ace-overseer 0.20.0 → 0.20.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7afa7d878680232ac2f7800973b1dec72b7991a9ecd6ce3c498c73d6d8264b21
-  data.tar.gz: 124e8f19e7aa46504760813344459124a630db4263e9a2f4bf08133409036e94
+  metadata.gz: a295b89da7b7dfa9878c4bee713637b790eb75aa6c3116887feac63893e6783a
+  data.tar.gz: 92e4629661696347d8c9b2e75f8295b4698cf4139cc51f5a0c80ef61e6d7c22f
 SHA512:
-  metadata.gz: 86a724ae87399315af6cbce345ec911f62ea7ec28e57ab660652056d99bcda986fd8cb571bb031071e6971b4bbd78f39b697fa02c393ed4a562c594306b012b5
-  data.tar.gz: 15ae48aea39c596a2fb3fd639f04f72b8f669872a9a4cce365ff5cca9eefbd8d2322df523b5b6974d56e9253011dd12b4aa72f8243f7d7f1264248b548cc2a8e
+  metadata.gz: 16e8f719474ec2090c1463d4341d4199e17d74692da8c0f31fdbc329671e5af2edfe7516a19496ac4706bedb9b823b62f16f82a9829e7c4ef1fdbd906294f7fe
+  data.tar.gz: f952e354ce7aba3bdde0dc55df80fce89b6b360763b5e6c98e4853e95bcb9a33dfbeb38b3c910e131fe7979b574b4298c1931e0460c7627ec677da304579e88e

data/.ace-defaults/nav/protocols/wfi-sources/ace-overseer.yml

@@ -9,5 +9,5 @@ priority: 10
 
 config:
   relative_path: handbook/workflow-instructions
-  pattern: "*.wf.md"
+  pattern: "**/*.wf.md"
   enabled: true

data/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.20.1] - 2026-10-08
+
+### Changed
+
+- Require the coordinated Assign, Herdr, Lab and Review producer versions for ordinary CLI worker launch and current protected delivery contracts.
+
+- Repair protected work-on composition fixtures to retain the originally provisioned workspace lifecycle resource, exercise the real worker reader, and return the simulated fork before post-readiness steering without changing product admission.
+
+- Route protected delivery through original worker merge request, canonical status and exact result consumption while preserving ordinary delivery and unresolved protected PR policy.
+
+
+### Added
+
+- Consume protected prune preview through the fixed service receiver, persist its complete result for explicitly authorized apply, and query canonical service status without repeating cleanup.
+
+- Package canonical project-overseer, Lab coordinator and second-commander role workflows with scoped authority, responsive delegation and the existing confirmed-delivery decision policy.
+
+- Execute protected candidate review through original launcher delegation, immutable Git snapshot, the maintained review engine and canonical receipt acceptance; expose explicit status/cancel modes without labd forwarding or automatic replay.
+
+- Discover protected project assignments through the actual authority inventory and public topology, preserving pinned pages, restart metadata and partial visibility without a local-journal fallback or proposal effects during status reads.
+
 ## [0.20.0] - 2026-10-05
 
 ### Added

data/README.md

@@ -20,9 +20,9 @@
 
 Starting task work means creating a worktree, opening a terminal window, and preparing an assignment - three manual steps before you even begin coding. ace-overseer collapses that into a single command, tracks what is running where, and cleans up finished worktrees so nothing lingers. You can jump straight to a focused worktree any time with a single invocation.
 
-On a configured Lab machine, the same CLI can prepare and dispatch the Lab's
-system-owned `Work` objects. The default remains the existing tmux runtime;
-using Lab always requires an explicit `--runtime lab` or a Lab-only command.
+Explicit `--project` selects provisioned protected Assign execution. Omitting it
+preserves ordinary local worktree/assignment mode. Runtime selects a terminal
+backend; it cannot select credentials or execution authority.
 
 ## How It Works
 
@@ -46,21 +46,21 @@ ace-overseer work-on --task 8q4 --preset work-on-task
 ace-overseer status --watch
 ```
 
-**Operate Lab workers** - prepare a reviewed Work, dispatch it to a configured
-agent, and inspect it without teaching ACE how to manage containers or Herdr:
+**Start protected work** - prepare one reviewed leaf under the explicit project,
+retain exact inputs, and keep its original foreground launcher:
 
