ace-lab 0.7.0 → 0.9.0

data/lib/ace/lab/organisms/ordinary_merge_receiver.rb

@@ -7,7 +7,7 @@ require "uri"
 require_relative "ordinary_merge_request"
 require_relative "../molecules/ordinary_receiver_config"
 require_relative "../molecules/ordinary_admission_resolver"
-require_relative "../molecules/ordinary_ff_merge"
+require_relative "../molecules/ordinary_merge_read"
 require_relative "../molecules/forge_merge_config"
 require_relative "../molecules/forgejo_merge_adapter"
 require "ace/assign/atoms/fixed_merge_schemas"
@@ -58,31 +58,37 @@ module Ace
           authorization request_id input_digest request principal receiver_id
           configuration_sha256].freeze
         ID = Molecules::ServicePolicy::ID
-        NO_EFFECT_DIR = ".ace/ordinary-no-effect"
 
         def initialize(config:, coordinator:, policy_document:, merge_factory: nil,
           forge_config: nil, forge_factory: nil, resolver: nil,
-          readback_attempts: 3, readback_backoff_seconds: 1.0)
+          readback_attempts: 3, readback_backoff_seconds: 1.0, owner_guard: nil)
           unless config.is_a?(Molecules::OrdinaryReceiverConfig)
             raise ArgumentError, "receiver needs validated OrdinaryReceiverConfig"
           end
           @config = config
+          unless owner_guard.nil? || owner_guard.respond_to?(:call)
+            raise ArgumentError, "ordinary installed owner guard must be callable"
+          end
+          @owner_guard = owner_guard
           @coordinator = coordinator
           @policy_document = policy_document
-          @configuration_sha256 = Ace::Lab::Atoms::ServiceInput.digest(policy_document)
+          @configuration_sha256 = Molecules::ServicePolicy.configuration_digest(policy_document)
           @merge_factory = merge_factory || ->(document) {
-            Molecules::OrdinaryFfMerge.new(repo_path: config.repo_path,
+            Molecules::OrdinaryMergeRead.new(repo_path: config.repo_path,
               base_ref: document.fetch("base_ref"))
           }
           # The scoped service identity is host-installed; an absent
           # configuration refuses construction with the actionable path.
-          @forge_config = forge_config || Molecules::ForgeMergeConfig.load
+          @forge_config = forge_config || Molecules::ForgeMergeConfig.load(
+            config.forge_config_path || Molecules::ForgeMergeConfig::DEFAULT_PATH
+          )
           @forge_factory = forge_factory || ->(_document) {
             Molecules::ForgejoMergeAdapter.new(base_url: @forge_config.base_url,
               token: @forge_config.token, timeout_seconds: @forge_config.merge_timeout_seconds)
           }
           @resolver = resolver || Molecules::OrdinaryAdmissionResolver.new(
-            policy_document, path: config.policy_path
+            policy_document, path: config.policy_path,
+            proposal_resolver: coordinator.method(:proposal_authorization), caller_uid: config.principal_uid
           )
           @readback_attempts = readback_attempts
           @readback_backoff_seconds = readback_backoff_seconds
@@ -101,6 +107,7 @@ module Ace
         # Assign record exists, or a closed pre-effect refusal envelope that
         # proves no effect began. Never a receiver-local record.
         def handle(submission)
+          @owner_guard&.call
           invalid!("submission is not a mapping") unless submission.is_a?(Hash)
           invalid!("submission has unknown selectors: #{unknown(submission)}") unless
             (submission.keys - SUBMISSION_KEYS).empty?
@@ -133,11 +140,9 @@ module Ace
           unless digest == submission.fetch("input_digest")
             invalid!("canonical request digest does not re-derive from the submission", request_id)
           end
-          # Selection and evidence integrity before authorization: the PR
-          # must target THIS receiver's configured forge repository, and the
-          # handed-over review must be independent of the executor.
+          # Forge selection precedes authorization. Reviewer independence is
+          # resolved by the canonical owner from native starts, not actor names.
           forge_identity!(document, request_id)
-          reviewer_independence!(document, request_id)
           decision = @resolver.decide(submission.fetch("authorization"), authorization_binding(submission))
           unless decision.authorized?
             return OrdinaryMergeRequest.refusal_envelope(decision.code, decision.message,
@@ -149,7 +154,7 @@ module Ace
         rescue OrdinaryMergeRefusal => e
           OrdinaryMergeRequest.refusal_envelope(e.code, e.detail,
             request_id: e.request_id, input_digest: e.input_digest)
-        rescue Ace::Assign::AttemptErrors::AuthorizationConflict => e
+        rescue Ace::Assign::AttemptErrors::AuthorizationConflict, Ace::Assign::AttemptErrors::ReceiptRejected => e
           OrdinaryMergeRequest.refusal_envelope("ordinary_merge_authorization_invalid", e.message,
             request_id: submission.is_a?(Hash) ? submission.fetch("request_id", "unknown") : "unknown",
             input_digest: nil)
@@ -157,7 +162,7 @@ module Ace
           OrdinaryMergeRequest.refusal_envelope("ordinary_merge_request_conflict", e.message,
             request_id: submission.is_a?(Hash) ? submission.fetch("request_id", "unknown") : "unknown",
             input_digest: nil)
-        rescue Molecules::OrdinaryFfMerge::GitUnavailable, Ace::Assign::AttemptErrors::EvidenceUnavailable,
+        rescue Molecules::OrdinaryMergeRead::GitUnavailable, Ace::Assign::Error,
           Ace::Lab::InvalidConfigurationError => e
           OrdinaryMergeRequest.refusal_envelope("ordinary_merge_unavailable", e.message,
             request_id: submission.is_a?(Hash) ? submission.fetch("request_id", "unknown") : "unknown",
@@ -173,13 +178,25 @@ module Ace
         # real forge readback. Any crash between begin and settle leaves the
         # canonical record uncertain with the original reference.
