ace-overseer 0.20.0 → 0.20.2

data/lib/ace/overseer/cli/commands/agents.rb

@@ -1,20 +1,25 @@
 # frozen_string_literal: true
 require "json"
+require "ace/lab"
 module Ace
   module Overseer
     module CLI
       module Commands
         class Agents < Ace::Support::Cli::Command
           include Ace::Support::Cli::Base
-          desc "List configured Lab agents"
-          def initialize(client: nil)
+          desc "List agents visible through maintained public topology"
+          option :project, required: true, desc: "Visible installed project ID"
+          def initialize(topology: nil)
             super()
-            @client = client || Molecules::LabClient.new
+            @topology = topology || Ace::Lab::Organisms::TopologyService.from_config
           end
-          def call(**)
-            puts JSON.pretty_generate(@client.call("agents", "--json"))
-          rescue => error
-            raise Ace::Support::Cli::Error.new(error.message)
+          def call(project:, **extra)
+            raise Error, "Unsupported topology options" unless extra.empty?
+            result = @topology.agents(project: project)
+            puts JSON.generate(result.envelope)
+            raise Error, "#{result.error_code}: #{result.message}" unless result.ok?
+          rescue StandardError => error
+            raise Ace::Support::Cli::Error, error.message
           end
         end
       end

data/lib/ace/overseer/cli/commands/projects.rb

@@ -1,20 +1,24 @@
 # frozen_string_literal: true
 require "json"
+require "ace/lab"
 module Ace
   module Overseer
     module CLI
       module Commands
         class Projects < Ace::Support::Cli::Command
           include Ace::Support::Cli::Base
-          desc "List configured Lab projects"
-          def initialize(client: nil)
+          desc "List projects visible through maintained public topology"
+          def initialize(topology: nil)
             super()
-            @client = client || Molecules::LabClient.new
+            @topology = topology || Ace::Lab::Organisms::TopologyService.from_config
           end
-          def call(**)
-            puts JSON.pretty_generate(@client.call("project", "list", "--json"))
-          rescue => error
-            raise Ace::Support::Cli::Error.new(error.message)
+          def call(**extra)
+            raise Error, "Unsupported topology options" unless extra.empty?
+            result = @topology.projects
+            puts JSON.generate(result.envelope)
+            raise Error, "#{result.error_code}: #{result.message}" unless result.ok?
+          rescue StandardError => error
+            raise Ace::Support::Cli::Error, error.message
           end
         end
       end