 ```bash
-ace-overseer prepare --runtime lab --project nervus \
-  --source lab-plan:oauth-callback --work W142 \
-  --planner admin-agy --title "OAuth callback validation"
-ace-overseer work-on --runtime lab --work W142 --agent builder-codex
-ace-overseer status --runtime lab --project nervus
+ace-overseer work-on --task TASK --project ace --agent builder --runtime herdr
+ace-overseer status --project ace --agent builder --format json
+ace-overseer work-on --recover-request .ace-local/overseer/launch-requests/INVOCATION.json
 ```
 
-Lab owns worktrees, credentials, Podman, and Herdr. Overseer decides what to
-run and delegates only through the absolute `/usr/local/bin/lab` boundary.
-Use `ace-overseer prune WORK... --runtime lab --dry-run` to preview exact Work
-destruction, then repeat with `--yes` to delegate it to Lab.
+The start command prints and flushes retained request, definition and bundle
+identity even under `--quiet`. It observes the same original child through
+uncertainty; use independent status/steering invocations while that foreground
+owner remains alive. Recovery is read-only and never rebuilds inputs or relaunches.
+Domain installation supplies credentials and fixed entries; ACE's existing
+Assign authority owns admission, execution evidence and progress.
 
 **Clean up finished work** - [`ace-overseer prune`](docs/usage.md#ace-overseer-prune) removes completed worktrees safely. It checks three conditions before removing: assignment completed, task marked done, and git working tree clean. Use `--dry-run` to preview what would be pruned, `--force` for worktrees that fail safety checks, or `--assignment` to prune a single stale assignment.
 

data/docs/usage.md

@@ -16,29 +16,43 @@ ace-docs:
 - `ace-overseer prune`
 - `ace-overseer projects`
 - `ace-overseer agents`
-- `ace-overseer prepare`
 - `ace-overseer prompt`
 - `ace-overseer review`
 - `ace-overseer stop`
 
 ## `ace-overseer work-on`
 
-Create or reuse task worktrees, open tmux windows, and prepare assignments.
-
-Invocation: `ace-overseer work-on --task <task-ref>`.
-
-Options:
-
-- `--task`, `-t` (required for tmux): task reference(s); repeatable and comma-separated values supported
-- `--preset`, `-p`: assignment preset name
-- `--runtime`: `tmux` (default) or `lab`
-- `--work`: existing Lab Work ID; required with `--runtime lab`
-- `--agent`: configured Lab agent ID; required with `--runtime lab`
-- `--quiet`, `-q`: suppress non-essential output
-- `--debug`, `-d`: show debug output
-- `--help`, `-h`: show help
-
-Internally, `work-on` now routes assignment creation through `ace-assign create --task ...`, so direct `ace-assign` and `ace-overseer` task flows use the same preset expansion behavior.
+Without `--project`, create/reuse local worktrees and prepare assignments.
+With `--project`, prepare exactly one reviewed leaf and retain its original
+foreground protected launcher; no local fallback occurs on protected refusal.
+
+- `--task`, `-t`: local repeatable/comma-separated task refs; protected mode requires one leaf.
+- `--preset`, `-p`: local assignment preset; forbidden in protected mode.
+- `--runtime`: terminal backend `auto`, `tmux` or `herdr`; overrides existing config. Protected tmux refuses before allocation.
+- `--project`: explicit protected project ID.
+- `--agent`: exact visible protected mapping ID, requiring project. Automatic selection is ordered and advances only after attributable readonly preflight denial.
+- `--mutation`: stable invocation ID; otherwise generated once and printed before effects.
+- `--base-head`: optional explicit reviewed code HEAD; must match the captured source HEAD, which is rechecked after preparation and before fork.
+- `--dependency-report`: repeatable `task:assignment:step` identities for selected dependency reports; omission is an explicit empty selection.
+- `--recover-request FILE`: readonly original canonical attribution from retained inputs; rejects all launch/mode overrides.
+- `--quiet`, `-q`: suppress nonessential output; retained input identity and original child observation remain visible.
+- `--debug`, `-d`, `--help`, `-h`: diagnostics/help.
+
+Fresh protected start exclusively publishes private request JSON, derived exact
+definition sidecar and original prepared Git bundle, then prints their paths and
+hashes before any child. Missing/corrupt input or changed code HEAD refuses.
+The living coordinator retains and observes the same original child through
+readiness/uncertainty without a lifetime timeout, replacement or cancellation.
+The fixed launch driver uses one 30-second phase budget; each protocol call
+receives only the remaining time. The parent separately retains its earlier
+30-second total readiness deadline, including CLI input reads and canonical
+ready verification; neither deadline refreshes. Late readiness preserves the
+same original child as uncertain, without a retry or replacement.
+
+Use independent status/steering while it remains foreground. Reap is local
+observation, never canonical terminal/release or physical cleanup permission.
+Recovery reports absent/mismatched local inputs separately from original canonical
+reservation attribution, without upload, reconstruction or retry.
 
 ## `ace-overseer status`
 
@@ -50,8 +64,8 @@ Options:
 
 - `--format`: output format (`table`, `json`)
 - `--watch`, `-w`: auto-refresh dashboard
-- `--runtime`: `tmux` (default) or `lab`
-- `--project`: filter Lab Works by project
+- `--runtime`: local backend selection; protected inventory is runtime-independent
+- `--project`: select protected canonical assignment inventory for this explicit project
 - `--quiet`, `-q`: suppress non-essential output
 - `--debug`, `-d`: show debug output
 - `--help`, `-h`: show help
@@ -73,7 +87,7 @@ Options:
 - `--yes`, `-y`: skip interactive confirmation
 - `--dry-run`: run the same proof classification as apply, changing no worktrees, refs, assignment state or metadata (a dry-run receipt is not reusable authorization)
 - `--preservation FILE`: YAML manifest (`version: 1`, `candidates:`) declaring cross-repository destinations for migrated work; a claim to verify, never proof by itself
-- `--runtime`: `tmux` (default) or `lab`
+- Local prune uses the configured runtime; protected physical cleanup uses its canonical cleanup owner.
 - `--quiet`, `-q`: suppress progress output; blocked/failed results still print and signal through the exit code
 - `--debug`, `-d`: show debug output
 - `--help`, `-h`: show help
@@ -139,32 +153,27 @@ YAML
 ace-overseer prune task.230 --preservation .ace-local/prune/destinations.yml --dry-run
 ```
 