         def execute(request_id)
+          @owner_guard&.call
           record = @coordinator.fixed_merge_record(request_id)
           return :unknown unless record
           return :skipped_terminal unless record.fetch("state") == "pending"
-          @coordinator.begin_fixed_merge_effect(request_id)
-          execute_effect(record)
+          begin
+            @coordinator.begin_fixed_merge_effect(request_id)
+          rescue Ace::Assign::AttemptErrors::ReceiptRejected, Ace::Assign::AttemptErrors::AuthorizationConflict
+            settle_no_effect(request_id, record, "canonical proposal is no longer authorized before effect")
+            return :refused
+          end
+          begin
+            @coordinator.with_fixed_merge_evidence(record) { execute_effect(record) }
+          rescue Ace::Assign::AttemptErrors::ReceiptRejected
+            settle_no_effect(request_id, record, "canonical review or executed test proof changed before effect")
+            return :refused
+          end
           :executed
-        rescue Ace::Assign::AttemptErrors::InvalidState, Ace::Assign::AttemptErrors::NotFound
+        rescue Ace::Assign::AttemptErrors::InvalidState, Ace::Assign::AttemptErrors::NotFound,
+          Ace::Assign::AttemptErrors::Conflict
           # Another lifecycle won the CAS or the record is terminal: never a
           # second effect, never a resubmission.
           :skipped_terminal
@@ -190,6 +207,7 @@ module Ace
         # a terminal state at most once. Already-uncertain records (a lost
         # lifecycle) are never re-executed — they reconcile by reference.
         def recover_pending!
+          @owner_guard&.call
           records = @coordinator.fixed_merge_records
           records.filter_map do |record|
             next nil unless record.fetch("state") == "pending" &&
@@ -267,6 +285,7 @@ module Ace
         def admit(submission)
           record = submission.merge(
             "principal" => @config.principal,
+            "caller_uid" => @config.principal_uid,
             "execution_identity" => @config.execution_identity
           )
           @coordinator.admit_fixed_merge_request(record)
@@ -294,16 +313,18 @@ module Ace
           candidate = document.fetch("candidate_head")
           expected = document.fetch("expected_base_head")
           merge = @merge_factory.call(document)
+          refusal = current_authorization_refusal(admitted_record)
+          return settle_no_effect(request_id, admitted_record, refusal) if refusal
           observed = merge.base_head
           if observed != expected
-            return settle_no_effect(request_id, admitted_record, merge,
+            return settle_no_effect(request_id, admitted_record,
               "base head moved before the effect: #{observed[0, 12]}")
           end
           identity = forge_identity!(document, request_id)
           forge = @forge_factory.call(document)
           pr = readback(forge, identity)
           if pr.nil?
-            return settle_no_effect(request_id, admitted_record, merge,
+            return settle_no_effect(request_id, admitted_record,
               "pull request is absent from the forge")
           end
           if pr["merged"]
@@ -318,40 +339,55 @@ module Ace
               owner: @forge_config.escalation_owner)
           end
           unless pr.dig("head", "sha") == candidate
-            return settle_no_effect(request_id, admitted_record, merge,
+            return settle_no_effect(request_id, admitted_record,
               "forge pull request head moved from the approved candidate")
           end
           unless pr.dig("base", "sha") == expected
-            return settle_no_effect(request_id, admitted_record, merge,
+            return settle_no_effect(request_id, admitted_record,
               "forge base head moved from the immutable request")
           end
+          refusal = current_authorization_refusal(admitted_record)
+          return settle_no_effect(request_id, admitted_record, refusal) if refusal
           refusal = attach_independent_review!(forge, identity, request_id,
-            admitted_record, merge, document)
+            admitted_record, document)
           return refusal if refusal
           # Exact-head contract: the merge POST binds the approved candidate
           # head server-side — the forge refuses to merge any head other
           # than the reviewed candidate (race between readback and POST can
           # never merge an unreviewed head).
+          refusal = current_authorization_refusal(admitted_record)
+          return settle_no_effect(request_id, admitted_record, refusal) if refusal
           result = forge.merge_pull_request!(owner: identity.fetch("owner"),
             repo: identity.fetch("repo"), index: identity.fetch("index"),
             head_commit_id: candidate)
           case result.outcome
           when :invoked
-            reconcile_invoked(forge, identity, request_id, admitted_record, merge,
+            reconcile_invoked(forge, identity, request_id, admitted_record,
               document, candidate)
           when :refused
-            settle_no_effect(request_id, admitted_record, merge,
+            settle_no_effect(request_id, admitted_record,
               "forge refused the merge: #{result.reason}")
           else
-            reconcile_ambiguous(forge, identity, request_id, admitted_record, merge,
+            reconcile_ambiguous(forge, identity, request_id, admitted_record,
               document, candidate, result.reason)
           end
-        rescue Molecules::OrdinaryFfMerge::GitUnavailable, Molecules::ForgejoMergeAdapter::Unavailable => e
+        rescue Molecules::OrdinaryMergeRead::GitUnavailable, Molecules::ForgejoMergeAdapter::Unavailable => e
           # The effect outcome is unprovable: the canonical record stays
           # uncertain with the original reference — never a resubmission.
           leave_uncertain(request_id, e.message)
         end
 