data/lib/ace/overseer/cli/commands/prompt.rb

@@ -1,32 +1,60 @@
 # frozen_string_literal: true
+require "json"
+require_relative "../../organisms/protected_steering"
 module Ace
   module Overseer
     module CLI
       module Commands
         class Prompt < Ace::Support::Cli::Command
           include Ace::Support::Cli::Base
-          desc "Prompt a running Lab Work from stdin"
-          option :work, required: true, desc: "Work ID"
-          option :file, desc: "Read prompt text from a file instead of stdin"
-          def initialize(client: nil, input: $stdin)
+          desc "Prompt an exact protected attempt or inspect its original prompt mutation"
+          option :project, required: true, desc: "Installed project ID"
+          option :agent, required: true, desc: "Literal installed mapping ID"
+          option :assignment, required: true, desc: "Original assignment ID"
+          option :attempt, required: true, desc: "Original attempt ID"
+          option :mutation, required: true, desc: "Stable original prompt mutation ID"
+          option :expected_generation, type: :integer, desc: "Observed original generation; never refreshed"
+          option :file, desc: "Read exact bounded prompt bytes from this regular file"
+          option :stdin, type: :boolean, default: false, desc: "Read exact bounded prompt bytes from redirected stdin"
+          option :status, type: :boolean, default: false, desc: "Read original prompt status without sending input"
+          def initialize(steering: nil, input: $stdin)
             super()
-            @client = client || Molecules::LabClient.new
+            @steering = steering || Organisms::ProtectedSteering.new
             @input = input
           end
-          def call(work:, file: nil, **)
-            if file
-              prompt = File.read(file)
+          def call(project:, agent:, assignment:, attempt:, mutation:, expected_generation: nil,
+            file: nil, stdin: false, status: false, **extra)
+            raise Error, "Unsupported prompt options" unless extra.empty?
+            text = if status
+              raise Error, "Prompt status forbids input selectors and expected generation" if file || stdin || expected_generation
+              nil
             else
-              if @input.respond_to?(:tty?) && @input.tty?
-                raise Ace::Support::Cli::Error, "prompt text is required via --file or stdin"
+              raise Error, "Select exactly one --file or --stdin" unless (!!file ^ !!stdin)
+              file ? file_bytes(file) : stdin_bytes
+            end
+            result = @steering.prompt(project: project, agent: agent, assignment: assignment, attempt: attempt,
+              mutation: mutation, expected_generation: expected_generation, text: text, status: status)
+            puts JSON.pretty_generate(result)
+          rescue StandardError => error
+            raise Ace::Support::Cli::Error, error.message
+          end
+          private
+          def stdin_bytes
+            raise Error, "--stdin requires redirected input" if @input.respond_to?(:tty?) && @input.tty?
+            @input.read(16_385) || ""
+          end
+          def file_bytes(path)
+            File.open(path, File::RDONLY | File::NOFOLLOW | File::NONBLOCK) do |file|
+              before = file.stat
+              raise Error, "Prompt file must be bounded and regular" unless before.file? && before.size.between?(1, 16_384)
+              bytes = file.read(16_385) || ""
+              after = file.stat
+              identity = ->(stat) { [stat.dev, stat.ino, stat.size, stat.mtime, stat.ctime] }
+              unless bytes.bytesize == before.size && identity.call(before) == identity.call(after)
+                raise Error, "Prompt file changed during held read"
               end
-              prompt = @input.read
+              bytes
             end
-            raise Ace::Support::Cli::Error, "prompt text must contain non-whitespace characters" if prompt.strip.empty?
-
-            puts @client.call("work", "prompt", work, stdin_data: prompt, json: false)
-          rescue => error
-            raise Ace::Support::Cli::Error.new(error.message)
           end
         end
       end

data/lib/ace/overseer/cli/commands/prune.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../../organisms/protected_prune"
+
 module Ace
   module Overseer
     module CLI
@@ -19,31 +21,68 @@ module Ace
           option :quiet, aliases: ["-q"], type: :boolean, default: false,
             desc: "Suppress progress output; failures still print and signal via exit code"
           option :debug, aliases: ["-d"], type: :boolean, default: false, desc: "Show debug output"
-          option :runtime, default: "tmux", desc: "Runtime (tmux, lab)"
           option :preservation, type: :string,
             desc: "YAML manifest (version 1) declaring verified cross-repository destinations"
-
-          def initialize(orchestrator: nil, input: $stdin, output: $stdout, lab_client: nil,
-            lab_safety_checker: nil, preservation_checker: nil)
+          option :project, desc: "Protected target project"
+          option :agent, desc: "Exact protected target mapping"
+          option :attempt, desc: "Exact protected target attempt"
+          option :request, desc: "Bounded protected prune JSON FILE"
+          option :status, type: :boolean, default: false, desc: "Observe the existing protected service request"
+          option :mutation, desc: "Stable explicit protected service request ID"
+          option :expected_generation, type: :integer, desc: "Expected current authority mutation generation"
+          option :authorization, desc: "Existing exact service authorization reference"
+
+          def initialize(orchestrator: nil, protected_prune: nil, input: $stdin, output: $stdout)
             super()
-            @orchestrator = orchestrator || Organisms::PruneOrchestrator.new
+            @orchestrator = orchestrator
             @input = input
             @output = output
-            @lab_client = lab_client || Molecules::LabClient.new
-            @lab_safety_checker = lab_safety_checker || Molecules::LabPruneSafetyChecker.new
-            @preservation_checker = preservation_checker || Molecules::GitPreservationChecker.new
+            @protected_prune = protected_prune || Organisms::ProtectedPrune.new
           end
 