-## Lab Runtime
-
-Lab commands are available only where `/usr/local/bin/lab` is installed. ACE
-does not read Lab credentials and does not call Podman or Herdr directly.
-
-- `ace-overseer projects`: list registered Lab projects.
-- `ace-overseer agents`: list registered Lab agents and concurrency limits.
-- `ace-overseer prepare --runtime lab --project PROJECT --source KIND:ID --work WORK --planner AGENT --title TITLE`: create a reviewed Work and its isolated worktree.
-- `ace-overseer work-on --runtime lab --work WORK --agent AGENT`: reserve the agent, create or reuse its Herdr workspace, and dispatch it.
-- `ace-overseer status --runtime lab [--project PROJECT] [--format table|json]`: show Lab Work state. Failed proposal ticks defer resolution and report a diagnostic on stderr while status remains available. Object JSON also includes `proposal_resolution.status: "deferred"`; legacy array JSON keeps its schema and uses the stderr diagnostic. Continuous status lives in each project Herdr session, so `--watch` is intentionally rejected for Lab.
-- `ace-overseer prompt --work WORK --file PATH`: forward prompt text from a file to the Work pane. Piped stdin is also supported; prompt text is never passed as a process argument.
-- `ace-overseer review --work WORK --pr NUMBER`: prepare an exact-head admin review checkout and pane.
-- `ace-overseer stop --work WORK`: stop the assigned process without destroying Work state.
-- `ace-overseer prune WORK... --runtime lab --dry-run`: classify each Work -- documented terminal state, no in-flight work, and preservation data (`repo`/`head`/`branch`) provable in the hosted repository. Apply with `--yes` re-verifies state immediately before delegating each destruction to `lab work destroy WORK --confirm`; blocked Works are never destroyed and the run exits nonzero. The raw Lab CLI cannot make the state check and the destruction atomic, so this adapter reports the path unsupported and preserves the Work; only a Lab surface with an atomic guarded destroy delegates.
+## Protected execution and review
 
-Example:
+The existing Assign authority and installed mapping grant admit execution. Public
+topology supplies visible IDs only. Runtime names and charter selection cannot
+change OS credentials, grants or reviewer identity.
 
 ```bash
-ace-overseer prepare --runtime lab --project nervus \
-  --source nervus-thread:67611c0b-f44c-4ac4-ae4e-55773b175617 \
-  --work W321 --planner admin-agy --title "Reviewed task title"
-ace-overseer work-on --runtime lab --work W321 --agent builder-codex
-ace-overseer prompt --work W321 --file .ace-local/prompts/W321.md
-ace-overseer status --runtime lab --project nervus --format json
+ace-overseer work-on --task TASK --project ace --agent builder --runtime herdr
+ace-overseer status --project ace --agent builder --format json
+ace-overseer work-on --recover-request .ace-local/overseer/launch-requests/INVOCATION.json
 ```
 
