :attempt, type: :string, desc: "Attempt id of the exact active attempt"
           option :project, type: :string, desc: "Lab project label (default: ace)"
           option :harness, type: :string, desc: "Lab harness label (default: lab-admin)"
@@ -45,17 +44,14 @@ module Ace
             effect = build_effect(options)
             validate_effect!(effect)
 
-            work, assignment = require_binding!(options)
+            assignment = require_binding!(options)
             attempt = require_attempt!(options)
             otp = build_otp_challenge!(options)
             provider = resolve_provider(options[:provider])
-            ref = capture_ref
 
             result = provider.ask(
               question: question,
               title: options[:title],
-              ref: ref,
-              work: work,
               assignment: assignment,
               attempt: attempt,
               kind: options[:kind] || "text",
@@ -67,6 +63,7 @@ module Ace
             )
 
             puts "HITL event: #{result.event_id}"
+            ref = result.ref
             puts "Provider: #{Providers::Lab::PROVIDER_NAME} (ref #{ref.session}/#{ref.pane}, #{Providers::Ref::SCHEMA})"
             puts "Lab request: #{result.request_id}"
           rescue Providers::ProviderUnavailableError => e
@@ -90,22 +87,10 @@ module Ace
             raise_cli_error(e.message)
           end
 
-          # The binding is authority: exactly one of the managed
-          # assignment binding or the legacy Work binding. An
-          # environment variable never supplies attempt identity
-          # (spec 8wq.t.34i).
           def require_binding!(options)
-            work = options[:work]
             assignment = options[:assignment]
-            if work && assignment
-              raise_cli_error("--assignment and --work are mutually exclusive binding authorities")
-            end
-            if work.nil? && assignment.nil?
-              raise_cli_error("--assignment required (managed binding), or --work for the legacy Work binding")
-            end
-            return [work, nil] unless work.nil?
-
-            [nil, assignment]
+            raise_cli_error("--assignment required (the managed assignment id)") if assignment.nil? || assignment.strip.empty?
+            assignment
           end
 
           # The OTP challenge evidence is non-secret, structurally
@@ -144,13 +129,6 @@ module Ace
             raise_cli_error(e.message)
           end
 
-          # Fail closed BEFORE any state is created: the reverse address is
-          # required so the answer can be delivered back to this pane.
-          def capture_ref
-            Providers::Ref.from_env
-          rescue Providers::InvalidRefError => e
-            raise_cli_error(e.message)
-          end
         end
       end
     end

data/lib/ace/hitl/cli/commands/pending.rb

@@ -16,9 +16,10 @@ module Ace
           desc "List answerable HITL relay requests (transport operation)"
 
           option :quiet, type: :boolean, aliases: %w[-q], desc: "Suppress non-essential output"
+          option :project, type: :string, desc: "Show requests for one authorized project"
 
           def call(**options)
-            emit(lifecycle_client.pending)
+            emit(LiveClient.new(boundary: lifecycle_client).pending(project: options[:project]))
           rescue Lifecycle::Error, Providers::ProviderUnavailableError => e
             raise_lifecycle_error(e.message)
           end

data/lib/ace/hitl/cli/commands/proposal.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require "ace/support/cli"
+require_relative "lifecycle_command"
+require_relative "../../proposals/evaluator"
+
+module Ace
+  module Hitl
+    module CLI
+      module Commands
+        class Proposal < Ace::Support::Cli::Command
+          include Ace::Support::Cli::Base
+          include LifecycleCommand
+          argument :operation, required: true, desc: "create, show, revise, history or resolve-due"
+          argument :id, required: false, desc: "Exact proposal ID"
+          option :assignment, type: :string
+          option :attempt, type: :string
+          option :project, type: :string
+          option :file, type: :string
+          option :"expected-revision", type: :integer, desc: "Exact source revision for revise"
+          option :"operation-id", type: :string, desc: "Caller-persisted revision- plus 24 lowercase hex digits"
+          option :format, type: :string, default: "json"
+          option :now, type: :string, desc: "Unavailable in production; inject a fixture clock in tests"
+          option :"history-after", type: :integer, desc: "Read the next bounded history page from history_next"
+          option :query, type: :string, desc: "Relevant prior decisions containing this text"
+          option :after, type: :string, desc: "History-list cursor from next"
+
+          def call(operation:, id: nil, **options)
+            raise_lifecycle_error("only --format json is supported") unless options[:format] == "json"
+            raise_lifecycle_error("--now is restricted to injected test fixtures; production uses trusted UTC clock") if options[:now]
+            result = case operation
+            when "create"
+              %i[assignment attempt project].each { |key| raise_lifecycle_error("--#{key} required") if options[key].to_s.empty? }
+              raise_lifecycle_error("stable proposal ID required") if id.to_s.empty?
+              lifecycle_client.proposal_create(id: id, assignment: options[:assignment], attempt: options[:attempt],
+                project: options[:project], document: load_document(options[:file]))
+            when "show"
+              raise_lifecycle_error("proposal ID required") if id.to_s.empty?
+              raise_lifecycle_error("--project required") if options[:project].to_s.empty?
+              lifecycle_client.proposal_show(id, project: options[:project], history_after: options[:"history-after"] || 0)
+            when "revise"
+              raise_lifecycle_error("proposal ID required") if id.to_s.empty?
+              raise_lifecycle_error("--expected-revision required") unless options[:"expected-revision"]
+              raise_lifecycle_error("--operation-id required") if options[:"operation-id"].to_s.empty?
+              raise_lifecycle_error("--project required") if options[:project].to_s.empty?
+              lifecycle_client.proposal_revise(id, project: options[:project], expected_revision: options[:"expected-revision"],
+                operation_id: options[:"operation-id"], document: load_document(options[:file]))
+            when "resolve-due"
+              raise_lifecycle_error("--project required") if options[:project].to_s.empty?
+              Proposals::Evaluator.new(boundary: lifecycle_client, project: options[:project]).call
+            when "history"
+              raise_lifecycle_error("--project required") if options[:project].to_s.empty?
+              lifecycle_client.proposal_history(project: options[:project], query: options[:query] || "", after: options[:after])
+            else raise_lifecycle_error("choose create, show, revise, history or resolve-due")
+            end
+            emit(result)
+          rescue Lifecycle::Error, Providers::ProviderUnavailableError => e
+            raise_lifecycle_error(e.message)
+          end
+
+          private
+
+          def load_document(path)
+            raise_lifecycle_error("--file required") if path.to_s.empty?
+            content = File.open(path, "rb") { |file| file.read(4097) }
+            raise_lifecycle_error("proposal file exceeds 4096 bytes") if content.bytesize > 4096
+            JSON.parse(content)
+          rescue JSON::ParserError, SystemCallError
+            raise_lifecycle_error("proposal file must be readable JSON")
+          end
+        end
+      end
+    end
+  end
+end