           def call(**options)
-            runtime = options.fetch(:runtime, "tmux")
-            if runtime == "lab"
-              prune_lab(**options)
+            if options[:status]
+              if options.values_at(:project, :agent, :assignment, :attempt).any?
+                raise Ace::Support::Cli::Error, "Protected prune status selects its target only from FILE"
+              end
+              if options[:dry_run] || options[:yes] || options[:force] || options[:authorization] || options[:expected_generation] ||
+                  options[:preservation] || !Array(options[:targets]).empty? || options.key?(:runtime)
+                raise Ace::Support::Cli::Error, "Protected prune status forbids effect/local options"
+              end
+              @output.puts JSON.generate(@protected_prune.status(request: options[:request], mutation: options[:mutation]))
+              return
+            end
+            if options[:project]
+              unless options.values_at(:project, :agent, :assignment, :attempt, :request).all? { |value| value.is_a?(String) && !value.empty? }
+                raise Ace::Support::Cli::Error, "Protected prune requires exact project, agent, assignment, attempt and request FILE"
+              end
+              unless !options[:force] && !options[:preservation] &&
+                  Array(options[:targets]).empty? && !options.key?(:runtime)
+                raise Ace::Support::Cli::Error, "Protected prune forbids local options"
+              end
+              selectors = options.slice(:project, :agent, :assignment, :attempt, :request)
+              value = if options[:dry_run]
+                if options[:yes] || options[:mutation] || options[:authorization] || options[:expected_generation]
+                  raise Ace::Support::Cli::Error, "Protected preview forbids effect options"
+                end
+                @protected_prune.preview(**selectors)
+              else
+                raise Ace::Support::Cli::Error, "Protected apply requires --yes" unless options[:yes]
+                @protected_prune.apply(**selectors, mutation: options[:mutation],
+                  expected_generation: options[:expected_generation], authorization: options[:authorization])
+              end
+              @output.puts JSON.generate(value)
               return
             end
-            raise Ace::Support::Cli::Error, "unsupported runtime: #{runtime}" unless runtime == "tmux"
+            if options.values_at(:agent, :attempt, :request, :mutation, :authorization, :expected_generation).any?
+              raise Ace::Support::Cli::Error, "Protected prune options require --project"
+            end
+            raise Ace::Support::Cli::Error, "Prune uses the configured local runtime; protected physical cleanup has its own owner" if options.key?(:runtime)
 
             Atoms::RepoGuard.ensure_repo!
 
+            @orchestrator ||= Organisms::PruneOrchestrator.new
+
             targets = Array(options[:targets] || [])
             progress = options[:quiet] ? nil : ->(msg) { puts msg }
             result = @orchestrator.call(
@@ -93,117 +132,6 @@ module Ace
 