+Retain the printed input paths/hashes and original mapping/invocation. Missing
+readiness, lost output, child exit or pane state never authorize replacement or
+physical cleanup. Recovery is strictly read-only. Protected physical cleanup
+requires its designated preservation/no-writer owner.
+
+- `ace-overseer review --project PROJECT --agent AGENT --assignment A --attempt T --head HEAD --candidate-generation N --expected-generation G --mutation REQUEST --accept-mutation ACCEPT`: request independent review of the exact canonical candidate and submit its executed receipt. Run under the installed reviewer principal. `accepted` means the authority accepted that receipt; `uncertain` requires explicit status inspection.
+- `ace-overseer review --status --project PROJECT --agent AGENT --assignment A --attempt T --mutation REQUEST`: inspect the original request without rerunning review or uploading anything.
+- `ace-overseer review --cancel --project PROJECT --agent AGENT --assignment A --attempt T --head HEAD --candidate-generation N --review-event EVENT --expected-generation G --mutation CANCEL`: revoke the exact reservation using its status-provided event. Cancellation does not terminate the old reviewer. After cancellation, start a new review explicitly with new mutation IDs and the observed generation.
+
 ## Public Verification Paths
 
 Use these user-visible checks when validating behavior end-to-end:
@@ -190,3 +199,19 @@ Use these user-visible checks when validating behavior end-to-end:
   5. `ace-overseer prune --dry-run` to confirm no remaining safe candidates
 
 Assignment JSON includes `recovery`: current liveness, recovery decision/reason, last verified observation, exact attempt identities, checkpoints and unresolved effect/inbox references. Unreadable evidence is explicitly unknown; dashboard rows needing reconciliation use a question mark instead of a success indicator. An older verified observation remains audit history and does not make a current unknown observation live.
+
+## Exact protected steering (reviewed target interface)
+
+`ace-overseer prompt --project ace --agent builder --assignment A --attempt T --mutation steer-001 --expected-generation 12 --file instruction.txt`
+
+Use exactly one explicit `--file PATH` or `--stdin` input selection. Prompt text remains bounded UTF-8 (16,384 bytes), preserved exactly and omitted from operational output. Redirecting stdin alone does not select input.
+
+`ace-overseer prompt --status --project ace --agent builder --assignment A --attempt T --mutation steer-001`
+
+Status rejects both input selectors and expected generation before reading input; it uses the original prompt mutation and never resends. An explicit identical replay retains the original generation and text; changed input refuses.
+
+`ace-overseer stop --project ace --agent builder --assignment A --attempt T --mutation stop-001 --expected-generation 14`
+
+Exact project/mapping/assignment/attempt selection is mandatory. Immutable stop replay does not refresh settlement. Canonical terminal plus reservation release remains separate from local child exit. Legacy Lab Work forwarding and prepare/prune delegation are removed.
+
+Public topology: `ace-overseer projects` and `ace-overseer agents --project PROJECT` emit the maintained classified topology envelope for the verified caller. Visibility grants no execution authority. Local prune uses the configured runtime and existing preservation/no-writer owner; it accepts no protected cleanup or legacy runtime selector.

data/handbook/workflow-instructions/overseer.wf.md

@@ -36,7 +36,9 @@ ace-overseer work-on --task <task-ref>
 - Repeatable/comma-separated refs fan out into the same batch: `ace-overseer work-on --task 230 --task 231,232`
 - Optional preset: `ace-overseer work-on --task <task-ref> --preset <preset-name>`
 - After launch, switch to the tmux window and run `/ace-assign-drive`.
-- Lab runtime variant (reserved agent + Herdr workspace): `ace-overseer work-on --runtime lab --work <work-id> --agent <agent-id>` -- `--task`/`--preset` are not supported with the Lab runtime.
+- Protected reviewed leaf: `ace-overseer work-on --task TASK --project PROJECT --agent MAPPING --runtime herdr`.
+- Retain the mandatory printed request/definition/bundle identity even under quiet mode. The original foreground owner remains alive through uncertainty; use independent status/steering invocations, never replace it on a missing reply.
+- Readonly recovery: `ace-overseer work-on --recover-request FILE`; no reconstruction, upload or launch.
 
