ace-lab 0.13.1 → 0.14.1

data/lib/ace/lab/molecules/gemset_provisioner.rb

@@ -3,6 +3,7 @@
 require_relative "../errors"
 require "open3"
 require "fileutils"
+require_relative "gem_payload_permissions"
 
 module Ace
   module Lab
@@ -49,7 +50,12 @@ module Ace
             if runtime_failure
               base(gem, gem_home).merge("status" => "failed", "message" => runtime_failure)
             else
-              converge(base(gem, gem_home), gem, gem_home)
+              report = converge(base(gem, gem_home), gem, gem_home)
+              if %w[exists installed updated].include?(report["status"])
+                converge_post_presence(report, gem, gem_home)
+              else
+                report
+              end
             end
           end
         end
@@ -78,6 +84,55 @@ module Ace
           [:ok, versions]
         end
 
+        # Public READ-ONLY probes (verify, task 8xs.t.pu0.0): the same
+        # primitives convergence runs, exposed so readiness reuses the
+        # identical logic instead of reimplementing it.
+        #
+        # Unsatisfied runtime dependencies of the declared gem — the
+        # concrete missing-dependency list readiness reports.
+        # @return [Array(Symbol, Object)] [:ok, reasons] (empty reasons
+        #   = closed) or the failing probe's [:unknown/:failed,
+        #   message] — the same shape newer_versions returns.
+        def closure_failures(name:, version:, gem_home:)
+          queue = [[name, version]]
+          seen = {}
+          reasons = []
+          until queue.empty?
+            current_name, current_version = queue.shift
+            next if seen[[current_name, current_version]]
+
+            seen[[current_name, current_version]] = true
+            deps = runtime_dependencies(name: current_name, version: current_version, gem_home: gem_home)
+            return [:failed, deps] if deps.is_a?(String)
+
+            deps.each do |dep|
+              kind, versions_or_message = runtime_versions(name: dep["name"], gem_home: gem_home)
+              return [kind, versions_or_message] if kind != :ok
+
+              satisfying = satisfying_versions(dep, versions_or_message)
+              if satisfying.empty?
+                reasons << "dependency '#{dep["name"]} (#{dep["requirement"]})' required by gem " \
+                  "'#{current_name}' is not satisfied in runtime '#{gem_home}'"
+              else
+                queue << [dep["name"], satisfying.max_by { |v| Gem::Version.new(v) }]
+              end
+            end
+          end
+          [:ok, reasons]
+        end
+
+        # Installed versions of `name` NEWER than the declared one —
+        # the versions that would win activation and take over the CLI.
+        # @return [Array(String, Object)] [:ok, versions] or the probe's
+        #   [:unknown/:failed, message]
+        def newer_versions(name:, declared_version:, gem_home:)
+          kind, versions_or_message = runtime_versions(name: name, gem_home: gem_home)
+          return [kind, versions_or_message] if kind != :ok
+
+          declared = Gem::Version.new(declared_version)
+          [:ok, versions_or_message.select { |version| Gem::Version.new(version) > declared }]
+        end
+
         private
 
         def base(gem, gem_home)
@@ -132,6 +187,158 @@ module Ace
           end
         end
 