+        # Recheck pending/recovered authority and again after slow forge calls,
+        # immediately before each privileged effect. No cached decision is a lease.
+        def current_authorization_refusal(record)
+          @owner_guard&.call
+          @coordinator.verify_fixed_merge_evidence!(record)
+          decision = @resolver.decide(record.fetch("authorization"), authorization_binding(record))
+          decision.message unless decision.authorized?
+        rescue Ace::Lab::InvalidConfigurationError, Ace::Assign::Error => e
+          e.message
+        end
+
         # The merge invocation was accepted: prove the terminal state by
         # readback before any settlement. A readback showing a merge at any
         # head other than the approved candidate is never a success. A 404
@@ -361,7 +397,7 @@ module Ace
         # absence of effect — the record stays uncertain with the original
         # reference, the escalation owner named, no no-effect attestation
         # and no retry, never a re-invocation.
-        def reconcile_invoked(forge, identity, request_id, admitted_record, merge,
+        def reconcile_invoked(forge, identity, request_id, admitted_record,
           document, candidate)
           pr = readback(forge, identity)
           if pr.nil?
@@ -389,7 +425,7 @@ module Ace
         # never a fabricated no-effect claim while the forge may still be
         # applying the invocation. A 404 after the invocation stays in the
         # same uncertain family: absence cannot prove no effect.
-        def reconcile_ambiguous(forge, identity, request_id, admitted_record, merge,
+        def reconcile_ambiguous(forge, identity, request_id, admitted_record,
           document, candidate, reason)
           pr = readback(forge, identity)
           if pr.nil?
@@ -419,7 +455,7 @@ module Ace
         # refused or ambiguous attachment settles failed_no_effect: the merge
         # was never invoked, so no effect provably occurred.
         def attach_independent_review!(forge, identity, request_id, admitted_record,
-          merge, document)
+          document)
           return nil unless @forge_config.review_attachment_enabled
           evidence = document.fetch("review_evidence")
           body = [
@@ -438,10 +474,10 @@ module Ace
           when :invoked
             nil
           when :refused
-            settle_no_effect(request_id, admitted_record, merge,
+            settle_no_effect(request_id, admitted_record,
               "forge refused the independent review attachment: #{result.reason}")
           else
-            settle_no_effect(request_id, admitted_record, merge,
+            settle_no_effect(request_id, admitted_record,
               "independent review attachment outcome ambiguous; merge not invoked: #{result.reason}")
           end
         end
@@ -512,11 +548,14 @@ module Ace
         end
 