 Never improvise worktree provisioning by hand when `work-on` exists; ad-hoc
 worktrees bypass the assignment lifecycle that `status` and `prune` rely on.
@@ -48,8 +50,10 @@ ace-overseer status                     # table dashboard
 ace-overseer status --format json       # machine-readable snapshot
 ```
 
-Lab runtime: `ace-overseer status --runtime lab [--project <project>]` (no
-`--watch`; continuous status lives in each project Herdr session).
+Protected canonical snapshot: `ace-overseer status --project PROJECT --agent MAPPING --format json` (no `--watch`).
+
+Exact original steering: `ace-overseer prompt --project PROJECT --agent MAPPING --assignment A --attempt T --mutation ID --expected-generation N --file FILE` (or explicit --stdin). Prompt status uses the same tuple/mutation with --status and rejects input selectors/generation before reads. Stop uses the same exact tuple with its own stable mutation/generation. Never infer consumption from submitted; immutable explicit replay never refreshes generation or resends automatically. Canonical terminal plus reservation release is required separately from local child exit. Public projects/agents use maintained topology; no lab/labd forwarding or Work-ID prepare/prune path remains.
+
 
 #### Status truth (non-negotiable executed check)
 
@@ -78,7 +82,7 @@ ace-overseer prune --yes
 ```
 
 - Targeted: `ace-overseer prune <task-ref|folder>...` or `ace-overseer prune --assignment <assignment-id>`
-- Lab runtime: `ace-overseer prune <work-id>... --runtime lab --dry-run`, rerun with `--yes` to delegate each destruction to Lab. The raw Lab CLI cannot make the no-writer check and the destruction atomic, so it is classified unsupported and preserved; only a Lab surface with an atomic guarded destroy delegates.
+- Protected physical cleanup belongs to its designated canonical cleanup owner. Local prune, readiness, pane closure and child reap never substitute for its preservation/no-writer proof.
 
 #### Prune safety (non-negotiable executed check)
 
@@ -130,9 +134,9 @@ candidate:
    ace-overseer status --format json
    ```
 
-   For assignment-backed candidates also check `ace-assign status`; for Lab
-   runtime candidates check `ace-overseer status --runtime lab`. A running
-   assignment, an active or uncertain attempt, an in-flight Lab work, or any
+   For assignment-backed candidates also check `ace-assign status`; for protected
+   work check `ace-overseer status --project PROJECT --agent MAPPING`. A running
+   assignment, an active or uncertain attempt, unreleased protected work, or any
    unaccounted writer blocks the prune. Missing or unreadable lifecycle
    state counts as an active writer -- preserve. `ace-overseer prune`
    enforces this itself: apply holds a durable exclusion shared with every
@@ -153,12 +157,12 @@ candidate:
 
 | Contract     | Claim | Executed proof |
 |--------------|-------|----------------|
-| Prune safety | "The work is preserved and nothing is actively writing" | `git merge-base --is-ancestor <work-head> <base>` (rc=0), or a verified declared destination (--preservation) with tree/artifact or exact content-transition equivalence; plus the executed no-writer reconciliation (overseer/assignment/Lab status, terminal attempts, durable prune/start exclusion) |
+| Prune safety | "The work is preserved and nothing is actively writing" | `git merge-base --is-ancestor <work-head> <base>` (rc=0), or a verified declared destination (--preservation) with tree/artifact or exact content-transition equivalence; plus the executed no-writer reconciliation (overseer/assignment canonical status, terminal attempts, durable prune/start exclusion) |
 | Status truth | "The task is blocked on the owner" | An executable non-secret check run in this session; stale tasks closed/corrected in the same change |
 
 ## Success Criteria
 
-- Work starts only through `ace-overseer work-on` (or the Lab-runtime equivalent), never through ad-hoc manual worktree provisioning.
+- Work starts only through `ace-overseer work-on` (with explicit project for protected work), never through ad-hoc manual worktree provisioning.
 - Every status review re-verified pending owner-blocked tasks with an executed check and corrected stale state in the same change.
 - Every pruned worktree/branch had an executed preservation proof (ancestor containment, or a verified destination with tree/artifact or exact content-transition equivalence) and an executed no-active-writer check; candidates without complete proof were reported as blocked, not removed; `--force` and `--yes` never bypassed a safety block.
 

