ace-hitl 0.17.0 → 0.23.2

data/lib/ace/hitl/cli/commands/send.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require "ace/support/cli"
+
+module Ace
+  module Hitl
+    module CLI
+      module Commands
+        class Send < Ace::Support::Cli::Command
+          include Ace::Support::Cli::Base
+
+          desc "Send a HITL event through the configured adapter routes"
+
+          example [
+            "8xhkep                   # Deliver one event; per-route results",
+            "8xhkep --scope all       # Resolve across worktrees"
+          ]
+
+          argument :ref, required: true, desc: "HITL reference (full ID or shortcut)"
+
+          option :scope, type: :string, desc: "Scope (current, all)"
+          option :force, type: :boolean, desc: "Redeliver every configured route (same case ID; recipients dedup)"
+          option :"dry-run", type: :boolean, desc: "Show retry/skip decisions without delivering"
+
+          option :quiet, type: :boolean, aliases: %w[-q], desc: "Suppress non-essential output"
+          option :verbose, type: :boolean, aliases: %w[-v], desc: "Show verbose output"
+          option :debug, type: :boolean, aliases: %w[-d], desc: "Show debug output"
+
+          def call(ref:, **options)
+            scope = validate_scope(options[:scope])
+
+            sender = Organisms::HitlSender.new
+            report = sender.send(ref, scope: scope,
+              force: options[:force] == true,
+              dry_run: options[:"dry-run"] == true)
+
+            unless options[:quiet]
+              puts "HITL event #{report.event_id} sent through #{report.results.size} route(s):"
+              report.results.each do |result|
+                detail = result.detail ? " - #{result.detail}" : ""
+                puts "  #{result.route} (#{result.adapter}): #{result.status}#{detail}"
+              end
+              report.skipped.each do |result|
+                detail = result.detail ? " - #{result.detail}" : ""
+                puts "  #{result.route} (#{result.adapter}): skipped#{detail}"
+              end
+              if report.results.empty? && report.skipped.any?
+                puts "already delivered on all routes; nothing to retry (use --force to redeliver)"
+              end
+            end
+
+            return if options[:"dry-run"] == true
+
+            unless report.all_delivered?
+              raise Ace::Support::Cli::Error.new(
+                "HITL event '#{report.event_id}' not delivered on all routes"
+              )
+            end
+          rescue Ace::Hitl::Organisms::HitlManager::AmbiguousReferenceError => e
+            candidates = e.matches.map(&:file_path).join(", ")
+            raise Ace::Support::Cli::Error.new(
+              "HITL event '#{ref}' is ambiguous across scope '#{scope || "all"}'. Candidates: #{candidates}"
+            )
+          rescue Ace::Hitl::Adapters::Error,
+            Ace::Hitl::Molecules::HitlRouteLoader::NoRoutesError,
+            Ace::Hitl::Molecules::HitlRouteLoader::InvalidRouteError => e
+            raise Ace::Support::Cli::Error.new(e.message)
+          end
+
+          private
+
+          def validate_scope(raw_scope)
+            return nil if raw_scope.nil?
+
+            scope = raw_scope.to_s.strip
+            allowed = Ace::Hitl::Molecules::WorktreeScopeResolver::VALID_SCOPES
+            return scope if allowed.include?(scope)
+
+            raise Ace::Support::Cli::Error.new("Invalid scope '#{raw_scope}'. Allowed: #{allowed.join(", ")}")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/hitl/cli/commands/serve.rb

@@ -2,40 +2,51 @@
 
 require "ace/support/cli"
 require_relative "../../lifecycle"
-require_relative "../../providers/providers"
+require_relative "../../providers/lab"
 
 module Ace
   module Hitl
     module CLI
       module Commands
-        # The installed scoped store boundary (spec 8wq.t.34i): serves
-        # the private HITL store over a peer-authenticated UNIX socket.
-        # Authorization facts come only from the trusted grants
-        # document; the store root and socket paths come from the
-        # deployment (options/environment), never from caller payloads.
+        # The operator-only local scoped store boundary: serves explicitly
+        # granted nonsecret operator questions over a peer-authenticated
+        # UNIX socket. Authorization facts come only from the trusted grants
+        # document; the store root and socket paths come from the deployment
+        # (options/environment), never from caller payloads.
+        #
+        # The installed managed-attempt authority and the host/Incus mTLS
+        # crossing were removed with the old authority model.
         class Serve < Ace::Support::Cli::Command
           include Ace::Support::Cli::Base
 