         # Terminal failure requires the immutable no-effect attestation: an
-        # executor-owned file inside the canonical repository whose SHA-256
-        # binds the no-merge proof to this exact request.
-        def settle_no_effect(request_id, admitted_record, merge, reason)
+        # blob committed atomically with the terminal receipt in Assign's
+        # canonical evidence ref. No caller checkout path is written.
+        def settle_no_effect(request_id, admitted_record, reason)
           record = @coordinator.fixed_merge_record(request_id)
           document = record.fetch("request")
+          # Provider I/O has its own lifetime. Settlement needs a fresh bounded
+          # local observation, never the expired pre-effect read deadline.
+          merge = @merge_factory.call(document)
           attestation = {
             "request_id" => request_id,
             "input_digest" => record.fetch("input_digest"),
@@ -524,12 +563,11 @@ module Ace
             "candidate_head" => document.fetch("candidate_head"),
             "expected_base_head" => document.fetch("expected_base_head"),
             "observed_base_head" => merge.base_head,
-            "strategy" => Molecules::OrdinaryFfMerge::STRATEGY,
+            "strategy" => Molecules::OrdinaryMergeRead::STRATEGY,
             "outcome" => "no_effect",
             "reason" => reason[0, 512],
             "recorded_at" => Time.now.utc.iso8601
           }
-          evidence = write_no_effect_attestation(request_id, attestation)
           receipt = {
             "schema" => Ace::Assign::Atoms::FixedMergeSchemas::RECEIPT_SCHEMA_ID,
             "reference" => record.fetch("reference"),
@@ -555,16 +593,16 @@ module Ace
               "finished_at" => Time.now.utc.iso8601,
               "outcome" => "failed_no_effect",
               "failure_code" => "merge_failed_no_effect",
-              "no_effect_evidence" => evidence
+              "no_effect_evidence" => nil
             },
             "remote_observation" => nil
           }
-          settle(request_id, "failed", receipt)
+          settle(request_id, "failed", receipt, attestation: attestation)
         end
 