data/handbook/workflow-instructions/roles/lab-coordinator.wf.md

@@ -0,0 +1,99 @@
+---
+name: lab-coordinator
+description: Coordinate cross-project dependencies and scoped services without taking ownership of project execution evidence.
+doc-type: workflow
+title: Coordinate Lab Capabilities
+purpose: Canonical lab-coordinator role charter for scoped ACE orchestration.
+ace-docs:
+  last-updated: '2026-10-07'
+  last-checked: '2026-10-07'
+---
+# Coordinate Lab Capabilities
+
+## Goal
+
+Coordinate cross-project dependencies and scoped services without taking ownership of project execution evidence.
+
+## Prerequisites
+
+Use the current reviewed task scope, actual provisioned credentials and installed
+public interfaces. Selecting this charter changes instructions only: it does not
+change OS credentials, project grants, reviewer identity or authority permissions.
+Missing capability must remain a visible blocker; never fall back to lab/labd,
+impersonation, detached brokers or direct authority-journal writes.
+
+## Project Context Loading
+
+Read the selected project's task/dependency records, current canonical Assign
+state, applicable scoped service grants, and existing HITL proposal history.
+Use `ace-task show TASK` and the installed public status/history interfaces for
+the actual selected project. Do not treat remembered status as current evidence.
+
+## High-Level Execution Plan
+
+- [ ] Reconcile current scope, existing executions and proposals.
+- [ ] Identify permitted actions, independent delegates and unresolved decisions.
+- [ ] Dispatch authorized work while retaining original references.
+- [ ] Report verified outcomes, uncertainty and the next attributable action.
+
+## Process Steps
+
+1. Reconcile existing project tasks, assignment receipts and scoped HITL
+   proposals/callbacks on every wake. Use stable project, agent and service IDs.
+   Check visible installed capabilities and their exact grants; absence or
+   ambiguity is a blocker, never permission to choose another principal.
+2. Keep generic execution ownership in ACE and domain installation in the Lab
+   tasks. Route provisioning and privileged operations to already configured
+   scoped executors. A credential, workflow role or requested capability does
+   not grant permission. Do not supply root access, raw socket paths or private
+   evidence roots as a workaround for missing deployment.
+3. Coordinate independent project work in parallel when its contracts permit it.
+   Retain each project's original task/assignment/attempt and evidence references.
+   Do not create a second execution registry, review acceptance owner or progress
+   ledger. A project's uncertain attempt remains occupied until its actual owner
+   resolves it; never replace it to improve apparent throughput.
+4. Escalate unresolved cross-project priority, scope or policy choices to the
+   second commander with concrete alternatives, affected projects and exact
+   authorization scope. Distinguish an unreachable coordinator, explicit policy
+   refusal, uncertain effect and missing technical evidence in the report.
+5. Apply an existing direct Captain approval or applicable scoped standing
+   authorization without requesting a duplicate proposal. Otherwise use the
+   existing HITL proposal owner and confirmed-delivery policy below. Authorization
+   never supplies missing test, review, SHA, receipt, privilege or OTP evidence.
+   For merge, route the original project worker through the configured receiver
+   and exact merge/status contract in `wfi://handbook/perform-delivery`. Retain
+   the request/input/candidate binding and canonical result; accepted claim or
+   coordinator observation is not completed delivery. Do not route protected
+   create/update/ready through a local fallback while its ordering policy remains
+   unresolved, or create a redundant merge proposal for existing authorization.
+6. Track installation and actual system acceptance once in the Lab's designated
+   acceptance task. Link producer versions, source reviews and unresolved checks
+   there. Preserve distinct source completion, publication, installation and
+   installed acceptance. Physical cleanup requires preserved work and verified
+   absence of writers under the existing cleanup owner; pane closure or status
+   snapshots alone cannot authorize destruction.
+
+## Shared Decision and Responsiveness Contract
+
+Confirmed Hermes delivery starts the sixteen-hour proposal window. Only the
+existing HITL owner's healthy, drained reconciliation and resolved decision admit
+silent approval. Preserve approve/veto/clarify and revised/superseded history.
+A stalled resolver is deferred visibly; keep status and conversation usable and
+coalesce wakes through the existing bounded tick owner. Never wait for long
+implementation or review in the conversation handler. Selecting a role adds no
+new timer service, authorization policy or execution journal.
+
+## Success Criteria
+
+- Every action retains its task, assignment or proposal reference and exact scope.
+- Actual role/grant boundaries and independent review remain enforced.
+- Unknown results, failed delivery and policy refusals remain distinguishable.
+- Captain direction and status remain actionable while delegated work proceeds.
+- No elapsed clock, report, exit code or pane state substitutes for canonical proof.
+
+## Error Handling
+
+On missing authority, unavailable transport or ambiguous evidence, report the
+original reference and missing proof. Inspect existing state through its public
+owner. Do not repeat an uncertain effect, change an accepted definition, release
+an occupied slot or claim completed work to bypass the blocker.