-          desc "Run the authenticated HITL store boundary service (peer-credential access)"
+          desc "Run the operator-only HITL store boundary service (peer-credential access)"
 
           option :socket, type: :string, desc: "Boundary socket path (default: ACE_HITL_SOCKET or /run/lab/hitl.sock)"
           option :group, type: :string,
             desc: "Dedicated lifecycle group allowed to connect (required; root and lab-control are refused)"
           option :store_root, type: :string, desc: "Private store root (default: ACE_HITL_STORE_ROOT or /run/lab/hitl)"
-          option :grants_path, type: :string, desc: "Trusted grants document (default: ACE_HITL_GRANTS_PATH or /etc/lab/ace-lab/authorization.yml)"
+          option :grants_path, type: :string,
+            desc: "Trusted grants document (default: ACE_HITL_GRANTS_PATH or /etc/lab/ace-lab/authorization.yml)"
           option :operator_only, type: :boolean,
             desc: "Serve explicitly granted nonsecret operator questions without a managed execution authority"
-          option :repo_root, type: :string, desc: "Candidate repository for the managed attempt authority"
-          option :tls_authority, type: :string, desc: "Serve the host/Incus mTLS crossing from this authority config (root:<service-group> 0640; loopback TCP + verified project client identity)"
+          option :repo_root, type: :string, desc: "(removed) managed attempt authority repository"
+          option :tls_authority, type: :string, desc: "(removed) host/Incus mTLS crossing authority"
 
           option :quiet, type: :boolean, aliases: %w[-q], desc: "Suppress non-essential output"
           option :verbose, type: :boolean, aliases: %w[-v], desc: "Show verbose output"
 
           def call(**options)
-            if options[:tls_authority] && options[:operator_only]
-              raise_cli_error("operator questions require a local kernel requester; operator-only TLS is not supported")
+            if options[:repo_root] || options[:tls_authority]
+              raise_cli_error(
+                "managed and TLS serve were removed with the installed attempt authority; " \
+                "serve supports --operator-only only"
+              )
+            end
+            unless options[:operator_only]
+              raise_cli_error(
+                "the installed managed attempt authority is removed; serve requires --operator-only"
+              )
             end
-            return serve_tls_authority(options) if options[:tls_authority]
 
             group = dedicated_group(options)
             policy = Providers::Lab.grants_policy(grants_path: grants_path(options))
@@ -46,15 +57,9 @@ module Ace
                 "fail every client endpoint verification"
               )
             end
-            binding_policy = if options[:operator_only]
-              raise_cli_error("operator-only serve cannot select a managed repository") if options[:repo_root]
-              Lifecycle::OperatorOnlyBinding.new
-            else
-              Providers::Lab.assignment_binding(repo_root: options[:repo_root])
-            end
             service = Lifecycle::Service.new(
               root: store_root(options),
-              binding: binding_policy,
+              binding: Lifecycle::OperatorOnlyBinding.new,
               policy: policy,
               socket_path: socket_path(options),
               group: group,
@@ -67,30 +72,6 @@ module Ace
 
           private
 
-          # The host/Incus crossing (spec 8xa.t.nh0): authority config,
-          # credential layout and TLS material are verified fail-closed
-          # BEFORE the loopback listener opens; the verified project-
-          # scoped client certificate is the only admitted peer.
-          def serve_tls_authority(options)
-            authority = Lifecycle::TlsAuthority.load(options[:tls_authority])
-            binding_policy = Providers::Lab.assignment_binding(repo_root: options[:repo_root])
-            service = Lifecycle::TlsService.new(
-              root: store_root(options),
-              binding: binding_policy,
-              project: authority.project_id,
-              credential: authority.credential,
-              decision_policy: Providers::Lab.grants_policy(grants_path: grants_path(options)),
-              ssl_context: authority.ssl_context!,
-              listen: authority.listen,
-              port: authority.port,
-              group: authority.service_group,
-              logger: options[:verbose] ? ->(message) { warn message } : nil
-            )
-            service.run
-          rescue Lifecycle::Error, Providers::ProviderUnavailableError => e
-            raise_cli_error(e.message)
-          end
-
           def dedicated_group(options)
             group = options[:group].to_s
             return group unless group.empty?