           private
 
-          def prune_lab(**options)
-            raise Ace::Support::Cli::Error, "--assignment is not supported with Lab runtime; provide exact Work IDs" if options[:assignment]
-            raise Ace::Support::Cli::Error, "--force is not supported with Lab runtime" if options[:force]
-            raise Ace::Support::Cli::Error, "--preservation is not supported with Lab runtime" if options[:preservation]
-
-            works = Array(options[:targets]).map(&:to_s)
-            raise Ace::Support::Cli::Error, "provide at least one exact Lab Work ID to prune" if works.empty?
-
-            classifications = if atomic_destroy_supported?
-              works.to_h do |work|
-                [work, @lab_safety_checker.check(
-                  lab_client: @lab_client,
-                  work_id: work,
-                  preservation_proof: lab_preservation_proof(work)
-                )]
-              end
-            else
-              # The raw Lab surface cannot make the no-writer check and the
-              # destruction atomic; claiming a probe was safe would be a
-              # lie, so the whole path is unsupported and preserved.
-              unsupported = Molecules::LabPruneSafetyChecker::Classification.new(
-                safe?: false,
-                reason: "lab runtime cannot make the no-writer check and destruction atomic; " \
-                  "preserve the Work instead"
-              )
-              works.to_h { |work| [work, unsupported] }
-            end
-
-            if options[:dry_run]
-              print_lab_dry_run(classifications)
-              return
-            end
-
-            raise Ace::Support::Cli::Error, "Lab prune requires --yes after reviewing --dry-run" unless options[:yes]
-
-            blocked = []
-            destroyed = []
-            works.each do |work|
-              classification = classifications[work]
-              unless classification.safe?
-                blocked << [work, classification.reason]
-                next
-              end
-
-              # Guarded delegation: re-read the authoritative state
-              # immediately before destroy; a changed state aborts.
-              recheck = @lab_safety_checker.check(
-                lab_client: @lab_client,
-                work_id: work,
-                preservation_proof: lab_preservation_proof(work)
-              )
-              unless recheck.safe?
-                blocked << [work, "state changed before destroy: #{recheck.reason}"]
-                next
-              end
-
-              result = @lab_client.call("work", "destroy", work, "--confirm", json: false)
-              destroyed << work
-              puts result unless options[:quiet]
-            end
-
-            blocked.each do |work, reason|
-              puts "Blocked: lab work #{work}: #{reason}"
-            end
-            puts "#{destroyed.length} lab work(s) destroyed." unless options[:quiet]
-            return if blocked.empty?
-
-            raise Ace::Support::Cli::Error, "#{blocked.length} lab work(s) blocked; nothing unsafe was destroyed"
-          end
-
-          # Delegation is only honest when the Lab surface itself can make
-          # the state check and the destruction atomic. The raw CLI adapter
-          # cannot, so it reports unsupported; adapters with an atomic
-          # guarded destroy opt in.
-          def atomic_destroy_supported?
-            @lab_client.respond_to?(:supports_atomic_destroy?) && @lab_client.supports_atomic_destroy?
-          end
-
-          # Preservation evidence for a Lab Work comes from the Work's own
-          # documented surviving identity (repo/head/branch). A surface that
-          # does not document it cannot prove preservation.
-          def lab_preservation_proof(work)
-            entry = @lab_client.work_entry(work)
-            return Models::PreservationProof.blocked("lab work #{work} not found in authoritative status") if entry.nil?
-
-            repo = entry["repo"].to_s
-            head = entry["head"].to_s
-            branch = entry["branch"].to_s
-            if repo.empty? || head.empty? || branch.empty? || !repo.start_with?("/")
-              return Models::PreservationProof.blocked(
-                "lab work #{work} does not document preservation data (repo/head/branch)"
-              )
-            end
-
-            accepted_base = @preservation_checker.accepted_base_for(repo)
-            @preservation_checker.ancestry_proof(repo: repo, head: head, accepted_base: accepted_base)
-          rescue Ace::Overseer::Error => e
-            Models::PreservationProof.blocked("lab preservation evidence unavailable: #{e.message}")
-          end
-
-          def print_lab_dry_run(classifications)
-            puts "Lab prune classification:"
-            classifications.each do |work, classification|
-              if classification.safe?
-                puts "  #{work}: safe (terminal, preserved, no in-flight work)"
-              else
-                puts "  #{work}: BLOCKED — #{classification.reason}"
-              end
-            end
-          end
-
           def print_assignment_result(result)
             candidate = result[:assignment_candidate]
             if result[:dry_run]

data/lib/ace/overseer/cli/commands/review.rb

@@ -1,20 +1,40 @@
 # frozen_string_literal: true
+require "json"
+require_relative "../../organisms/protected_review"
+
 module Ace
   module Overseer
     module CLI
       module Commands
         class Review < Ace::Support::Cli::Command
           include Ace::Support::Cli::Base
-          desc "Start an exact-head Lab review"
-          option :work, required: true, desc: "Work ID"
-          option :pr, required: true, type: :integer, desc: "Forgejo PR number"
-          def initialize(client: nil)
+          desc "Review an exact protected candidate, inspect its request, or cancel its reservation"
+          option :project, required: true, desc: "Installed project ID"
+          option :agent, required: true, desc: "Installed agent mapping ID"
+          option :assignment, required: true, desc: "Assignment ID"
+          option :attempt, required: true, desc: "Attempt ID"
+          option :mutation, required: true, desc: "Request or cancel mutation; original request ID for status"
+          option :status, type: :boolean, default: false, desc: "Observe the original review request without execution"
+          option :cancel, type: :boolean, default: false, desc: "Cancel the exact review reservation"
+          option :head, desc: "Exact candidate commit"
+          option :candidate_generation, type: :integer, desc: "Exact candidate generation"
+          option :expected_generation, type: :integer, desc: "Observed authority generation; never refreshed implicitly"
+          option :accept_mutation, desc: "Distinct acceptance mutation for a new review"
+          option :review_event, desc: "Exact reservation event to cancel"
+
+          def initialize(review: nil)
             super()
-            @client = client || Molecules::LabClient.new
+            @review = review || Organisms::ProtectedReview.new
           end
-          def call(work:, pr:, **)
-            puts @client.call("work", "review", work, "--pr", pr, json: false)
-          rescue => error
+
+          def call(project:, agent:, assignment:, attempt:, mutation:, status: false, cancel: false,
+            head: nil, candidate_generation: nil, expected_generation: nil, accept_mutation: nil, review_event: nil, **extra)
+            raise Error, "Unsupported review options" unless extra.empty?
+            result = @review.call(project: project, agent: agent, assignment: assignment, attempt: attempt,
+              mutation: mutation, status: status, cancel: cancel, head: head, candidate_generation: candidate_generation,
+              expected_generation: expected_generation, accept_mutation: accept_mutation, review_event: review_event)
+            puts JSON.pretty_generate(result)
+          rescue StandardError => error
             raise Ace::Support::Cli::Error.new(error.message)
           end
         end