+        # Post-presence convergence (task 8xs.t.pu0.0): the declared
+        # version being present is necessary but not sufficient.
+        #   1. NEWER versions of the declared gem sitting beside the
+        #      declared one would win RubyGems activation and take over
+        #      the runtime's CLI — the manifest is the single owner of
+        #      the declared set, so convergence removes them from the
+        #      target runtime.
+        #   2. The dependency closure must actually resolve in the
+        #      runtime: a gem whose version already figures in
+        #      `gem list` can still miss a transitive runtime
+        #      dependency (the manually-repaired `json` class of gap);
+        #      missing dependencies are converged by installing them
+        #      at the parent's requirement, and an unsatisfiable
+        #      dependency is a classified failure — never readiness.
+        # A dry run predicts both without writing (would_uninstall /
+        # would_install) and stops recursion at the prediction.
+        def converge_post_presence(report, gem, gem_home)
+          removal = converge_newer_versions(gem, gem_home)
+          return report.merge("status" => "failed", "message" => removal) if removal.is_a?(String)
+          report["removed_newer_versions"] = removal
+
+          closure = converge_closure(gem, gem_home)
+          return report.merge("status" => "failed", "message" => closure) if closure.is_a?(String)
+          report["closure"] = closure
+          permissions = GemPayloadPermissions.new(gem_home: gem_home, dry_run: @dry_run,
+            privileged: @privileged.call).call(name: gem["name"], version: gem["version"])
+          report["permissions"] = permissions
+          report
+        rescue GemPayloadPermissions::Error => e
+          report.merge("status" => "failed", "message" => e.message)
+        end
+
+        # @return [Array<Hash>, String] per-version removal reports or a
+        #   classified failure message
+        def converge_newer_versions(gem, gem_home)
+          kind, versions_or_message = runtime_versions(name: gem["name"], gem_home: gem_home)
+          return versions_or_message if kind != :ok
+
+          declared = Gem::Version.new(gem["version"])
+          newer = versions_or_message.select { |version| Gem::Version.new(version) > declared }
+          return [] if newer.empty?
+
+          return newer.map { |version| {"version" => version, "status" => "would_uninstall"} } if @dry_run
+
+          newer.map do |version|
+            result = @runner.call(runtime_argv(gem_home,
+              ["gem", "uninstall", gem["name"], "--version", version, "-x", "--force"]))
+            if result["status"] != "ok"
+              break command_failure("gem uninstall #{gem["name"]} #{version}", result)
+            end
+            {"version" => version, "status" => "uninstalled"}
+          end
+        end
+
+        # Breadth-first walk of the gem's RUNTIME dependency closure in
+        # the target runtime. `gem dependency` output is plain text (no
+        # marshaled objects), development dependencies are ignored.
+        # @return [Array<Hash>, String] per-dependency convergence
+        #   actions or a classified failure message
+        def converge_closure(gem, gem_home)
+          queue = [[gem["name"], gem["version"]]]
+          seen = {}
+          actions = []
+          until queue.empty?
+            name, version = queue.shift
+            next if seen[[name, version]]
+
+            seen[[name, version]] = true
+            deps = runtime_dependencies(name: name, version: version, gem_home: gem_home)
+            return deps if deps.is_a?(String)
+
+            deps.each do |dep|
+              kind, versions_or_message = runtime_versions(name: dep["name"], gem_home: gem_home)
+              return versions_or_message if kind != :ok
+
+              satisfying = satisfying_versions(dep, versions_or_message)
+              if satisfying.empty?
+                if @dry_run
+                  actions << {"name" => dep["name"], "requirement" => dep["requirement"],
+                              "status" => "would_install"}
+                  next # recursion stops at the prediction
+                end
+
+                failure = install_dependency(dep, gem_home)
+                return failure if failure
+
+                kind, versions_or_message = runtime_versions(name: dep["name"], gem_home: gem_home)
+                return versions_or_message if kind != :ok
+                satisfying = satisfying_versions(dep, versions_or_message)
+                if satisfying.empty?
+                  return "dependency '#{dep["name"]} (#{dep["requirement"]})' required by gem " \
+                    "'#{name}' is not satisfiable in runtime '#{gem_home}' after install; " \
+                    "check the gem source or the manifest declaration"
+                end
+                actions << {"name" => dep["name"], "requirement" => dep["requirement"],
+                            "status" => "installed"}
+              end
+
+              chosen = satisfying.max_by { |v| Gem::Version.new(v) }
+              queue << [dep["name"], chosen]
+            end
+          end
+          actions
+        end
+
+        # Installs a missing dependency at the parent requirement: the
+        # requirement string the runtime's own resolver would accept
+        # (`gem install name -v "~> 2.7"`).
+        # @return [String, nil] classified failure, nil on success
+        def install_dependency(dep, gem_home)
+          result = @runner.call(runtime_argv(gem_home,
+            ["gem", "install", dep["name"], "--version", dep["requirement"], "--no-document"]))
+          return nil if result["status"] == "ok"
+
+          command_failure("gem install #{dep["name"]}", result)
+        end
+
+        # The runtime (non-development) dependencies of an installed
+        # gem, from `gem dependency <name> --version <v>` plain-text
+        # output: "dep (~> 2.0, runtime)" lines under the gem header.
+        # @return [Array<Hash{"name","requirement"}>, String] or a
+        #   classified failure message
+        def runtime_dependencies(name:, version:, gem_home:)
+          result = @runner.call(runtime_argv(gem_home,
+            ["gem", "dependency", name, "--version", version]))
+          if result["status"] == "enoent"
+            return "gem not found in PATH; install RubyGems and rerun ace-lab prepare"
+          end
+          return "gem dependency failed (#{exit_detail(result["status"])}); rerun ace-lab prepare" \
+            unless result["status"] == "ok"
+
+          result["out"].lines.filter_map do |line|
+            match = line.match(/\A\s+([A-Za-z0-9._-]+) \(([^)]*)\)\s*\z/)
+            next if match.nil?
+
+            parts = match[2].split(",").map(&:strip)
+            type = %w[runtime development].include?(parts.last) ? parts.pop : "runtime"
+            next if type == "development"
+
+            requirement = parts.join(", ")
+            requirement = ">= 0" if requirement.empty?
+            {"name" => match[1], "requirement" => requirement}
+          end
+        end
+
+        def satisfying_versions(dep, versions)
+          requirement = dep["requirement"].split(",").map(&:strip)
+          versions.select do |version|
+            Gem::Dependency.new(dep["name"], *requirement).match?(dep["name"], version)
+          end
+        end
+
         # Installs the EXACT declared version into the runtime. Sources
         # are the gem command's own defaults — fetching from the
         # configured gem source is provisioning network access, the same
@@ -169,8 +376,16 @@ module Ace
 