data/lib/ace/hitl/cli/commands/show.rb

@@ -45,10 +45,30 @@ module Ace
               puts "ID: #{event.id}"
               puts "Title: #{event.title}"
               puts "Status: #{event.status}"
-              puts "Kind: #{event.kind}"
+              puts "Type: #{event.type}"
+              puts "Kind: #{event.kind}" if event.question?
+              puts "Result: #{event.result}" if event.report?
               puts "Tags: #{event.tags.join(", ")}"
-              puts "Questions: #{event.questions.join(" | ")}"
-              puts "Answer: #{event.answer || "(none)"}"
+              if event.recipient
+                puts "Recipient: #{Ace::Hitl::Atoms::HitlAddress.to_s(event.recipient)}"
+              end
+              if event.reply_to
+                puts "Reply-To: #{Ace::Hitl::Atoms::HitlAddress.to_s(event.reply_to)}"
+              end
+              if event.report?
+                puts "Report: #{event.content}"
+              else
+                puts "Questions: #{event.questions.join(" | ")}"
+                puts "Answer: #{event.answer || "(none)"}"
+              end
+              delivery = event.metadata["delivery"]
+              if delivery.is_a?(Hash) && !delivery.empty?
+                delivery.sort.each do |route, record|
+                  detail = record["detail"].to_s.empty? ? "" : " - #{record["detail"]}"
+                  attempted = record["attempted_at"] ? " (#{record["attempted_at"]})" : ""
+                  puts "Delivery: #{route} (#{record["adapter"]}): #{record["status"]}#{detail}#{attempted}"
+                end
+              end
               puts resolved_location if resolved_location
               puts "Path: #{event.file_path}"
             end

data/lib/ace/hitl/cli/commands/update.rb

@@ -59,6 +59,8 @@ module Ace
               raise Ace::Support::Cli::Error.new(
                 "HITL event '#{ref}' is ambiguous across scope '#{scope || "all"}'. Candidates: #{candidates}"
               )
+            rescue Ace::Hitl::Organisms::HitlManager::NotAnswerableError => e
+              raise Ace::Support::Cli::Error.new(e.message)
             end
 
             raise Ace::Support::Cli::Error.new("HITL event '#{ref}' not found") unless event
@@ -81,6 +83,8 @@ module Ace
               puts "HITL event archived after successful dispatch."
             when :managed_request
               raise Ace::Support::Cli::Error.new("Managed requests require scoped live delivery; unscoped resume is prohibited")
+            when :report
+              raise Ace::Support::Cli::Error.new("HITL event '#{event.id}' is a report; reports do not await an answer or resume")
             when :no_answer
               raise Ace::Support::Cli::Error.new("Cannot resume '#{event.id}' without an answer")
             when :failed

data/lib/ace/hitl/cli/commands/wait.rb

@@ -47,6 +47,9 @@ module Ace
 
             manager = Ace::Hitl::Organisms::HitlManager.new
             event = manager.show(ref, scope: scope)&.dig(:event)
+            if event&.report?
+              raise Ace::Support::Cli::Error.new("HITL event '#{event.id}' is a report; reports do not await an answer")
+            end
             if event && event.metadata["lab_request_id"]
               emit(Ace::Hitl::LiveClient.new(boundary: lifecycle_client).wait(
                 request: event.metadata.fetch("lab_request_id"), timeout: options[:timeout] || 0,
@@ -70,6 +73,8 @@ module Ace
               puts "Resume: #{resume}" if resume
             when :timeout
               raise Ace::Support::Cli::Error.new("Timed out waiting for HITL event '#{ref}'")
+            when :report
+              raise Ace::Support::Cli::Error.new("HITL event '#{ref}' is a report; reports do not await an answer")
             else
               raise Ace::Support::Cli::Error.new("HITL event '#{ref}' not found")
             end

