ace-review 0.60.2 → 0.60.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7a5d2a502e12992e339ce8f61fa147e9232ccaba97393af83f3e28e46d5ff67b
-  data.tar.gz: e494d8c91a74925bf75f0a234feb8424a061d8edb2c183f191c8b1360946c57e
+  metadata.gz: cf22abbaecfa8e1946ec8d74145079d674550f330d80c6a11b6585daf06838c8
+  data.tar.gz: f4c8b3bacba1773ce6e524db739f775f0a3f24583b2b95eab82556ebe14405e7
 SHA512:
-  metadata.gz: 1fd6cb5c9c591e6f869b54b6de6c73510a5bfbbf3bec00fabdb14eca47b9bceaa8e2242be78be9ae0278b335f3582cb214711efb0b4cda48fa2fc6c65e3a8e81
-  data.tar.gz: 5e20675f80c039fe4dbd5601fe54b9a9827a01c08027ee2b49a20e38a5993b4be6a720ae152e3fe36cae64e9cf7e52fc06f91f36d3f4e381b09475eaa47cc023
+  metadata.gz: 20a97ff08b91f5ebc898e3ab6d4b251e1effb8be044473cb2875ff34b25cb101de727fb24b6190879b5c133a2bb8e0278608f230d2556b44662ab1872baf91b1
+  data.tar.gz: bcc904083e7d122a03ca7dbe3fce06fc9bf6934a74b8a761d9f4404a24c4ed9e6613ac7efdcc6e43f9e9d351720a1cd42b05288fdf61ccdb87a41b8be3e2dc05

data/CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.60.3] - 2026-10-16
+
+### Fixed
+
+- Keep campaign execution receipts stable across unrelated journal appends, preserve historical-head evidence joins, and make delta reports uniquely attributable without requiring a local branch checkout.
+
 ## [0.60.2] - 2026-10-16
 
 ### Changed

data/lib/ace/review/molecules/campaign_execution_evidence.rb

@@ -68,7 +68,10 @@ module Ace
               data["head"] == head && data["kind"] == kind && data["historical"] == historical
             raise Atoms::CampaignContract::Invalid, "accepted execution receipt identity/head/kind mismatch"
           end
-          data
+          # The journal tip is a read cursor, not the identity of an accepted
+          # receipt. Unrelated attempts advance it without changing this proof.
+          # Keep the receipt digest, exact head and canonical ref in the proof.
+          data.except("journal_commit")
         rescue Gem::LoadError, JSON::ParserError, SystemCallError => e
           raise Atoms::CampaignContract::Invalid, "ace-assign execution authority unavailable: #{e.message}"
         end

data/lib/ace/review/molecules/delta_resolver.rb

@@ -2,6 +2,7 @@
 
 require "open3"
 require "yaml"
+require "ace/git/atoms/server_url"
 
 module Ace
   module Review
@@ -46,6 +47,10 @@ module Ace
           return {success: false, error: "Delta reference '#{reference}' is not a commit SHA"} unless reference_head.match?(SHA_PATTERN)
           return {success: false, error: "Delta reference head #{reference_head} is not an ancestor of the current PR head #{head}; history was likely rewritten — re-run a full review round"} unless ancestor?(reference_head, head, project_root: project_root)
 
+          if reference_head == head && newer_local_head?(head, pr_metadata, project_root: project_root)
+            return {success: false, error: "PR metadata still reports the reviewed head #{head}, but the local PR branch is newer; reconcile the push and refresh PR metadata before recording an empty delta"}
+          end
+
           diff = run_git(["diff", "#{reference_head}..#{head}"], project_root: project_root)
           return diff unless diff[:success]
 
@@ -53,6 +58,48 @@ module Ace
            session_dir: session_dir, diff: diff[:stdout]}
         end
 
+        # Repeated provider reads can return the same stale snapshot after a
+        # push. A local descendant is evidence against certifying that no code
+        # changed. Select the PR branch explicitly; an unrelated checkout does
+        # not define that PR's head.
+        def self.newer_local_head?(head, metadata, project_root:)
+          branch = metadata["headRefName"].to_s
+          repository = metadata["head_repository_url"].to_s
+          return false if branch.empty? || repository.empty?
+          remote = run_git(["for-each-ref", "--format=%(push:remotename)%00%(push:remoteref)", "refs/heads/#{branch}"], project_root: project_root)
+          return false unless remote[:success]
+          remote_name, remote_ref = remote[:stdout].strip.split("\0", -1)
+          return false if remote_name.to_s.empty?
+          remote_ref = default_push_ref(branch, remote_name, project_root: project_root) if remote_ref.to_s.empty?
+          return false unless remote_ref == "refs/heads/#{branch}"
+          urls = run_git(["remote", "get-url", "--push", "--all", remote_name], project_root: project_root)
+          return false unless urls[:success] && urls[:stdout].lines.any? do |url|
+            Ace::Git::Atoms::ServerUrl.match?(repository, url.strip)
+          end
+          local = rev_parse("refs/heads/#{branch}", project_root: project_root)
+          local[:success] && local[:stdout] != head && ancestor?(head, local[:stdout], project_root: project_root)
+        end
+        private_class_method :newer_local_head?
+
+        # Git exposes push:remoteref for explicit push refspecs only. Its
+        # default policies use branch names/upstream, not that empty atom.
+        def self.default_push_ref(branch, remote, project_root:)
+          explicit = run_git(["config", "--get-all", "remote.#{remote}.push"], project_root: project_root)
+          return nil if explicit[:success] && !explicit[:stdout].empty?
+          policy = run_git(["config", "--get", "push.default"], project_root: project_root)
+          upstream = run_git(["config", "--get", "branch.#{branch}.merge"], project_root: project_root)
+          case policy[:stdout].to_s.strip
+          when "", "simple"
+            target = upstream[:stdout].to_s.strip
+            fetch = run_git(["config", "--get", "branch.#{branch}.remote"], project_root: project_root)
+            triangular = fetch[:success] && fetch[:stdout].strip != remote
+            "refs/heads/#{branch}" if triangular || target.empty? || target == "refs/heads/#{branch}"
+          when "current", "matching" then "refs/heads/#{branch}"
+          when "upstream" then upstream[:stdout].to_s.strip
+          end
+        end
+        private_class_method :default_push_ref
+
         # Find the head SHA recorded by the most recent prior session of this PR.
         #
         # @param pr_url [String] canonical PR URL stored in session metadata

data/lib/ace/review/molecules/review_evidence.rb

@@ -23,8 +23,9 @@ module Ace
             end
             # Reviewer reports are written as review-report-<model>.md (Ruby API
             # path) or review-<model>.md (CLI provider path); prompt/context and
-            # dev-feedback files are not reports.
-            reports = Dir.glob(File.join(dir, "review-*.md")).select do |path|
+            # dev-feedback files are not reports. Single-model and no-op rounds
+            # use the maintained review.md output.
+            reports = Dir.glob(File.join(dir, "{review-*,review}.md")).select do |path|
               base = File.basename(path)
               !base.end_with?(".prompt.md", ".context.md") &&
                 !%w[review-dev-feedback.md].include?(base)

data/lib/ace/review/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Review
-    VERSION = "0.60.2"
+    VERSION = "0.60.3"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ace-review
 version: !ruby/object:Gem::Version
-  version: 0.60.2
+  version: 0.60.3
 platform: ruby
 authors:
 - Michal Czyz