         # `gem list <name> --exact --local` prints one `name (v1, v2)`
         # line when the name is present in the runtime and nothing when
-        # it is absent. A present-but-unparseable line is a failed probe
-        # (nil, fail closed), never a guessed empty list.
+        # it is absent. A DEFAULT gem's bundled version appears as a
+        # `default: V` part (`abbrev (default: 0.1.2)`,
+        # `json (2.9.4, default: 2.9.1)`): the marked V is the default
+        # gem's own version, every other part is an additionally
+        # installed version — both are present in the runtime, so the
+        # normalized list carries the marked version in place of the
+        # marker. Every candidate is validated by Gem::Version itself —
+        # platform-suffixed or otherwise malformed strings fail the
+        # probe (nil, fail closed) instead of crashing a later
+        # Gem::Version.new caller; never a guessed empty list.
         def parse_versions(out, name)
           line = out.lines.find { |candidate| candidate.start_with?("#{name} ") }
           return [] if line.nil?
@@ -178,7 +393,17 @@ module Ace
           match = line.chomp.match(/\A#{Regexp.escape(name)} \((.*)\)\z/)
           return nil if match.nil?
 
-          match[1].split(",").map(&:strip)
+          versions = match[1].split(",").map(&:strip).map do |part|
+            default = part.match(/\Adefault: (\S+)\z/)
+            default ? default[1] : part
+          end
+          begin
+            versions.each { |version| Gem::Version.new(version) }
+          rescue ArgumentError
+            return nil
+          end
+
+          versions
         end
 