data/lib/ace/hitl/cli.rb

@@ -3,7 +3,7 @@
 require "ace/support/cli"
 require_relative "../hitl/version"
 require_relative "cli/commands/create"
-require_relative "cli/commands/ask"
+require_relative "cli/commands/send"
 require_relative "cli/commands/operator_question"
 require_relative "cli/commands/read"
 require_relative "cli/commands/show"
@@ -17,10 +17,6 @@ require_relative "cli/commands/pending"
 require_relative "cli/commands/states"
 require_relative "cli/commands/duty"
 require_relative "cli/commands/serve"
-require_relative "cli/commands/overseer_send"
-require_relative "cli/commands/overseer_pending"
-require_relative "cli/commands/overseer_ack"
-require_relative "cli/commands/proposal"
 
 module Ace
   module Hitl
@@ -30,43 +26,40 @@ module Ace
       PROGRAM_NAME = "ace-hitl"
 
       REGISTERED_COMMANDS = [
-        ["proposal", "Create, inspect, revise or resolve an immutable second-commander proposal"],
-        ["create", "Create HITL event"],
+        ["create", "Create HITL event (question or report)"],
         ["operator-question", "Create a nonsecret question under an installed operator project grant"],
         ["read", "Read authenticated lifecycle request facts"],
-        ["ask", "Ask a human via HITL and forward the request to the Lab"],
         ["show", "Show HITL event details"],
         ["list", "List HITL events"],
         ["update", "Update HITL event metadata or answer"],
+        ["send", "Send a HITL event through the configured adapter routes"],
         ["wait", "Wait for an answer on a specific HITL event"],
         ["deliver", "Deliver an answer (stdin) to a pending HITL relay request"],
         ["consume", "Wait for and consume the answer of one own HITL relay request"],
         ["cancel", "Cancel one HITL relay request with an audited reason"],
         ["pending", "List answerable HITL relay requests (transport)"],
         ["states", "List public HITL lifecycle projections (transport)"],
-        ["duty", "Project pending and escalated HITL requests (transport)"],
-        ["overseer-send", "Queue a bounded, type-tagged Overseer response (stdin)"],
-        ["overseer-pending", "List queued Overseer responses (host-broker)"],
-        ["overseer-ack", "Acknowledge one relayed Overseer response"]
+        ["duty", "Project pending and escalated HITL requests (transport)"]
       ].freeze
 
       HELP_EXAMPLES = [
         "ace-hitl list --status pending",
         "ace-hitl show abc123 --content",
         "ace-hitl create \"Which auth strategy?\" --kind decision",
-        "ace-hitl ask --question \"Proceed with deploy?\" --assignment assign685 --attempt attempt685 --effect-arg /bin/false --effect-cwd /tmp",
+        "ace-hitl create \"Blocked on auth\" --kind decision --to overseer --task 8xg.t.sbz.1.1",
+        "ace-hitl create \"Work done\" --type report --result success --task 8xg.t.sbz.1.0",
         "ace-hitl update abc123 --answer \"Use JWT with refresh tokens\"",
+        "ace-hitl send 8xhkep",
         "ace-hitl wait abc123 --poll-every 600 --timeout 14400"
       ].freeze
 
       register "create", CLI::Commands::Create
-      register "proposal", CLI::Commands::Proposal
-      register "ask", CLI::Commands::Ask
       register "operator-question", CLI::Commands::OperatorQuestion
       register "read", CLI::Commands::Read
       register "show", CLI::Commands::Show
       register "list", CLI::Commands::List
       register "update", CLI::Commands::Update
+      register "send", CLI::Commands::Send
       register "wait", CLI::Commands::Wait
       register "deliver", CLI::Commands::Deliver
       register "consume", CLI::Commands::Consume
@@ -75,9 +68,6 @@ module Ace
       register "states", CLI::Commands::States
       register "duty", CLI::Commands::Duty
       register "serve", CLI::Commands::Serve
-      register "overseer-send", CLI::Commands::OverseerSend
-      register "overseer-pending", CLI::Commands::OverseerPending
-      register "overseer-ack", CLI::Commands::OverseerAck
 
