ace-hitl 0.12.0 → 0.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f29e133df951a7ba9c8781bc983cea5b72efe298b6544bae9c7a60626cadcdd2
-  data.tar.gz: e3078f625d062203d1dd94b946b3fa4503daf49c6029201682dc659c9cc8463e
+  metadata.gz: 2e0e3e52b0322d7e5b585bf30728ebaae32337e06b4a8be12e96dcba1c0d498b
+  data.tar.gz: 4b79e7e2d5efd486c794be95cf515d147b17f322227d3cd6d6583382f3e6fb7e
 SHA512:
-  metadata.gz: edf72377db41e27f64075763543fcb4886357b9647400b634c7e06cf4ccb9285aeb87506e1ffde60f2b594e7e337f826a7beecfef3e8e32d0e28521da984679d
-  data.tar.gz: a71bc89e5841a1fa25b2256f7989d1ee2fb4cc830e61ae27935bb84e4f38deed4a9bd51cb5370de61633cecf911309b11219af5798798551d9dd7c7331d17a30
+  metadata.gz: a7abb0c60530c467efbb7a2b99d514e23a716bd61fce8d67c65966d629bb70969785043d63dd36e60eabd1d708d7d850b58eca6b31e5135c071e2791147c3bd7
+  data.tar.gz: 339b0dee9be68ff3ef82b4de954e6642a58b4ccdf8cad109524b66991423f39f543a59f75e8e957c1be23e263975a3448009a3558aa3e622415059d14ad036bd

data/CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.13.0] - 2026-10-08
+
+### Added
+
+- Bind scoped publication to the original canonical HITL challenge and authorization; keep OTP material out of agent messages and ordinary transport.
+
+### Changed
+
+- Read delivery history from the original Inbox owner. Complete human attention on terminal submission without requiring an agent-read receipt or querying recovery caches.
+
+### Fixed
+
+- Route proposals through the retained project journal and preserve exact protected attempt identity across lifecycle calls.
+- Exercise concurrent creation under the actual lifecycle lock.
+
+### Fixed
+
+- Accept exact protected launch attempt identifiers for HITL requests while preserving assignment syntax and authoritative binding checks.
+
 ## [0.12.0] - 2026-10-05
 
 ### Added

data/docs/usage.md

@@ -127,35 +127,22 @@ client.status(request: request_id)
 ```
 
 `deliver` consumes an authorized ordinary answer, enqueues one incarnation-bound
-Herdr event, registers its digest/key with Assign, and attempts exact native
-submission. The accepted owner's terminal, agent and immutable native session ID
-are captured before consumption and checked under the Inbox event lock. A thread
-restart in the same pane refuses delivery rather than changing that original
-identity. Repeated calls reuse the same event and never resubmit an uncertain
-intent. A stopped watcher leaves the request/native intent visible in
-`pending --project ace`; it never chooses a new pane or launches a replacement
-watcher. The configured Hermes transport publishes created requests for its
-explicitly registered project channels and owns their Telegram polling.
-
-Queue acceptance (`delivered`) and wake are transport facts. Business effects
-run once through the scoped service under the requester's declaration; their
-separate receipt reference cannot be inferred from native delivery. Actual
-consumption requires the existing trusted supervisor/observer signing context:
-
-```ruby
-client.reconcile(request: request_id, receipt_path: signed_receipt_path)
-# Explicit retry only after verified supersession/non-consumption:
-client.reconcile(request: request_id, receipt_path: signed_receipt_path, retry_delivery: true)
-```
-
-Herdr verifies the signature, exact event/attempt/digest/generation/native binding
-and accepted registration under the event lock. Assign journals the verified
-observation. Missing authority or signer, wrong key, changed target and stale
-proof stay refused/unknown. Signed supersession leaves ordinary `deliver` and
-`watch` calls queued; only `reconcile(..., retry_delivery: true)` submits again.
-No elapsed-time rule establishes success or retries.
-Keep the original trusted verification/signing context for unresolved events or
-defer key rotation; a replacement fingerprint cannot rebind an existing event.