data/lib/ace/overseer/cli/commands/status.rb

@@ -16,39 +16,38 @@ module Ace
           option :quiet, aliases: ["-q"], type: :boolean, default: false, desc: "Suppress non-essential output"
           option :debug, aliases: ["-d"], type: :boolean, default: false, desc: "Show debug output"
           option :watch, aliases: ["-w"], type: :boolean, default: false, desc: "Auto-refresh dashboard"
-          option :runtime, default: "tmux", desc: "Runtime (tmux, lab)"
-          option :project, desc: "Filter Lab status by project"
+          option :runtime, desc: "Runtime (auto, tmux, herdr)"
+          option :project, desc: "Read protected canonical status for this project"
+          option :agent, desc: "Exact visible protected agent ID (requires --project)"
 
-          def initialize(collector: nil, config: nil, lab_client: nil, proposal_tick: nil)
+          def initialize(collector: nil, config: nil, protected_status: nil, proposal_tick: nil)
             super()
             @collector = collector || Organisms::StatusCollector.new
             @config = config
-            @lab_client = lab_client || Molecules::LabClient.new
+            @protected_status = protected_status || Organisms::ProtectedStatus.new
             @proposal_tick = proposal_tick || Molecules::ProposalTick.new
           end
 
-          def call(format:, runtime: "tmux", project: nil, **options)
-            tick_proposals
-            if runtime == "lab"
+          def call(format:, runtime: nil, project: nil, agent: nil, **options)
+            raise Ace::Support::Cli::Error, "--agent requires --project" if agent && project.to_s.empty?
+            selected_runtime = runtime || (@config || Ace::Overseer.config)["runtime"] || "auto"
+            unless project.to_s.empty?
+              unless %w[auto tmux herdr].include?(selected_runtime)
+                raise Ace::Support::Cli::Error, "unsupported runtime for protected inventory"
+              end
               if options[:watch]
-                raise Ace::Support::Cli::Error, "Lab watch runs in the project Herdr status pane; omit --watch"
+                raise Ace::Support::Cli::Error, "Protected status is a bounded snapshot; omit --watch"
               end
-              arguments = ["work", "status"]
-              arguments.concat(["--project", project]) unless project.to_s.empty?
-              arguments << "--json" if format == "json"
-              output = @lab_client.call(*arguments, json: false)
+              value = @protected_status.collect(project: project, agent: agent)
               unless options[:quiet]
                 warn @proposal_error if @proposal_error
-                if format == "json" && @proposal_error
-                  value = JSON.parse(output)
-                  output = JSON.pretty_generate(value.merge("proposal_resolution" =>
-                    {"status" => "deferred", "error" => @proposal_error})) if value.is_a?(Hash)
-                end
-                puts output
+                value = value.merge("proposal_resolution" => {"status" => "deferred", "error" => @proposal_error}) if @proposal_error
+                puts(format == "json" ? JSON.pretty_generate(value) : protected_table(value))
               end
               return
             end
-            raise Ace::Support::Cli::Error, "unsupported runtime: #{runtime}" unless runtime == "tmux"
+            raise Ace::Support::Cli::Error, "unsupported local runtime: #{selected_runtime}" unless %w[auto tmux].include?(selected_runtime)
+            tick_proposals
 