       version_cmd = Ace::Support::Cli::VersionCommand.build(
         gem_name: "ace-hitl",

data/lib/ace/hitl/lifecycle/frame_serving.rb

@@ -43,21 +43,6 @@ module Ace
         def execute(store, op, params)
           case op
           when "ping" then store.capabilities
-          when "proposal-create" then store.proposal_create(**symbolize(params))
-          when "proposal-show" then store.proposal_show(required(params, "id"), project: required(params, "project"), history_after: params.fetch("history_after", 0))
-          when "proposal-revise" then store.proposal_revise(required(params, "id"), project: required(params, "project"), expected_revision: required(params, "expected_revision"),
-            operation_id: required(params, "operation_id"), document: required(params, "document"))
-          when "proposal-ack"
-            store.proposal_acknowledge(required(params, "id"), project: required(params, "project"), submitted_at: required(params, "submitted_at"))
-          when "proposal-reply"
-            store.proposal_reply(required(params, "id"), project: required(params, "project"), answer: required(params, "answer"),
-              received_at: required(params, "received_at"), sequence: required(params, "sequence"))
-          when "proposal-reconcile"
-            store.proposal_reconcile(required(params, "id"), project: required(params, "project"), checkpoint: required(params, "checkpoint"))
-          when "proposal-wake" then store.proposal_wake(project: required(params, "project"), after: params["after"])
-          when "proposal-due" then store.proposal_due(project: required(params, "project"), after: params["after"])
-          when "proposal-history" then store.proposal_history(project: required(params, "project"),
-            query: params.fetch("query", ""), after: params["after"])
           when "operator-question" then store.operator_question(**symbolize(params))
           when "create" then store.create(**symbolize(params))
           when "read" then store.read(required(params, "id"))

data/lib/ace/hitl/lifecycle/kinds.rb

@@ -11,7 +11,7 @@ module Ace
       module Kinds
         ALL = %w[
           text choice confirm secret review
-          question decision verification otp proposal
+          question decision verification otp
         ].freeze
         SECRET = %w[otp].freeze
 

data/lib/ace/hitl/lifecycle/lifecycle_requests.rb

@@ -13,42 +13,6 @@ module Ace
           request("operator-question", params.transform_keys(&:to_s))
         end
 
-        def proposal_create(**params)
-          request("proposal-create", params)
-        end
-
-        def proposal_show(id, project:, history_after: 0)
-          request("proposal-show", {"id" => id, "project" => project, "history_after" => history_after})
-        end
-
-        def proposal_revise(id, project:, expected_revision:, operation_id:, document:)
-          request("proposal-revise", {"id" => id, "project" => project, "expected_revision" => expected_revision, "operation_id" => operation_id, "document" => document})
-        end
-
-        def proposal_acknowledge(id, project:, submitted_at:)
-          request("proposal-ack", {"id" => id, "project" => project, "submitted_at" => submitted_at})
-        end
-
-        def proposal_reply(id, project:, **params)
-          request("proposal-reply", {"id" => id, "project" => project}.merge(params))
-        end
-
-        def proposal_reconcile(id, project:, checkpoint:)
-          request("proposal-reconcile", {"id" => id, "project" => project, "checkpoint" => checkpoint})
-        end
-
-        def proposal_wake(project:, after: nil)
-          request("proposal-wake", {"project" => project, "after" => after}.compact)
-        end
-
-        def proposal_due(project:, after: nil)
-          request("proposal-due", {"project" => project, "after" => after}.compact)
-        end
-
-        def proposal_history(project:, query: "", after: nil)
-          request("proposal-history", {"project" => project, "query" => query, "after" => after}.compact)
-        end
-
         def create(deadline: nil, **params)
           request("create", params.transform_keys(&:to_s), deadline: deadline)
         end