+Herdr event, registers its original assignment/attempt attribution with Assign,
+and sends to the exact selected terminal. The accepted owner's terminal, agent
+and native session ID are checked against the live Herdr pane before sending.
+A replaced agent in the same pane refuses rather than selecting another target.
+Repeated calls reuse the same event; uncertain sends are not automatically
+repeated. The configured Hermes transport owns Telegram request/reply routing.
+
+A delivered acknowledgement means submitted to the terminal, not read by the
+agent. LiveClient.status reads delivery history from the original Inbox owner;
+delivered answers no longer appear as pending human attention. Current agent
+progress/output comes from direct Herdr/tmux panel capture when needed.
+
+Business effects still run through their scoped owner with their own result
+and authorization. Neither a sent message nor panel output replaces verification
+of those effects. No dedicated Codex app-server, message-read signer/key or
+signed consumption/supersession reconciliation API is required.
 
 The shared versioned envelope is semantically owned by HITL and packaged in
 `ace-hitl-contract` to preserve the acyclic HITL → Assign → Herdr → contract
@@ -315,9 +302,9 @@ operation and returns its bytes only over protected IPC. Local event polling
 remains available for ordinary unbound local events. Managed events cannot use
 `update --resume` to launch unscoped session/shell delivery.
 
-Installed acceptance still requires real registered Telegram ingress, native
-owner observation and trusted signer/OS-user evidence in Lab. Controlled local
-transport and synthetic native observations do not satisfy those gates.
+Installed acceptance uses actual registered Telegram ingress, the selected
+live Herdr/tmux terminal and the real scoped users in Lab. Controlled local
+transport tests do not replace launching and observing the actual task.
 
 ## Lifecycle Event Names
 
@@ -370,11 +357,17 @@ publishing, deployment and access/privilege expansion. Fixed service scope, curr
 independently executed review/tests, bound running attempt and operation-specific OTP gates
 still apply at execution. Proposal authorization never supplies credentials or runs a callback.
 
-`ace-hitl proposal show ID --format json` shows decision, deadline, actual Assign claim/outcome
+All proposal reads, revisions and transport acknowledgements/replies carry an explicit project.
+The authority selects that project's canonical Assign journal; a proposal ID does not select a journal.
+The managed request's existing project supplies this selector for ordinary `read`; Hermes uses the
+accepted envelope's project for acknowledgement, reply and reconciliation. Missing selectors are
+rejected, and an ID from another project's journal cannot be read or changed through the selected project.
+
+`ace-hitl proposal show ID --project PROJECT --format json` shows decision, deadline, actual Assign claim/outcome
 and a bounded history page; continue with `--history-after HISTORY_NEXT`.
 `ace-hitl proposal history --project ID --query TEXT` retrieves relevant prior decisions;
 continue with `--after NEXT`. Current project grants and exact requester identity gate history and show; losing project access refuses reads and excludes history, including lifecycle proposal request reads.
-`ace-hitl proposal revise ID --expected-revision N --operation-id revision-abcdef0123456789abcdef01 --file changed.json` supersedes the prior decision and creates a
+`ace-hitl proposal revise ID --project PROJECT --expected-revision N --operation-id revision-abcdef0123456789abcdef01 --file changed.json` supersedes the prior decision and creates a
 new request with a fresh full window after acknowledgement. An unresolved claimed effect
 must be reconciled before revision; known successful or proven no-effect settlement can be
 followed by a new revision. Persist the proposal ID, expected source revision, stable revision operation ID and exact file before invocation. The operation ID is `revision-` followed by 24 lowercase hex digits and is unique across proposals. Exact retry returns that committed revision, including after acknowledged delivery, approval or a later revision, without creating another request or resetting the window. Changed proposal/source/content/caller bindings and stale-source new operations are refused. Supersession and new prepared revision commit atomically against effect claims. Generic lifecycle `create` rejects proposal kind; use this canonical proposal interface.

data/lib/ace/hitl/cli/commands/proposal.rb

@@ -36,12 +36,14 @@ module Ace
                 project: options[:project], document: load_document(options[:file]))
             when "show"
               raise_lifecycle_error("proposal ID required") if id.to_s.empty?