data/handbook/workflow-instructions/roles/project-overseer.wf.md

@@ -0,0 +1,103 @@
+---
+name: project-overseer
+description: Keep reviewed project work attributable, independently reviewed and responsive to Captain direction.
+doc-type: workflow
+title: Coordinate Project Work
+purpose: Canonical project-overseer role charter for scoped ACE orchestration.
+ace-docs:
+  last-updated: '2026-10-07'
+  last-checked: '2026-10-07'
+---
+# Coordinate Project Work
+
+## Goal
+
+Keep reviewed project work attributable, independently reviewed and responsive to Captain direction.
+
+## Prerequisites
+
+Use the current reviewed task scope, actual provisioned credentials and installed
+public interfaces. Selecting this charter changes instructions only: it does not
+change OS credentials, project grants, reviewer identity or authority permissions.
+Missing capability must remain a visible blocker; never fall back to lab/labd,
+impersonation, detached brokers or direct authority-journal writes.
+
+## Project Context Loading
+
+Read the selected project's task/dependency records, current canonical Assign
+state, applicable scoped service grants, and existing HITL proposal history.
+Use `ace-task show TASK` and the installed public status/history interfaces for
+the actual selected project. Do not treat remembered status as current evidence.
+
+## High-Level Execution Plan
+
+- [ ] Reconcile current scope, existing executions and proposals.
+- [ ] Identify permitted actions, independent delegates and unresolved decisions.
+- [ ] Dispatch authorized work while retaining original references.
+- [ ] Report verified outcomes, uncertainty and the next attributable action.
+
+## Process Steps
+
+1. Reconcile reviewed task scope and dependencies with canonical assignment state.
+   Select only literal visible provisioned mappings for this project. Public
+   topology narrows visibility; installed authority defines capacity and grants.
+   Unknown or uncertain work still occupies its slot. Never choose a replacement
+   merely because a pane closed or a process disappeared.
+2. Delegate implementation and review to separate attributable executions. A
+   project-overseer with actual provisioned launcher credentials may start work;
+   a supervisor-only instance delegates to an already provisioned launcher.
+   Retain the original request, assignment, attempt and mutation identities before
+   effects. After a lost reply, inspect those identities without repeating the
+   launch. Automatic selection advances only after attributable zero-effect
+   refusal before registration; explicit mapping selection never substitutes.
+3. Keep conversation available while delegates work. On each wake, inspect the
+   task queue, canonical execution evidence and scoped HITL proposal/callback
+   state. Report unavailable observations and deferred resolution explicitly;
+   neither a report nor exit code zero proves completion.
+4. Route review and integration using the exact current candidate and independent
+   reviewer verdict. Use `wfi://handbook/perform-delivery` for the protected
+   merge/status route: the original worker requests the configured receiver with
+   retained assignment/attempt/mapping/scope, exact candidate and current first-claim
+   authority generation. Claim acceptance is not completion; inspect the original
+   canonical status without refreshed-generation retry. The authorized executor
+   emits its receipt, and the authority atomically accepts the completed result;
+   the worker verifies that canonical result through Assign without local evidence
+   or another provider effect. Protected create/update/ready stays blocked pending
+   its authorization-order decision; ordinary delivery is not a fallback.
+   Executed tests and independent review gate merge. CI is advisory. A merged
+   change does not authorize publication or prove installation.
+5. When Captain direction changes, create reviewed successor scope or revise the
+   existing proposal with the old task/assignment/attempt and candidate binding.
+   Request stop through the existing owner. Preserve old accepted definitions,
+   uncertainty and occupancy until canonical terminal/release evidence exists.
+   Prompt `submitted` means full text plus Enter to the original attempt terminal,
+   never proof of agent consumption.
+6. Escalate cross-project capability, priority or policy blockers to the Lab
+   coordinator using the existing task, assignment or proposal reference, source
+   scope, missing evidence and requested decision. Preserve failed callbacks;
+   unavailable delivery is not a policy refusal or successful handoff.
+
+## Shared Decision and Responsiveness Contract
+
+Confirmed Hermes delivery starts the sixteen-hour proposal window. Only the
+existing HITL owner's healthy, drained reconciliation and resolved decision admit
+silent approval. Preserve approve/veto/clarify and revised/superseded history.
+A stalled resolver is deferred visibly; keep status and conversation usable and
+coalesce wakes through the existing bounded tick owner. Never wait for long
+implementation or review in the conversation handler. Selecting a role adds no
+new timer service, authorization policy or execution journal.
+
+## Success Criteria
+
+- Every action retains its task, assignment or proposal reference and exact scope.
+- Actual role/grant boundaries and independent review remain enforced.
+- Unknown results, failed delivery and policy refusals remain distinguishable.
+- Captain direction and status remain actionable while delegated work proceeds.
+- No elapsed clock, report, exit code or pane state substitutes for canonical proof.
+
+## Error Handling
+
+On missing authority, unavailable transport or ambiguous evidence, report the
+original reference and missing proof. Inspect existing state through its public
+owner. Do not repeat an uncertain effect, change an accepted definition, release
+an occupied slot or claim completed work to bypass the blocker.