data/lib/ace/hitl/lifecycle/policy.rb

@@ -106,17 +106,6 @@ module Ace
           false
         end
 
-        def proposal?(_peer, project:)
-          false
-        end
-
-        def proposal_silence?(caller_uid:, requester:, project:, operation:)
-          false
-        end
-
-        def silence_operation?(project:, operation:)
-          false
-        end
         # @return [Boolean] true when the peer may deliver answers and
         #   observe pending/states for the given project
         def transport?(_peer, project: nil)
@@ -170,41 +159,8 @@ module Ace
           uid.is_a?(Integer) ? uid : nil
         end
 
-        # Decision admission is explicitly installed, never inferred from
-        # an ordinary requester or transport grant.
-        def proposal?(peer, project:)
-          current = document
-          proposal_principal?(peer.uid, project, current)
-        end
-
-        # A proposer grant allows asking. Only this separate, exact project
-        # operation list delegates a decision after the acknowledged window.
-        def proposal_silence?(caller_uid:, requester:, project:, operation:)
-          current = document
-          proposal_principal?(caller_uid, project, current) &&
-            delegated_operation?(project, operation, current)
-        end
-
-        def silence_operation?(project:, operation:)
-          delegated_operation?(project, operation, document)
-        end
-
         private
 
-        def proposal_principal?(uid, project, current)
-          uids = hitl_facts(current)["proposal_uids"]
-          projects = authorized_projects(uid, current)
-          uid.is_a?(Integer) && uids.is_a?(Array) && uids.include?(uid) && projects &&
-            (projects.empty? || projects.include?(project.to_s))
-        end
-
-        def delegated_operation?(project, operation, current)
-          delegations = hitl_facts(current)["silence_operations"]
-          operations = delegations.is_a?(Hash) && delegations[project]
-          operations.is_a?(Array) && operation.is_a?(String) &&
-            operation.match?(/\A[a-z][a-z0-9-]{0,63}\z/) && operations.include?(operation)
-        end
-
         def document
           @document || TrustedFile.read_yaml(@grants_path) || {}
         end

data/lib/ace/hitl/lifecycle/protocol.rb

@@ -14,8 +14,7 @@ module Ace
         VERSION = 1
         MAX_FRAME_BYTES = 64 * 1024
         DEFAULT_DEADLINE_SECONDS = 10.0
-        OPERATIONS = %w[operator-question create read deliver consume cancel pending states ping
-          proposal-create proposal-show proposal-revise proposal-ack proposal-reply proposal-reconcile proposal-due proposal-history proposal-wake].freeze
+        OPERATIONS = %w[operator-question create read deliver consume cancel pending states ping].freeze
 
         # Wire failures map to the transport error; classified lifecycle
         # failures pass through under their own names.

data/lib/ace/hitl/lifecycle/service.rb

@@ -41,7 +41,7 @@ module Ace
 
         def initialize(root:, binding:, policy:, socket_path:, group: Store::DEFAULT_GROUP,
           deadline_seconds: Protocol::DEFAULT_DEADLINE_SECONDS, vault: nil, logger: nil,
-          idle_seconds: DEFAULT_IDLE_SECONDS, proposal_clock: -> { Time.now.utc })
+          idle_seconds: DEFAULT_IDLE_SECONDS)
           @root = root
           @binding = binding
           @policy = policy
@@ -51,7 +51,6 @@ module Ace
           @vault = vault || OtpVault::MemoryVault.new
           @logger = logger
           @idle_seconds = idle_seconds
-          @proposal_clock = proposal_clock
           @max_connections = MAX_CONNECTIONS
           @connections = 0
           @handler_threads = []
@@ -249,7 +248,7 @@ module Ace
             policy: @policy,
             identity: peer,
             vault: @vault,
-            proposal_clock: @proposal_clock, stopping: -> { @stopping }, group: @group
+            stopping: -> { @stopping }, group: @group
           )
         end