-              lifecycle_client.proposal_show(id, history_after: options[:"history-after"] || 0)
+              raise_lifecycle_error("--project required") if options[:project].to_s.empty?
+              lifecycle_client.proposal_show(id, project: options[:project], history_after: options[:"history-after"] || 0)
             when "revise"
               raise_lifecycle_error("proposal ID required") if id.to_s.empty?
               raise_lifecycle_error("--expected-revision required") unless options[:"expected-revision"]
               raise_lifecycle_error("--operation-id required") if options[:"operation-id"].to_s.empty?
-              lifecycle_client.proposal_revise(id, expected_revision: options[:"expected-revision"],
+              raise_lifecycle_error("--project required") if options[:project].to_s.empty?
+              lifecycle_client.proposal_revise(id, project: options[:project], expected_revision: options[:"expected-revision"],
                 operation_id: options[:"operation-id"], document: load_document(options[:file]))
             when "resolve-due"
               raise_lifecycle_error("--project required") if options[:project].to_s.empty?

data/lib/ace/hitl/lifecycle/binding.rb

@@ -16,7 +16,7 @@ module Ace
           raise NotImplementedError
         end
 
-        def reverse_address(attempt:, caller_pid:)
+        def reverse_address(assignment:, attempt:, project:, caller_pid:)
           raise NotImplementedError
         end
 

data/lib/ace/hitl/lifecycle/client.rb

@@ -27,32 +27,32 @@ module Ace
           request("proposal-create", params)
         end
 
-        def proposal_show(id, history_after: 0)
-          request("proposal-show", {"id" => id, "history_after" => history_after})
+        def proposal_show(id, project:, history_after: 0)
+          request("proposal-show", {"id" => id, "project" => project, "history_after" => history_after})
         end
 
-        def proposal_revise(id, expected_revision:, operation_id:, document:)
-          request("proposal-revise", {"id" => id, "expected_revision" => expected_revision, "operation_id" => operation_id, "document" => document})
+        def proposal_revise(id, project:, expected_revision:, operation_id:, document:)
+          request("proposal-revise", {"id" => id, "project" => project, "expected_revision" => expected_revision, "operation_id" => operation_id, "document" => document})
         end
 
-        def proposal_acknowledge(id, submitted_at:)
-          request("proposal-ack", {"id" => id, "submitted_at" => submitted_at})
+        def proposal_acknowledge(id, project:, submitted_at:)
+          request("proposal-ack", {"id" => id, "project" => project, "submitted_at" => submitted_at})
         end
 
-        def proposal_reply(id, **params)
-          request("proposal-reply", {"id" => id}.merge(params))
+        def proposal_reply(id, project:, **params)
+          request("proposal-reply", {"id" => id, "project" => project}.merge(params))
         end
 
-        def proposal_reconcile(id, checkpoint:)
-          request("proposal-reconcile", {"id" => id, "checkpoint" => checkpoint})
+        def proposal_reconcile(id, project:, checkpoint:)
+          request("proposal-reconcile", {"id" => id, "project" => project, "checkpoint" => checkpoint})
         end
 
         def proposal_wake(project:, after: nil)
           request("proposal-wake", {"project" => project, "after" => after}.compact)
         end
 
-        def proposal_due(after: nil)
-          request("proposal-due", {"after" => after}.compact)
+        def proposal_due(project:, after: nil)
+          request("proposal-due", {"project" => project, "after" => after}.compact)
         end
 
         def proposal_history(project:, query: "", after: nil)
@@ -66,14 +66,15 @@ module Ace
         end
 
         # @return [Hash] the result frame
-        def request(op, params = {})
+        def request(op, params = {}, deadline: nil)
+          deadline = request_deadline(op, params, deadline)
           verify_endpoint!