-        def settle(request_id, terminal_status, receipt)
+        def settle(request_id, terminal_status, receipt, attestation: nil)
           @coordinator.settle_fixed_merge_effect(request_id, terminal_status: terminal_status,
-            receipt: receipt)
+            receipt: receipt, attestation: attestation)
           terminal_status.to_sym
         rescue Ace::Assign::AttemptErrors::ReceiptRejected
           # The journal refused the receipt: the record stays uncertain with
@@ -587,15 +625,6 @@ module Ace
           nil
         end
 
-        def write_no_effect_attestation(request_id, attestation)
-          dir = File.join(@config.repo_path, NO_EFFECT_DIR)
-          FileUtils.mkdir_p(dir)
-          path = File.join(dir, "#{request_id}.json")
-          File.write(path, JSON.generate(attestation))
-          {"reference" => "#{NO_EFFECT_DIR}/#{request_id}.json",
-           "sha256" => Digest::SHA256.file(path).hexdigest}
-        end
-
         def target_changed!(message, request_id)
           raise OrdinaryMergeRefusal.new("ordinary_merge_target_changed", message,
             request_id: request_id)
@@ -620,19 +649,6 @@ module Ace
           {"owner" => match[1], "repo" => match[2], "index" => match[3].to_i}
         end
 
-        # The independent final-head review is handed over in the request;
-        # the executor's own identity is never an independent reviewer.
-        # Evidence naming the receiver or its principal refuses pre-effect —
-        # it can never be attached as independent review and never grounds
-        # the merge.
-        def reviewer_independence!(document, request_id)
-          reviewer = document.dig("review_evidence", "reviewer")
-          return unless [config.receiver_id, config.principal].include?(reviewer)
-          raise OrdinaryMergeRefusal.new("ordinary_merge_evidence_invalid",
-            "review evidence names the receiver executor, not an independent reviewer",
-            request_id: request_id)
-        end
-
         def selection_refusal!(message, request_id)
           raise OrdinaryMergeRefusal.new("ordinary_merge_selection_mismatch", message,
             request_id: request_id)

data/lib/ace/lab/organisms/ordinary_merge_request.rb

@@ -6,6 +6,7 @@ require "open3"
 require_relative "protected_service_request"
 require_relative "../molecules/ordinary_socket"
 require "ace/assign/atoms/fixed_merge_schemas"
+require "ace/assign/molecules/installed_journal_read"
 
 module Ace
   module Lab
@@ -45,8 +46,7 @@ module Ace
         def initialize(topology: nil, policy: nil, coordinator: nil, repo_root: nil, ingress: nil)
           @topology = topology || TopologyService.from_config
           @repo_root = repo_root || git_toplevel
-          @coordinator = coordinator ||
-            Ace::Assign::Organisms::AttemptCoordinator.new(repo_root: @repo_root)
+          @coordinator = coordinator
           @policy = policy || Molecules::ServicePolicy.new(
             Molecules::GrantResolver.trusted_document(Ace::Lab.authorization_path)
           )
@@ -71,6 +71,11 @@ module Ace
             queue_entry: queue_entry, authorization: authorization, request_id: request_id,
             document: document)
           principal = authenticate!(project)
+          unless @coordinator
+            return with_installed_journal(project) { |producer| producer.request(project: project,
+              assignment: assignment, attempt: attempt, queue_entry: queue_entry, operation: operation,
+              input: input, authorization: authorization, request_id: request_id, **options) }
+          end
           existing = @coordinator.fixed_merge_record(request_id)
           if existing
             return ack_envelope(existing) if exact_replay?(existing, project: project,
@@ -137,6 +142,11 @@ module Ace
             invalid!("invalid input digest", request)
           end
           authenticate!(project)
+          unless @coordinator
+            return with_installed_journal(project) { |producer| producer.status(project: project,
+              assignment: assignment, attempt: attempt, queue_entry: queue_entry, reference: reference,
+              request: request, input_digest: input_digest, **options) }
+          end
           record = @coordinator.fixed_merge_status(reference: reference, request_id: request,
             project_id: project, assignment_id: assignment, attempt_id: attempt,
             queue_entry: queue_entry, input_digest: input_digest)
@@ -198,6 +208,23 @@ module Ace
 