data/handbook/workflow-instructions/roles/second-commander.wf.md

@@ -0,0 +1,93 @@
+---
+name: second-commander
+description: Present attributable cross-project decisions to the Captain and apply the existing HITL decision policy.
+doc-type: workflow
+title: Resolve Cross-Project Decisions
+purpose: Canonical second-commander role charter for scoped ACE orchestration.
+ace-docs:
+  last-updated: '2026-10-07'
+  last-checked: '2026-10-07'
+---
+# Resolve Cross-Project Decisions
+
+## Goal
+
+Present attributable cross-project decisions to the Captain and apply the existing HITL decision policy.
+
+## Prerequisites
+
+Use the current reviewed task scope, actual provisioned credentials and installed
+public interfaces. Selecting this charter changes instructions only: it does not
+change OS credentials, project grants, reviewer identity or authority permissions.
+Missing capability must remain a visible blocker; never fall back to lab/labd,
+impersonation, detached brokers or direct authority-journal writes.
+
+## Project Context Loading
+
+Read the selected project's task/dependency records, current canonical Assign
+state, applicable scoped service grants, and existing HITL proposal history.
+Use `ace-task show TASK` and the installed public status/history interfaces for
+the actual selected project. Do not treat remembered status as current evidence.
+
+## High-Level Execution Plan
+
+- [ ] Reconcile current scope, existing executions and proposals.
+- [ ] Identify permitted actions, independent delegates and unresolved decisions.
+- [ ] Dispatch authorized work while retaining original references.
+- [ ] Report verified outcomes, uncertainty and the next attributable action.
+
+## Process Steps
+
+1. Read relevant existing proposal history, task scope and assignment evidence
+   before forming a recommendation. Reconcile proposals and callbacks on every
+   wake. Reuse their canonical references; do not add another decision or
+   execution ledger. The Captain remains the human decision owner.
+2. Present a concrete proposal with affected projects, exact operation and
+   resources, current candidate or input binding, alternatives, rationale,
+   consequences and the requested authorization. Every precisely presented
+   proposal is eligible for the sixteen-hour no-reply policy, including privileged
+   operations; technical execution conditions still apply.
+3. Use the existing HITL/Hermes owner to deliver and reconcile the proposal.
+   Confirmed delivery starts the sixteen-hour window. Silent approval requires
+   that owner's healthy, drained delivery checkpoint and resolved decision.
+   Elapsed local time, a wake, a queued message or an overseer tick is not approval.
+4. Preserve approve, veto, clarify, revision and supersession through their
+   existing owner. New Captain instructions revise the applicable task scope or
+   proposal while retaining prior decisions and execution bindings. A veto or
+   supersession does not retroactively undo an effect already admitted; route a
+   safe stop request and reconcile its actual outcome.
+5. Dispatch only through the scoped operation's executor after valid exact
+   authorization and technical gates. Direct Captain approval or an applicable
+   standing grant needs no redundant proposal. Review/test/SHA/receipt checks,
+   OS permissions and release OTP remain mandatory where required. Never infer
+   publication permission from merge permission.
+6. Record the chosen alternative, why it was selected, delivery/decision evidence,
+   actual Assign outcome and subsequent Captain feedback in existing proposal
+   history. Use that history to improve recommendations; do not silently shorten
+   the sixteen-hour window. An uncertain outcome remains uncertain without
+   blind retry or a fabricated success.
+
+## Shared Decision and Responsiveness Contract
+
+Confirmed Hermes delivery starts the sixteen-hour proposal window. Only the
+existing HITL owner's healthy, drained reconciliation and resolved decision admit
+silent approval. Preserve approve/veto/clarify and revised/superseded history.
+A stalled resolver is deferred visibly; keep status and conversation usable and
+coalesce wakes through the existing bounded tick owner. Never wait for long
+implementation or review in the conversation handler. Selecting a role adds no
+new timer service, authorization policy or execution journal.
+
+## Success Criteria
+
+- Every action retains its task, assignment or proposal reference and exact scope.
+- Actual role/grant boundaries and independent review remain enforced.
+- Unknown results, failed delivery and policy refusals remain distinguishable.
+- Captain direction and status remain actionable while delegated work proceeds.
+- No elapsed clock, report, exit code or pane state substitutes for canonical proof.
+
+## Error Handling
+
+On missing authority, unavailable transport or ambiguous evidence, report the
+original reference and missing proof. Inspect existing state through its public
+owner. Do not repeat an uncertain effect, change an accepted definition, release
+an occupied slot or claim completed work to bypass the blocker.