-          socket = UNIXSocket.open(@socket_path)
+          socket = Socket.new(Socket::AF_UNIX, Socket::SOCK_STREAM, 0)
           begin
+            connect!(socket, deadline)
             verify_service_peer!(socket)
-            socket.write(Protocol.encode_request(op, params))
-            socket.flush
-            line = read_line(socket, deadline_for(op, params))
+            write_frame!(socket, Protocol.encode_request(op, params), deadline)
+            line = read_line(socket, deadline)
             Protocol.decode_response(line)
           ensure
             socket.close
@@ -84,27 +85,27 @@ module Ace
           raise TransportError, "HITL boundary request is not serializable (#{e.message})"
         end
 
-        def create(**params)
-          request("create", params.transform_keys(&:to_s))
+        def create(deadline: nil, **params)
+          request("create", params.transform_keys(&:to_s), deadline: deadline)
         end
 
-        def read(id)
-          request("read", {"id" => id})
+        def read(id, deadline: nil)
+          request("read", {"id" => id}, deadline: deadline)
         end
 
         def deliver(id, answer)
           request("deliver", {"id" => id, "answer" => answer.to_s})
         end
 
-        def consume(id, timeout: 0, operation: nil, native_delivery: false)
+        def consume(id, timeout: 0, operation: nil, native_delivery: false, deadline: nil)
           params = {"id" => id, "timeout" => Integer(timeout)}
           params["operation"] = operation if operation
           params["native_delivery"] = true if native_delivery
-          request("consume", params)
+          request("consume", params, deadline: deadline)
         end
 
-        def cancel(id, reason: "")
-          request("cancel", {"id" => id, "reason" => reason.to_s})
+        def cancel(id, reason: "", deadline: nil)
+          request("cancel", {"id" => id, "reason" => reason.to_s}, deadline: deadline)
         end
 
         def pending(project: nil)
@@ -177,6 +178,43 @@ module Ace
         # A consume without a timeout waits indefinitely at the client
         # boundary too; every bounded call gets a deadline slightly
         # beyond its own wait so the server result wins the race.
+        def request_deadline(op, params, selected)
+          if !selected.nil? && (!selected.is_a?(Numeric) || !selected.finite?)
+            raise TransportError, "HITL boundary deadline is invalid"
+          end
+          local = deadline_for(op, params)
+          [selected, local].compact.min
+        end
+
+        def await!(socket, direction, deadline)
+          remaining = deadline && deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          raise TransportError, "HITL boundary deadline exceeded" if remaining && remaining <= 0
+          readable, writable = direction == :read ? [[socket], nil] : [nil, [socket]]
+          raise TransportError, "HITL boundary deadline exceeded" unless IO.select(readable, writable, nil, remaining)
+        end
+
+        def connect!(socket, deadline)
+          if deadline && deadline <= Process.clock_gettime(Process::CLOCK_MONOTONIC)
+            raise TransportError, "HITL boundary deadline exceeded"
+          end
+          result = socket.connect_nonblock(Socket.sockaddr_un(@socket_path), exception: false)
+          return if result == 0
+          await!(socket, :write, deadline)
+          error = socket.getsockopt(Socket::SOL_SOCKET, Socket::SO_ERROR).int
+          raise SystemCallError.new("HITL boundary connection failed", error) unless error.zero?
+        end
+
+        def write_frame!(socket, frame, deadline)
+          offset = 0
+          while offset < frame.bytesize
+            await!(socket, :write, deadline)
+            written = socket.write_nonblock(frame.byteslice(offset..), exception: false)
+            next if written == :wait_writable
+            raise TransportError, "HITL boundary closed before request" unless written.is_a?(Integer) && written.positive?
+            offset += written
+          end
+        end
+
         def deadline_for(op, params)
           if op == "consume" && Integer(params["timeout"]) <= 0
             nil

data/lib/ace/hitl/lifecycle/kinds.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "ace/hitl/contract/secret_gate"
+require "ace/hitl/contract/managed_envelope"
 
 module Ace
   module Hitl
@@ -16,8 +17,10 @@ module Ace
 
         REQUEST_ID = /\A[A-Za-z0-9_-]{6,64}\z/
         # Compact managed identifiers (ADR-030): ace-assign assignment and
-        # attempt ids are Base36 timestamp ids plus optional local suffix.
+        # standalone attempt ids are Base36 timestamp ids plus optional local suffix.
+        # Protected attempts retain the exact LaunchLifecycle launch identity.