         # Classified one-line command failure: status plus the first

data/lib/ace/lab/molecules/project_locations.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require "yaml"
+
+module Ace
+  module Lab
+    module Molecules
+      # INTERNAL project-location read for the lab-level overseer start
+      # (task 8xs.t.pu0.a): the project list and their CANONICAL
+      # locations come from the raw topology configuration
+      # (`topology.projects`: id/path) read at the lab root — the schema
+      # normalization and the public projection deliberately strip paths,
+      # so this reader goes to the raw cascade document and takes only
+      # what the start needs. Locations are never derived from a public
+      # id/label or a repo name. The public CLI keeps its allowlisted
+      # projection; only the start operation consumes locations,
+      # in-process.
+      class ProjectLocations
+        # @param lab_root [String] lab coordination directory whose
+        #   cascade lists the configured projects
+        # @return [Array<Hash>] {"id" =>, "path" =>} sorted by id; a
+        #   project entry without a usable path is returned with a nil
+        #   path so its OWN start reports the concrete error
+        # @raise [Ace::Lab::InvalidConfigurationError] the topology
+        #   configuration could not be read or has no project list
+        def self.read(lab_root)
+          config_path = File.join(lab_root, ".ace/lab/config.yml")
+          document = YAML.safe_load_file(config_path,
+            permitted_classes: [Date], aliases: true)
+          unless document.is_a?(Hash)
+            raise Ace::Lab::InvalidConfigurationError, ".ace/lab/config.yml must be a mapping"
+          end
+
+          raw = document.dig("topology", "projects")
+          unless raw.is_a?(Array)
+            raise Ace::Lab::InvalidConfigurationError,
+              "topology.projects must be a list in .ace/lab/config.yml"
+          end
+
+          raw.map do |entry|
+            next {"id" => nil, "path" => nil} unless entry.is_a?(Hash)
+
+            # A nil/blank path encoding is returned as a nil path (the
+            # project's OWN start reports the concrete error) — never a
+            # bogus empty-string path, never an exception. The config is
+            # read by explicit path: no global cwd mutation.
+            path = entry["path"]
+            path = nil unless path.is_a?(String) && !path.strip.empty?
+            {"id" => entry["id"].to_s, "path" => path}
+          end.sort_by { |project| project["id"].to_s }
+        rescue Errno::ENOENT
+          raise Ace::Lab::InvalidConfigurationError,
+            "no lab configuration at #{lab_root}/.ace/lab/config.yml; run " \
+              "ace-lab project add or fix the lab root"
+        rescue Psych::SyntaxError => e
+          raise Ace::Lab::InvalidConfigurationError,
+            "lab configuration could not be parsed: #{e.message}"
+        end
+      end
+    end
+  end
+end

data/lib/ace/lab/organisms/prepare.rb

@@ -7,6 +7,7 @@ require_relative "../molecules/directory_provisioner"
 require_relative "../molecules/key_provisioner"
 require_relative "../molecules/role_verifier"
 require_relative "../molecules/gemset_provisioner"
+require_relative "../molecules/extension_provisioner"
 
 module Ace
   module Lab
@@ -51,9 +52,11 @@ module Ace
             unresolved, effective_dry_run)
           roles = prepare_roles(manifest["roles"], available, unresolved, effective_dry_run)
           gems = prepare_gems(manifest["gemset"], effective_dry_run)
+          extensions = prepare_extensions(manifest["gemset"], effective_dry_run, gems)
 
           {
-            "ok" => [accounts, directories, keys, roles, gems].flatten.none? { |item| item["status"] == "failed" },
+            "ok" => [accounts, directories, keys, roles, gems, extensions].flatten
+              .none? { |item| item["status"] == "failed" },
             "dry_run" => effective_dry_run,
             "machine" => manifest["machine"],
             "manifest" => manifest_path,
@@ -61,7 +64,8 @@ module Ace
             "directories" => directories,
             "keys" => keys,
             "roles" => roles,
-            "gems" => gems
+            "gems" => gems,
+            "extensions" => extensions
           }
         end
 
@@ -152,6 +156,28 @@ module Ace
           provisioner.call(runtime: runtime)
         end
 
