ace-overseer 0.16.0 → 0.17.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9f1239c62289b213199cac3a316f72301a82477c6d688a70d991eea76880f2cc
-  data.tar.gz: 4b847ed09a40f56ad43fc52b74db62325230f8c2cd393f2a175491fe21fd262f
+  metadata.gz: 860e9ff0d0d664c563c1fa9139d5f0d18b2e4c869239424e881dd2a018ad12bc
+  data.tar.gz: 55c0694f24f3a4d8ea9492df5f552e42fb2171cc75bd848988b642171f1b1e3c
 SHA512:
-  metadata.gz: 6babe8200aa8f1c2275218d038dc6764a1d64e2af1a252659a38f0445ffd1c8bacfd23be81ae62c99eb22b37be34577a30fa4dc1ec2532a8a995d0c4339b4518
-  data.tar.gz: 668e65a1f12a922b02f1884d1e51eaec6aaf3bfd8fe5647911b1731ce51d4070dab43e79a98069ae8b93ef9fb7c357d168bc05d9af905cd1bbaa070d91f15812
+  metadata.gz: 6bb2d12eb03983cc5b10f9b71f72fea46c25c39e6394e02060a9e505767400d2a57a1da1794140235a9e1b6f0f01fa01f89287755b5d7af6490497312e1375ed
+  data.tar.gz: 830f8f444002616d28121d391b95d85cc50a07c18b6bf0f63a4e7186d332cb7a118d7b3ef059e7d11d24e7e37f37a2305eeb15bcda5a63ecc2fc42469dd5f204

data/CHANGELOG.md

@@ -7,11 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.17.0] - 2026-09-29
+
 ### Added
 - Added an explicit Lab runtime adapter for listing projects and agents, preparing and dispatching Works, forwarding prompts over stdin, starting exact-head reviews, and stopping workers.
+- Added installed-consumer probe coverage: the suite builds the current gem artifacts, installs them into an isolated consumer environment (fresh gem home, unrelated cwd, sanitized HOME), and proves `ace-nav resolve wfi://overseer` and `ace-bundle wfi://overseer` succeed from packaged content only, with a registration-removal fixture proving the probe detects masking.
 
 ### Changed
 - Kept tmux as the default runtime while allowing `work-on`, `status`, and dry-run `prune` to delegate through the system-owned `/usr/local/bin/lab` boundary.
+- Strengthened the overseer prune-safety contract: migrated-work preservation now requires a declared, verified destination plus tree/artifact or patch equivalence (the subject-only successor search is gone), plus a positive executed no-active-writer check from overseer/assignment/Lab status; ambiguity preserves.
 
 
 ## [0.16.0] - 2026-09-20

data/handbook/workflow-instructions/overseer.wf.md

@@ -6,8 +6,8 @@ doc-type: workflow
 title: Overseer Workflow
 purpose: Binding process contract for the overseer lifecycle (work-on, status, prune) with executed-check contracts for prune safety and status truth.
 ace-docs:
-  last-updated: '2026-09-20'
-  last-checked: '2026-09-20'
+  last-updated: '2026-09-28'
+  last-checked: '2026-09-28'
 ---
 
 # Overseer Workflow
@@ -84,7 +84,8 @@ ace-overseer prune --yes
 #### Prune safety (non-negotiable executed check)
 
 Prune/removal of a worktree or branch happens **only after an executed
-preservation proof** for every commit that would be removed:
+preservation proof plus an executed no-active-writer check** for every
+candidate:
 
 1. Prove the work is already merged into its base:
 
@@ -92,35 +93,86 @@ preservation proof** for every commit that would be removed:
    git merge-base --is-ancestor <work-head> <base>
    ```
 
-   Exit code 0 proves every commit on the work branch is contained in the base.
+   Exit code 0 proves every commit on the work branch is contained in the
+   base.
 