         COMPACT_ID = /\A[0-9a-z][0-9a-z]{4,63}\z/
+        PROTECTED_ATTEMPT_ID = Contract::ManagedEnvelope::PROTECTED_ATTEMPT
         SAFE_LABEL = /\A[A-Za-z0-9_. -]{1,48}\z/
         OTP_ANSWER = /\A[0-9]{6}\z/
 

data/lib/ace/hitl/lifecycle/proposals.rb

@@ -12,7 +12,7 @@ module Ace
           unless id.is_a?(String) && id.match?(/\Aproposal-[0-9a-f]{24}\z/)
             raise StateError, "create requires a stable proposal ID"
           end
-          existing = proposal_journal.proposal_record(id)
+          existing = proposal_journal(project).proposal_record(id)
           if existing && existing.values_at("assignment_id", "attempt_id", "project_id", "requester", "caller_uid", "content_digest") !=
               [assignment, attempt, project, @identity.username, @identity.uid, Digest::SHA256.hexdigest(JSON.generate(content))]
             raise StateError, "proposal retry changed immutable content or caller"
@@ -20,15 +20,15 @@ module Ace
           proposal_revision(id, 1, assignment: assignment, attempt: attempt, project: project, content: content)
         end
 
-        def proposal_revise(id, expected_revision:, operation_id:, document:)
-          old = proposal_access!(id, requester: true)
+        def proposal_revise(id, project:, expected_revision:, operation_id:, document:)
+          old = proposal_access!(id, project: project, requester: true)
           require_proposer!(old["project_id"])
           unless expected_revision.is_a?(Integer) && expected_revision.positive? &&
               operation_id.is_a?(String) && operation_id.match?(/\Arevision-[0-9a-f]{24}\z/)
             raise StateError, "revise requires an expected source revision and stable revision operation ID"
           end
           content = Ace::Hitl::Proposals::Policy.document(document)
-          replay = proposal_revision_replay(id, expected_revision, operation_id, content)
+          replay = proposal_revision_replay(id, expected_revision, operation_id, content, project: project)
           if replay
             project_proposal_request(replay)
             return replay
@@ -40,18 +40,18 @@ module Ace
           raise StateError, "Proposal revision refused (#{e.message})"
         end
 
-        def proposal_show(id, history_after: 0)
-          record = proposal_access!(id)
+        def proposal_show(id, project:, history_after: 0)
+          record = proposal_access!(id, project: project)
           unless history_after.is_a?(Integer) && history_after >= 0
             raise StateError, "history cursor must be a non-negative offset"
           end
-          history = proposal_journal.proposal_history(id)
+          history = proposal_journal(project).proposal_history(id)
           entries = (history.slice(history_after, 3) || []).map do |entry|
-            outcome = proposal_journal.proposal_claims(entry["revision_id"]).last
+            outcome = proposal_journal(project).proposal_claims(entry["revision_id"]).last
             entry.merge("actual_outcome" => outcome && outcome["state"],
               "effect_request_id" => outcome && outcome["request_id"])
           end
-          claims = proposal_journal.proposal_claims(record["revision_id"])
+          claims = proposal_journal(project).proposal_claims(record["revision_id"])
           claim = claims.last
           outcome = case claim && claim["state"]
           when "accepted" then "executing"
@@ -64,19 +64,19 @@ module Ace
             "history_next" => history_after + entries.length < history.length ? history_after + entries.length : nil)
         end
 
-        def proposal_acknowledge(request, submitted_at:)
-          record = proposal_for_request!(request)
+        def proposal_acknowledge(request, project:, submitted_at:)
+          record = proposal_for_request!(request, project: project)
           require_transport!("proposal delivery", {"project" => record["project_id"]})
           proposal_transition(record) { |current| Ace::Hitl::Proposals::Policy.acknowledge(current, submitted_at) }
         end
 
-        def proposal_reply(request, answer:, received_at:, sequence:)
-          record = proposal_for_request!(request)
+        def proposal_reply(request, project:, answer:, received_at:, sequence:)
+          record = proposal_for_request!(request, project: project)
           require_transport!("proposal reply", {"project" => record["project_id"]})
           proposal_transition(record) do |current|
             # Claims and this transition share one canonical ref lock/CAS.
-            claimed = proposal_journal.proposal_claims(current["revision_id"]).any?