+        # Harness extension projections (task 8xs.t.pu0.0): converged
+        # from the installed gem's exact declared version after the
+        # gemset phase; a gem phase failure fails every extension as a
+        # dependency (the projection source would not exist).
+        def prepare_extensions(runtime, dry_run, gems)
+          entries = runtime["extensions"]
+          return [] if entries.empty?
+
+          if gems.any? { |gem| gem["status"] == "failed" }
+            return entries.map do |entry|
+              {"extension" => entry["gem"], "gem" => entry["gem"], "version" => nil,
+               "path" => entry["path"], "account" => entry["account"], "status" => "failed",
+               "loaded_version" => nil, "restart_required" => false, "files" => [],
+               "message" => "gemset convergence failed; fix the gem phase first"}
+            end
+          end
+
+          Molecules::ExtensionProvisioner.new(
+            gem_home: runtime["gem_home"], dry_run: dry_run, account_lookup: @account_lookup
+          ).call(extensions: entries, gems: runtime["gems"])
+        end
+
         def available_accounts(account_reports)
           account_reports.reject { |report| report["status"] == "failed" }
             .map { |report| report["username"] }

data/lib/ace/lab/organisms/verify.rb

@@ -5,11 +5,14 @@ require_relative "../molecules/install_manifest_loader"
 require_relative "../molecules/key_provisioner"
 require_relative "../molecules/role_verifier"
 require_relative "../molecules/gemset_provisioner"
+require_relative "../molecules/extension_provisioner"
 require_relative "../molecules/hitl_routes"
 require_relative "../molecules/caller_authorizer"
 require_relative "../atoms/topology_schema"
 require "open3"
 require "yaml"
+require "json"
+require "fileutils"
 require "date"
 
 module Ace
@@ -99,7 +102,8 @@ module Ace
             "overseer" => check_overseer(manifest),
             "adapters" => check_adapters(manifest, executors),
             "tools" => check_tools(manifest, executors),
-            "gems" => check_gems(manifest)
+            "gems" => check_gems(manifest),
+            "extensions" => check_extensions(manifest, entries)
           }
           flat = checks.values.flatten(1)
           {
@@ -583,20 +587,146 @@ module Ace
             kind, versions_or_message = provisioner.runtime_versions(
               name: gem["name"], gem_home: gem_home
             )
-            reason = case kind
-            when :unknown, :failed then versions_or_message
-            when :ok then gem_version_reason(gem, versions_or_message, gem_home)
-            end
-            status = case kind
-            when :ok then reason ? FAIL : PASS
-            when :unknown then UNKNOWN
-            else FAIL
+            status, reason = if kind != :ok
+              [kind == :unknown ? UNKNOWN : FAIL, versions_or_message]
+            else
+              verify_present_gem(provisioner, gem, versions_or_message, gem_home)
             end
             {"gem" => gem["name"], "version" => gem["version"], "gem_home" => gem_home,
              "status" => status, "reason" => reason}
           end
         end
 