             Atoms::RepoGuard.ensure_repo!
             return if options[:quiet]
@@ -66,6 +65,21 @@ module Ace
 
           private
 
+          def protected_table(value)
+            lines = ["#{value.fetch('project_id')}: #{value.fetch('visible_capacity')}/#{value.fetch('provisioned_capacity')} visible mappings (#{value.fetch('visibility')})"]
+            value.fetch("agents").each do |agent|
+              if agent.fetch("status") != "ok"
+                lines << "#{agent.fetch('agent_id')}\tunavailable"
+                next
+              end
+              agent.fetch("inventory").fetch("items").each do |row|
+                lines << [agent.fetch("agent_id"), row.fetch("assignment_id"), row.fetch("attempt_id") || "registration",
+                  row.fetch("canonical_state") || "registered", row.fetch("reservation_release_event_id") ? "released" : "retained"].join("\t")
+              end
+            end
+            lines.join("\n")
+          end
+
           def tick_proposals
             @proposal_tick.call
             @proposal_error = nil

data/lib/ace/overseer/cli/commands/stop.rb

@@ -1,20 +1,30 @@
 # frozen_string_literal: true
+require "json"
+require_relative "../../organisms/protected_steering"
 module Ace
   module Overseer
     module CLI
       module Commands
         class Stop < Ace::Support::Cli::Command
           include Ace::Support::Cli::Base
-          desc "Stop a Lab Work"
-          option :work, required: true, desc: "Work ID"
-          def initialize(client: nil)
+          desc "Request proof-authenticated stop of an exact protected attempt"
+          option :project, required: true, desc: "Installed project ID"
+          option :agent, required: true, desc: "Literal installed mapping ID"
+          option :assignment, required: true, desc: "Original assignment ID"
+          option :attempt, required: true, desc: "Original attempt ID"
+          option :mutation, required: true, desc: "Stable stop mutation ID"
+          option :expected_generation, type: :integer, required: true, desc: "Observed original generation; never refreshed"
+          def initialize(steering: nil)
             super()
-            @client = client || Molecules::LabClient.new
+            @steering = steering || Organisms::ProtectedSteering.new
           end
-          def call(work:, **)
-            puts @client.call("work", "stop", work, json: false)
-          rescue => error
-            raise Ace::Support::Cli::Error.new(error.message)
+          def call(project:, agent:, assignment:, attempt:, mutation:, expected_generation:, **extra)
+            raise Error, "Unsupported stop options" unless extra.empty?
+            result = @steering.stop(project: project, agent: agent, assignment: assignment, attempt: attempt,
+              mutation: mutation, expected_generation: expected_generation)
+            puts JSON.pretty_generate(result)
+          rescue StandardError => error
+            raise Ace::Support::Cli::Error, error.message
           end
         end
       end

data/lib/ace/overseer/cli/commands/work_on.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+require_relative "../../organisms/launch_recovery"
+require_relative "../../organisms/protected_work_on"
+
 module Ace
   module Overseer
     module CLI
@@ -7,35 +10,68 @@ module Ace
         class WorkOn < Ace::Support::Cli::Command
           include Ace::Support::Cli::Base
 
-          desc "Create worktree, open tmux window, and prepare assignment"
+          desc "Start local task work or retain one original protected launch"
 
           option :task, aliases: ["-t"], type: :array,
             desc: "Task reference(s), repeatable and comma-separated (e.g., 230 --task 231,232)"
+          option :recover_request, desc: "Read retained protected invocation input and original canonical reservation"
           option :preset, aliases: ["-p"], desc: "Assignment preset name"
-          option :runtime, default: "tmux", desc: "Runtime (tmux, lab)"
-          option :work, desc: "Existing Lab Work ID"
-          option :agent, desc: "Configured Lab agent ID"
+          option :runtime, desc: "Terminal backend (auto, tmux, herdr)"
+          option :project, desc: "Explicit protected project ID"
+          option :base_head, desc: "Explicit reviewed code base (must match current source HEAD)"
+          option :mutation, desc: "Stable retained protected invocation ID"
+          option :dependency_report, type: :array, desc: "Selected task:assignment:step report identities"
+          option :agent, desc: "Exact visible protected mapping ID (requires project)"
           option :quiet, aliases: ["-q"], type: :boolean, default: false, desc: "Suppress non-essential output"
           option :debug, aliases: ["-d"], type: :boolean, default: false, desc: "Show debug output"
 