-            applied = proposal_journal.proposal_history(current["proposal_id"]).find do |entry|
+            claimed = proposal_journal(project).proposal_claims(current["revision_id"]).any?
+            applied = proposal_journal(project).proposal_history(current["proposal_id"]).find do |entry|
               entry["revision_id"] == current["revision_id"] && entry["reply_sequence"] == sequence
             end
             Ace::Hitl::Proposals::Policy.reply(current, applied: applied, answer: answer, received_at: received_at,
@@ -84,8 +84,8 @@ module Ace
           end
         end
 
-        def proposal_reconcile(request, checkpoint:)
-          record = proposal_for_request!(request)
+        def proposal_reconcile(request, project:, checkpoint:)
+          record = proposal_for_request!(request, project: project)
           require_transport!("proposal reconciliation", {"project" => record["project_id"]})
           proposal_transition(record) do |current|
             Ace::Hitl::Proposals::Policy.resolve(current, checkpoint: checkpoint, now: proposal_now)
@@ -95,7 +95,7 @@ module Ace
         def proposal_wake(project:, after: nil)
           raise StateError, "invalid proposal wake project" unless project.is_a?(String) && Kinds::SAFE_LABEL.match?(project)
           require_proposer!(project)
-          records = proposal_journal.proposals.sort_by { |record| record["proposal_id"] }.select do |record|
+          records = proposal_journal(project).proposals.sort_by { |record| record["proposal_id"] }.select do |record|
             record["project_id"] == project && (!after || record["proposal_id"] > after) &&
               record["state"] == "awaiting-decision" && record["deadline"] <= proposal_now
           end
@@ -107,10 +107,10 @@ module Ace
           {"items" => items, "next" => records.length > 8 ? selected.last["proposal_id"] : nil}
         end
 
-        def proposal_due(after: nil)
-          require_transport!("proposal deadlines")
-          records = proposal_journal.proposals.sort_by { |record| record["proposal_id"] }.select do |record|
-            (!after || record["proposal_id"] > after) &&
+        def proposal_due(project:, after: nil)
+          require_transport!("proposal deadlines", {"project" => project})
+          records = proposal_journal(project).proposals.sort_by { |record| record["proposal_id"] }.select do |record|
+            record["project_id"] == project && (!after || record["proposal_id"] > after) &&
               @policy.transport?(@identity, project: record["project_id"]) &&
               record["state"] == "awaiting-decision" && record["deadline"] <= proposal_now && record["reconcile_requested_at"]
           end
@@ -123,7 +123,7 @@ module Ace
           unless query.is_a?(String) && query.bytesize <= 240 && project.is_a?(String)
             raise StateError, "history requires a project and bounded query"
           end
-          records = proposal_journal.proposals.sort_by { |record| record["proposal_id"] }.select do |record|
+          records = proposal_journal(project).proposals.sort_by { |record| record["proposal_id"] }.select do |record|
             next false unless record["project_id"] == project && (!after || record["proposal_id"] > after)
             visible = (record["requester"] == @identity.username && record["caller_uid"] == @identity.uid &&
               @policy.respond_to?(:proposal?) && @policy.proposal?(@identity, project: project)) ||
@@ -146,18 +146,21 @@ module Ace
           @proposal_clock.call.utc.iso8601
         end
 
-        def proposal_journal
-          @binding.proposal_journal
+        def proposal_journal(project)
+          unless project.is_a?(String) && Kinds::SAFE_LABEL.match?(project)
+            raise StateError, "proposal requires an explicit project"
+          end
+          @binding.proposal_journal(project: project)
         rescue NoMethodError
           raise BindingError, "Managed proposal authority is unavailable"
         end
 
-        def proposal_access!(id, requester: false)
+        def proposal_access!(id, project:, requester: false)
           unless id.is_a?(String) && id.match?(/\Aproposal-[0-9a-f]{24}\z/)
             raise StateError, "invalid proposal ID"
           end
-          record = proposal_journal.proposal_record(id)
-          raise StateError, "unknown proposal" unless record
+          record = proposal_journal(project).proposal_record(id)