         private
 
+        def with_installed_journal(project)
+          receiver = @policy.ordinary_receiver!(project)
+          unless receiver && %w[journal_repository journal_ref].all? { |key| receiver.key?(key) }
+            raise Ace::Lab::InvalidConfigurationError, "installed ordinary journal selection is missing"
+          end
+          repository, ref = receiver.values_at("journal_repository", "journal_ref")
+          boundary = Ace::Assign::Molecules::InstalledJournalRead.new(repo_root: repository,
+            ref: ref, owner_uid: receiver.fetch("receiver_uid"))
+          boundary.with(deadline: Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30) do |view|
+            journal = Ace::Assign::Molecules::EvidenceJournal.new(repo_root: repository,
+              ref: ref, checkout_root: File.join(repository, ".unused-reader"), read_boundary: view)
+            coordinator = Ace::Assign::Organisms::AttemptCoordinator.new(repo_root: @repo_root, journal: journal)
+            yield self.class.new(topology: @topology, policy: @policy, repo_root: @repo_root,
+              coordinator: coordinator, ingress: @ingress)
+          end
+        end
+
         # The immutable binding digest — spec ruling r4: lowercase hex SHA-256
         # over the canonical JSON (recursively key-sorted, compact, UTF-8) of
         # the full eight-field binding. Computed once here at admission; the
@@ -242,7 +269,7 @@ module Ace
             raise Molecules::OrdinarySocket::OrdinaryUnavailable,
               "ordinary merge admission is not available in the installed configuration"
           end
-          receiver.merge("configuration_sha256" => Atoms::ServiceInput.digest(@policy.document))
+          receiver.merge("configuration_sha256" => Molecules::ServicePolicy.configuration_digest(@policy.document))
         end
 
         def resolve_selection!(project:, assignment:, attempt:, queue_entry:)
@@ -261,8 +288,15 @@ module Ace
                      "head_ref" => document.fetch("head_ref"), "candidate_head" => document.fetch("candidate_head"),
                      "base_repository" => document.fetch("base_repository"), "base_ref" => document.fetch("base_ref"),
                      "expected_base_head" => document.fetch("expected_base_head")}
-          @policy.authorize_ordinary!(authorization, binding)
-        rescue SecurityError => e
+          if authorization.start_with?("proposal-")
+            @coordinator.proposal_authorization(authorization, binding.slice(
+              "operation", "project_id", "assignment_id", "attempt_id", "input_digest", "candidate_head").merge(
+                "target" => {"resource" => document.fetch("pr_url"), "artifact_digest" => nil},
+                "caller_uid" => Process.uid))
+          else
+            @policy.authorize_ordinary!(authorization, binding)
+          end
+        rescue SecurityError, Ace::Assign::AttemptErrors::ReceiptRejected => e
           # Spec table (ruling r4): the authorization decision or reference is
           # invalid for this request — missing, expired, revoked, out of scope,
           # bound to another operation/project/PR/head, or not an ordinary
@@ -306,7 +340,7 @@ module Ace
         def normalize_ack(response, request_id:, input_digest:)
           data = response.fetch("data") { {} }
           expected = %w[schema type request_id input_digest reference]
-          digest = data["input_digest"]
+          digest = data.is_a?(Hash) && data["input_digest"]
           unless data.is_a?(Hash) && (data.keys - expected).empty? &&
               expected.all? { |key| data[key].is_a?(String) && !data[key].empty? } &&
               data.fetch("schema") == Ace::Assign::Atoms::FixedMergeSchemas::ACK_SCHEMA_ID &&
@@ -322,7 +356,7 @@ module Ace
         def normalize_refusal(response, request_id:, input_digest:)
           error = response.fetch("error") { {} }
           expected = %w[schema code message request_id input_digest]
-          valid = error.is_a?(Hash) && (error.keys - expected).empty? &&
+          valid = error.is_a?(Hash) && error.keys.sort == expected.sort &&
             error.fetch("schema") == Ace::Assign::Atoms::FixedMergeSchemas::REFUSAL_SCHEMA_ID &&
             CODES.include?(error.fetch("code")) &&
             error.fetch("message").is_a?(String) && !error.fetch("message").empty? &&