-          def initialize(orchestrator: nil, lab_client: nil)
+          def initialize(orchestrator: nil, recovery: nil, protected_work_on: nil, config: nil)
             super()
+            @recovery = recovery || Organisms::LaunchRecovery.new
             @orchestrator = orchestrator || Organisms::WorkOnOrchestrator.new
-            @lab_client = lab_client || Molecules::LabClient.new
+            @protected_work_on = protected_work_on || Organisms::ProtectedWorkOn.new
+            @config = config
           end
 
-          def call(task: nil, preset: nil, runtime: "tmux", work: nil, agent: nil, **options)
-            if runtime == "lab"
-              if task || preset
-                raise Ace::Support::Cli::Error, "--task and --preset are not supported with Lab runtime"
+          def call(task: nil, preset: nil, runtime: nil, project: nil, agent: nil, mutation: nil, base_head: nil, dependency_report: nil, recover_request: nil, **options)
+            raise Ace::Support::Cli::Error, "--work is obsolete; select task/project or retained request" if options.key?(:work)
+            if recover_request
+              if task || preset || project || agent || runtime || mutation || base_head || dependency_report
+                raise Ace::Support::Cli::Error, "--recover-request cannot be combined with launch mode overrides"
               end
-              raise Ace::Support::Cli::Error, "--work and --agent are required for Lab runtime" if work.to_s.empty? || agent.to_s.empty?
-
-              output = @lab_client.call("work", "dispatch", work, "--agent", agent, json: false)
-              puts output unless options[:quiet]
+              # Retained identity/canonical attribution remains mandatory even
+              # under --quiet. This path never enters preparation or launch.
+              puts JSON.generate(@recovery.call(path: recover_request))
               return
             end
-            raise Ace::Support::Cli::Error, "unsupported runtime: #{runtime}" unless runtime == "tmux"
+            selected_runtime = runtime || (@config || Ace::Overseer.config)["runtime"] || "auto"
+            raise Ace::Support::Cli::Error, "unsupported runtime: #{selected_runtime}" unless %w[auto tmux herdr].include?(selected_runtime)
+            if project
+              refs = normalize_task_refs(task)
+              raise Ace::Support::Cli::Error, "Protected launch requires exactly one reviewed leaf task and no preset override" unless refs.one? && preset.nil?
+              reports = Array(dependency_report).map do |entry|
+                fields = entry.split(":", -1)
+                raise Ace::Support::Cli::Error, "Report identity must be task:assignment:step" unless fields.size == 3 && fields.none?(&:empty?)
+                %w[task_id assignment_id number].zip(fields).to_h
+              end
+              report = ->(identity) { $stdout.write(JSON.generate(identity) + "\n"); $stdout.flush }
+              result = @protected_work_on.start(task_ref: refs.first, project: project, agent: agent, runtime: selected_runtime,
+                dependency_reports: reports, mutation_id: mutation, base_head: base_head, report: report)
+              child = result.fetch("child")
+              begin
+                puts JSON.generate("type" => "original_launch_observation", "pid" => child.pid, "state" => child.state,
+                  "ready" => child.ready, "error" => child.error)
+                $stdout.flush
+              ensure
+                # An output failure after creation cannot discard the original
+                # living child or turn local observation into canonical release.
+                @protected_work_on.serve(child)
+              end
+              return
+            end
+            if agent || mutation || base_head || dependency_report
+              raise Ace::Support::Cli::Error, "Protected mapping/invocation/report selection requires --project"
+            end
 
             Atoms::RepoGuard.ensure_repo!
 
@@ -49,7 +85,7 @@ module Ace
               task_ref: task_refs.first,
               task_refs: task_refs,
               cli_preset: preset,
-              on_progress: progress
+              on_progress: progress, runtime: selected_runtime
             )
 
             return if options[:quiet]