+          raise StateError, "unknown proposal" unless record && record["project_id"] == project
           if record["requester"] == @identity.username && record["caller_uid"] == @identity.uid &&
               @policy.respond_to?(:proposal?) && @policy.proposal?(@identity, project: record["project_id"])
             return record
@@ -172,19 +175,19 @@ module Ace
           record
         end
 
-        def proposal_for_request!(request)
+        def proposal_for_request!(request, project:)
           unless request.is_a?(String) && request.match?(/\Aproposal-[0-9a-f]{24}-r[1-9][0-9]*\z/)
             raise StateError, "invalid proposal revision request"
           end
           id = request.sub(/-r[1-9][0-9]*\z/, "")
-          proposal_access!(id)
-          record = proposal_journal.proposal_history(id).reverse.find { |entry| entry["request_id"] == request }
+          proposal_access!(id, project: project)
+          record = proposal_journal(project).proposal_history(id).reverse.find { |entry| entry["request_id"] == request }
           raise StateError, "unknown proposal revision" unless record
           record
         end
 
         def proposal_transition(record, &policy)
-          proposal_journal.change_proposal(record["proposal_id"], assignment_id: record["assignment_id"],
+          proposal_journal(record.fetch("project_id")).change_proposal(record["proposal_id"], assignment_id: record["assignment_id"],
             attempt_id: record["attempt_id"]) do |current|
             # A reply to an older revision cannot modify the new decision.
             next current unless current["request_id"] == record["request_id"]
@@ -199,9 +202,9 @@ module Ace
           question = "Proposal #{request}: #{JSON.generate(content)}"
           replay = nil
           record = @binding.with_active(assignment: assignment, attempt: attempt, project: project, requester: @identity.username) do
-            proposal_journal.change_proposal(id, assignment_id: assignment, attempt_id: attempt) do |previous|
+            proposal_journal(project).change_proposal(id, assignment_id: assignment, attempt_id: attempt) do |previous|
               if operation_id
-                replay = proposal_revision_replay(id, expected_revision, operation_id, content)
+                replay = proposal_revision_replay(id, expected_revision, operation_id, content, project: project)
                 next previous if replay
                 unless previous && previous["revision"] == expected_revision
                   raise StateError, "proposal source revision changed concurrently"
@@ -238,11 +241,11 @@ module Ace
           record
         end
 
-        def proposal_revision_replay(id, expected_revision, operation_id, content)
-          replay = proposal_journal.proposal_operation_record(operation_id)
+        def proposal_revision_replay(id, expected_revision, operation_id, content, project:)
+          replay = proposal_journal(project).proposal_operation_record(operation_id)
           return unless replay
-          unless replay.values_at("proposal_id", "expected_source_revision", "requester", "caller_uid", "content_digest") ==
-              [id, expected_revision, @identity.username, @identity.uid, Digest::SHA256.hexdigest(JSON.generate(content))]
+          unless replay.values_at("proposal_id", "project_id", "expected_source_revision", "requester", "caller_uid", "content_digest") ==
+              [id, project, expected_revision, @identity.username, @identity.uid, Digest::SHA256.hexdigest(JSON.generate(content))]
             raise StateError, "revision retry changed immutable source, content or caller"
           end
           replay
@@ -267,10 +270,13 @@ module Ace
 
         def recover_proposal_projections(project:)
           return unless @binding.respond_to?(:proposal_journal)
-          proposal_journal.proposals.each do |record|
-            next if project && record["project_id"] != project
-            next unless @policy.transport?(@identity, project: record["project_id"])
-            project_proposal_request(record)
+          selected_projects = project ? [project] : @binding.proposal_projects
+          selected_projects.each do |selected|
+            next unless @policy.transport?(@identity, project: selected)
+            proposal_journal(selected).proposals.each do |record|
+              next unless record["project_id"] == selected
+              project_proposal_request(record)
+            end
           end
         end
       end