data/lib/ace/lab/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Lab
-    VERSION = "0.7.0"
+    VERSION = "0.9.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ace-lab
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.9.0
 platform: ruby
 authors:
 - Michal Czyz
@@ -71,28 +71,42 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.69'
+        version: '0.70'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.69'
+        version: '0.70'
+- !ruby/object:Gem::Dependency
+  name: ace-herdr
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.6'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.6'
 - !ruby/object:Gem::Dependency
   name: ace-hitl
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.15'
+        version: '0.16'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.15'
+        version: '0.16'
 - !ruby/object:Gem::Dependency
   name: ace-git-forgejo
   requirement: !ruby/object:Gem::Requirement
@@ -219,9 +233,12 @@ files:
 - lib/ace/lab/authorization_path.rb
 - lib/ace/lab/cli.rb
 - lib/ace/lab/cli/commands/agents.rb
+- lib/ace/lab/cli/commands/assignment.rb
+- lib/ace/lab/cli/commands/command_execute.rb
 - lib/ace/lab/cli/commands/projects.rb
 - lib/ace/lab/cli/commands/resolve.rb
 - lib/ace/lab/cli/commands/route.rb
+- lib/ace/lab/cli/commands/run.rb
 - lib/ace/lab/cli/commands/service.rb
 - lib/ace/lab/cli/commands/services.rb
 - lib/ace/lab/cli/commands/support.rb
@@ -232,6 +249,8 @@ files:
 - lib/ace/lab/models/topology_entry.rb
 - lib/ace/lab/molecules/caller_authorizer.rb
 - lib/ace/lab/molecules/capability_router.rb
+- lib/ace/lab/molecules/command_owner_admission.rb
+- lib/ace/lab/molecules/command_policy.rb
 - lib/ace/lab/molecules/exact_resolver.rb
 - lib/ace/lab/molecules/forge_merge_config.rb
 - lib/ace/lab/molecules/forgejo_merge_adapter.rb
@@ -239,10 +258,14 @@ files:
 - lib/ace/lab/molecules/hitl_authorizer.rb
 - lib/ace/lab/molecules/inventory_query.rb
 - lib/ace/lab/molecules/ordinary_admission_resolver.rb
-- lib/ace/lab/molecules/ordinary_ff_merge.rb
 - lib/ace/lab/molecules/ordinary_listener.rb
+- lib/ace/lab/molecules/ordinary_merge_read.rb
+- lib/ace/lab/molecules/ordinary_native_read.rb
+- lib/ace/lab/molecules/ordinary_owner_admission.rb
+- lib/ace/lab/molecules/ordinary_owner_config.rb
 - lib/ace/lab/molecules/ordinary_receiver_config.rb
 - lib/ace/lab/molecules/ordinary_socket.rb
+- lib/ace/lab/molecules/ordinary_worktree_read.rb
 - lib/ace/lab/molecules/protected_cleanup_owner_admission.rb
 - lib/ace/lab/molecules/protected_cleanup_owner_client.rb
 - lib/ace/lab/molecules/protected_cleanup_owner_identity.rb
@@ -253,6 +276,10 @@ files:
 - lib/ace/lab/molecules/service_policy.rb
 - lib/ace/lab/molecules/topology_loader.rb
 - lib/ace/lab/organisms/authority_composition.rb
+- lib/ace/lab/organisms/command_executor.rb
+- lib/ace/lab/organisms/command_run_client.rb
+- lib/ace/lab/organisms/ordinary_assignment_client.rb
+- lib/ace/lab/organisms/ordinary_authority_composition.rb
 - lib/ace/lab/organisms/ordinary_merge_receiver.rb
 - lib/ace/lab/organisms/ordinary_merge_request.rb
 - lib/ace/lab/organisms/protected_cleanup_owner.rb