-2. If the work was migrated elsewhere (squash-merge, cherry-pick, hand-off),
-   prove the copy exists with a subject-level search in the successor
-   repository:
+2. If the work was migrated elsewhere (squash-merge, cherry-pick,
+   hand-off), preservation requires a **declared, verified destination**
+   plus content equivalence. A matching commit subject is never sufficient
+   proof:
+
+   1. Declare the destination concretely: successor repository plus
+      branch/PR/commit that received the work.
+   2. Verify the destination actually accepted the work, executed in this
+      session:
+
+      ```bash
+      git -C <successor-repo> merge-base --is-ancestor <dest-ref> <dest-branch>
+      ```
+
+      rc=0 proves the destination landed on the declared branch (or read
+      the merged/accepted state from the forge hosting the PR).
+
+   3. Prove the destination carries the same work by content, not by
+      name. Pass with exactly one of:
+
+      - Tree/artifact equivalence -- the squashed result is the same
+        content:
+
+          ```bash
+          test "$(git -C <successor-repo> rev-parse '<dest-ref>^{tree}')" \
+            = "$(git rev-parse '<work-head>^{tree}')"
+          ```
+
+      - Patch equivalence -- the same changes, compared inside the
+        successor repository. Fetch the source proof refs first and
+        range-diff with separate source and destination bases:
+
+          ```bash
+          git -C <successor-repo> fetch <source-repo> <source-base> <work-head>
+          git -C <successor-repo> range-diff \
+            <source-base>...<work-head> <dest-base>...<dest-ref>
+          ```
+
+          with no substantive differences; or diff the normalized patches
+          (`git show --format=` output of each side) and require an empty
+          diff.
+
+   4. Ambiguity preserves: conflicting hashes, an unverifiable destination,
+      or a failed equivalence check means no proof -- block the prune per
+      step 5.
+
+3. Prove no active writer before destruction, executed in this session
+   against the authoritative lifecycle state:
 
    ```bash
-   git -C <successor-repo> log --all --grep "<subject>"
+   ace-overseer status --format json
    ```
 
-   The search must return the commit(s) carrying the work. No output means no
-   proof.
+   For assignment-backed candidates also check `ace-assign status`; for Lab
+   runtime candidates check `ace-overseer status --runtime lab`. A running
+   assignment, an in-flight Lab work, or any unaccounted writer blocks the
+   prune. Missing or unreadable lifecycle state counts as an active writer
+   -- preserve.
 
-3. A described or remembered proof is never sufficient -- run the command and
-   observe the result in this session.
+4. A described or remembered proof is never sufficient -- run the commands
+   and observe the results in this session.
 
-4. Any commit without a proven copy **blocks the prune** for that worktree.
-   Report the blocked candidate (ref, head SHA, missing proof) to the operator;
-   never silently drop it and never force past a failed proof.
+5. Any commit without a proven copy, any failed or ambiguous equivalence,
+   or any active-writer evidence **blocks the prune** for that worktree.
+   Report the blocked candidate (ref, head SHA, missing proof) to the
+   operator; never silently drop it and never force past a failed proof.
+   Preserve on ambiguity.
 
 ## Non-Negotiable Contracts Summary
 
-| Contract     | Claim                             | Executed proof                                                                                                                                                            |
-|--------------|-----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| Prune safety | "The work is preserved"           | `git merge-base --is-ancestor <work-head> <base>` (rc=0), or `git -C <successor-repo> log --all --grep "<subject>"` returning the migrated commit                          |
-| Status truth | "The task is blocked on the owner" | An executable non-secret check run in this session; stale tasks closed/corrected in the same change                                                                       |
+| Contract     | Claim | Executed proof |
+|--------------|-------|----------------|
+| Prune safety | "The work is preserved and nothing is actively writing" | `git merge-base --is-ancestor <work-head> <base>` (rc=0), or verified destination + tree/artifact or patch equivalence; plus `ace-overseer status --format json` (assignment/Lab status where applicable) showing no active writer |
+| Status truth | "The task is blocked on the owner" | An executable non-secret check run in this session; stale tasks closed/corrected in the same change |
 
 ## Success Criteria
 
 - Work starts only through `ace-overseer work-on` (or the Lab-runtime equivalent), never through ad-hoc manual worktree provisioning.
 - Every status review re-verified pending owner-blocked tasks with an executed check and corrected stale state in the same change.
-- Every pruned worktree/branch had an executed preservation proof; candidates without proof were reported as blocked, not removed.
+- Every pruned worktree/branch had an executed preservation proof (ancestor containment, or a verified destination with tree/artifact or patch equivalence) and an executed no-active-writer check; candidates without complete proof were reported as blocked, not removed.

data/lib/ace/overseer/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Overseer
-    VERSION = "0.16.0"
+    VERSION = "0.17.0"
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-overseer
 version: !ruby/object:Gem::Version
-  version: 0.16.0
+  version: 0.17.0
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-09-22 00:00:00.000000000 Z
+date: 2026-09-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ace-support-cli