+        # A gem whose exact declared version is present must ALSO prove
+        # (1) its runtime dependency closure resolves in the target
+        # runtime — a gem listed in `gem list` with a missing
+        # transitive dependency is NOT ready (task 8xs.t.pu0.0) — and
+        # (2) no NEWER version sits beside the declared one: RubyGems
+        # activates the highest installed version, so a newer sibling
+        # would silently take over the runtime's CLI.
+        def verify_present_gem(provisioner, gem, versions, gem_home)
+          reason = gem_version_reason(gem, versions, gem_home)
+          return [FAIL, reason] if reason
+
+          newer_kind, newer_or_message = provisioner.newer_versions(
+            name: gem["name"], declared_version: gem["version"], gem_home: gem_home
+          )
+          if newer_kind != :ok
+            return [newer_kind == :unknown ? UNKNOWN : FAIL, newer_or_message]
+          end
+          unless newer_or_message.empty?
+            return [FAIL,
+              "gem '#{gem["name"]}' has newer version(s) #{newer_or_message.join(", ")} beside " \
+                "the declared #{gem["version"]} in '#{gem_home}'; the newer version would take " \
+                "over CLI activation; rerun ace-lab install"]
+          end
+
+          closure_kind, closure_or_message = provisioner.closure_failures(
+            name: gem["name"], version: gem["version"], gem_home: gem_home
+          )
+          return [closure_kind == :unknown ? UNKNOWN : FAIL, closure_or_message] if closure_kind != :ok
+          return [FAIL, closure_or_message.join("; ")] unless closure_or_message.empty?
+
+          [PASS, nil]
+        end
+
+        # Declared harness extension projections (task 8xs.t.pu0.0):
+        # re-derived from the same receipts and installed gem trees the
+        # provisioner converges (shared ExtensionProjection helpers) —
+        # the receipt must name the declared gem at its exact declared
+        # version, every projected file must match the installed gem's
+        # handbook/extensions content, the destination must not escape
+        # the extensions directory through a symlinked component, and
+        # the projected files must grant the declared account read.
+        def check_extensions(manifest, entries)
+          gemset = manifest["gemset"]
+          gemset["extensions"].map do |entry|
+            declared = gemset["gems"].find { |gem| gem["name"] == entry["gem"] }
+            reason = if declared.nil?
+              "extension source gem '#{entry["gem"]}' is not declared in the gemset"
+            else
+              extension_reason(entry, declared, gemset["gem_home"], entries[entry["account"]])
+            end
+            {"extension" => entry["gem"], "gem" => entry["gem"], "path" => entry["path"],
+             "account" => entry["account"], "status" => reason ? FAIL : PASS, "reason" => reason}
+          end
+        end
+
+        def extension_reason(entry, declared, gem_home, account_entry)
+          source_root = Molecules::ExtensionProjection.gem_source_root(
+            gem_home, entry["gem"], declared["version"]
+          )
+          return "gem '#{entry["gem"]}' #{declared["version"]} is not installed with a " \
+            "handbook/extensions tree in '#{gem_home}'; rerun ace-lab install" unless File.directory?(source_root)
+
+          receipt_path = File.join(entry["path"], Molecules::ExtensionProvisioner::RECEIPT_NAME)
+          unless File.file?(receipt_path)
+            return "extension projection receipt '#{receipt_path}' is missing; rerun ace-lab install"
+          end
+
+          begin
+            receipt = JSON.parse(File.read(receipt_path))
+          rescue JSON::ParserError
+            return "extension projection receipt '#{receipt_path}' is not valid JSON; rerun ace-lab install"
+          rescue Errno::EACCES, Errno::ENOENT
+            return "extension projection receipt '#{receipt_path}' is not readable; " \
+              "rerun ace-lab install"
+          end
+          if receipt["gem"] != entry["gem"] || receipt["version"] != declared["version"]
+            return "extension projection at '#{entry["path"]}' was projected from " \
+              "'#{receipt["gem"]} #{receipt["version"]}' but the manifest declares " \
+              "'#{entry["gem"]} #{declared["version"]}'; rerun ace-lab install"
+          end
+
+          expected = Molecules::ExtensionProjection.source_files(source_root)
+          listed = receipt.fetch("files", [])
+          if listed.sort != expected.keys.sort
+            return "extension projection at '#{entry["path"]}' lists different files than " \
+              "gem '#{entry["gem"]}' #{declared["version"]} carries; rerun ace-lab install"
+          end
+
+          # A destination that escapes the extensions directory through
+          # a symlinked component is refused before any comparison (the
+          # same validate_destination posture convergence applies).
+          begin
+            expected.each_key do |relative|
+              Molecules::ExtensionProjection.validate_destination!(entry["path"], relative)
+            end
+          rescue Ace::Lab::Error => e
+            return "#{e.message}; rerun ace-lab install"
+          end
+
+          mismatch = expected.find do |relative, source|
+            target = File.join(entry["path"], relative)
+            !File.file?(target) || !FileUtils.compare_file(source, target)
+          end
+          return "extension projection file '#{mismatch.first}' differs from gem " \
+            "'#{entry["gem"]}' #{declared["version"]}; rerun ace-lab install" if mismatch
+
+          # Declared-account readability (stat-based — the verifier
+          # does not run as the declared account): a projected file is
+          # readable when it is world-readable, or owner-readable AND
+          # owned by the declared account's uid.
+          unreadable = expected.keys.find do |relative|
+            unreadable_reason(File.join(entry["path"], relative), account_entry)
+          end
+          return "extension projection file '#{unreadable}' is not readable by the declared " \
+            "account '#{entry["account"]}'; rerun ace-lab install" if unreadable
+
+          nil
+        end
+
+        def unreadable_reason(path, account_entry)
+          stat = lstat(path)
+          return true if stat.nil? || !stat.file? || stat.symlink?
+
+          mode = stat.mode & 0o777
+          return false if (mode & 0o004) != 0 # world-readable
+          return false if (mode & 0o400) != 0 && account_entry && stat.uid == account_entry.uid
+
+          true
+        end
+
         def gem_version_reason(gem, versions, gem_home)
           return nil if versions.include?(gem["version"])
           if versions.empty?