data/lib/ace/lab/molecules/ordinary_ff_merge.rb

@@ -1,86 +0,0 @@
-# frozen_string_literal: true
-
-require "open3"
-
-module Ace
-  module Lab
-    module Molecules
-      # The fixed merge method executor (spec 8x3.t.xz9.4, merge-method
-      # contract). The closed request schema admits literal `method=merge`;
-      # the installed executor gives that method FAST-FORWARD-ONLY semantics:
-      # the candidate head must be a descendant of the current base head.
-      # A non-fast-forwardable candidate is NOT merged silently and never
-      # falls back to a merge commit — it reports `:non_fast_forward` so the
-      # receiver answers in the moved-target/needs-rebase refusal family.
-      # The mutation itself is one atomic compare-and-swap on the base ref
-      # (`git update-ref <base> <candidate> <expected>`), so concurrent
-      # writers can never both move the ref: the loser provably performed
-      # no effect. Under this strategy the resulting base head equals the
-      # candidate head, and the receipt joins `merge_commit ==
-      # resulting_target_head == merged_candidate_head` — that join is the
-      # receipt's fast-forward proof. Any future non-ff strategy is a
-      # separate reviewed contract extension, never implicit.
-      class OrdinaryFfMerge
-        STRATEGY = "ff"
-
-        Result = Struct.new(:outcome, :resulting_head, :previous_head, :reason, keyword_init: true)
-
-        def initialize(repo_path:, base_ref:)
-          unless repo_path.is_a?(String) && repo_path.start_with?("/") &&
-              base_ref.is_a?(String) && base_ref.start_with?("refs/")
-            raise ArgumentError, "ordinary ff merge needs an absolute repo path and a full base ref"
-          end
-          @repo_path = repo_path
-          @base_ref = base_ref
-        end
-
-        def base_head
-          out, stderr, status = git("rev-parse", @base_ref)
-          return out.strip if status.success?
-          raise GitUnavailable, "base ref #{@base_ref} is unreadable: #{stderr.strip[0, 200]}"
-        end
-
-        def candidate_commit?(sha)
-          git("cat-file", "-e", "#{sha}^{commit}").last.success?
-        end
-
-        # True only when the candidate is a descendant of (or equal to) the
-        # current base head — the fast-forward precondition.
-        def fast_forwardable?(candidate_head)
-          git("merge-base", "--is-ancestor", @base_ref, candidate_head).last.success?
-        end
-
-        # The single effect: one compare-and-swap ref update. Returns a
-        # Result with outcome `:merged`, `:already_merged`, or `:race_lost`
-        # (the expected head moved before the swap — provably no effect from
-        # this invocation). Raises GitUnavailable when git itself fails.
-        def merge!(candidate_head, expected_head)
-          current = base_head
-          return Result.new(outcome: :already_merged, resulting_head: current,
-            previous_head: current, reason: nil) if current == candidate_head
-          unless current == expected_head
-            return Result.new(outcome: :race_lost, resulting_head: current,
-              previous_head: current, reason: "base head moved before the swap")
-          end
-          out, stderr, status = git("update-ref", @base_ref, candidate_head, expected_head)
-          unless status.success?
-            return Result.new(outcome: :race_lost, resulting_head: base_head,
-              previous_head: base_head, reason: "compare-and-swap lost: #{stderr.strip[0, 200]}")
-          end
-          Result.new(outcome: :merged, resulting_head: candidate_head,
-            previous_head: expected_head, reason: nil)
-        end
-
-        class GitUnavailable < ::StandardError; end
-
-        private
-
-        def git(*argv)
-          Open3.capture3("git", *argv, chdir: @repo_path)
-        rescue Errno::ENOENT => e
-          raise GitUnavailable, "git is unavailable: #{e.class}"
-        end
-      end
-    end
-  end
-end