data/lib/ace/lab/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Lab
-    VERSION = "0.13.1"
+    VERSION = "0.14.1"
   end
 end

data/lib/ace/lab.rb

@@ -18,6 +18,7 @@ require_relative "lab/models/topology_entry"
 require_relative "lab/models/query_result"
 require_relative "lab/models/status_report"
 require_relative "lab/molecules/topology_loader"
+require_relative "lab/molecules/project_locations"
 require_relative "lab/molecules/config_state_classifier"
 require_relative "lab/molecules/lab_state_scanner"
 require_relative "lab/molecules/caller_authorizer"

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-lab
 version: !ruby/object:Gem::Version
-  version: 0.13.1
+  version: 0.14.1
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-26 00:00:00.000000000 Z
+date: 2026-11-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-support-cli
@@ -173,9 +173,19 @@ files:
 - lib/ace/lab/atoms/install_schema.rb
 - lib/ace/lab/atoms/public_projection.rb
 - lib/ace/lab/atoms/topology_schema.rb
+- lib/ace/lab/auth.rb
+- lib/ace/lab/auth/credential_handoff.rb
+- lib/ace/lab/auth/lease_store.rb
+- lib/ace/lab/auth/plugins/env_provider.rb
+- lib/ace/lab/auth/plugins/forgejo_provider.rb
+- lib/ace/lab/auth/plugins/github_provider.rb
+- lib/ace/lab/auth/profile_schema.rb
+- lib/ace/lab/auth/providers.rb
+- lib/ace/lab/auth/service.rb
 - lib/ace/lab/authorization_path.rb
 - lib/ace/lab/cli.rb
 - lib/ace/lab/cli/commands/agents.rb
+- lib/ace/lab/cli/commands/auth.rb
 - lib/ace/lab/cli/commands/install.rb
 - lib/ace/lab/cli/commands/prepare.rb
 - lib/ace/lab/cli/commands/project_add.rb
@@ -198,8 +208,11 @@ files:
 - lib/ace/lab/molecules/config_state_classifier.rb
 - lib/ace/lab/molecules/directory_provisioner.rb
 - lib/ace/lab/molecules/exact_resolver.rb
+- lib/ace/lab/molecules/extension_projection.rb
+- lib/ace/lab/molecules/extension_provisioner.rb
 - lib/ace/lab/molecules/forge_merge_config.rb
 - lib/ace/lab/molecules/forgejo_merge_adapter.rb
+- lib/ace/lab/molecules/gem_payload_permissions.rb
 - lib/ace/lab/molecules/gemset_provisioner.rb
 - lib/ace/lab/molecules/grant_provisioner.rb
 - lib/ace/lab/molecules/grant_resolver.rb
@@ -209,6 +222,7 @@ files:
 - lib/ace/lab/molecules/key_provisioner.rb
 - lib/ace/lab/molecules/lab_state_scanner.rb
 - lib/ace/lab/molecules/overseer_provisioner.rb
+- lib/ace/lab/molecules/project_locations.rb
 - lib/ace/lab/molecules/project_registry.rb
 - lib/ace/lab/molecules/repository_provisioner.rb
 - lib/ace/lab/molecules/role_verifier.rb