ace-review 0.60.2 → 0.61.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7a5d2a502e12992e339ce8f61fa147e9232ccaba97393af83f3e28e46d5ff67b
-  data.tar.gz: e494d8c91a74925bf75f0a234feb8424a061d8edb2c183f191c8b1360946c57e
+  metadata.gz: afd5ecbdd17112927d36de0cefcea9307419d0dfb28b47a53b8caa27fccee5a9
+  data.tar.gz: aee54796dbef9221a2e45d2a5f630228c7b5f9740022edfdb05a6261c2be6960
 SHA512:
-  metadata.gz: 1fd6cb5c9c591e6f869b54b6de6c73510a5bfbbf3bec00fabdb14eca47b9bceaa8e2242be78be9ae0278b335f3582cb214711efb0b4cda48fa2fc6c65e3a8e81
-  data.tar.gz: 5e20675f80c039fe4dbd5601fe54b9a9827a01c08027ee2b49a20e38a5993b4be6a720ae152e3fe36cae64e9cf7e52fc06f91f36d3f4e381b09475eaa47cc023
+  metadata.gz: 1a966051ac35b1a93158cdfa5511178d18a24951a0ce8b55cc811fa6908408a597d7f40f8282effcbbc531e96aa769b8139a8ef033d39a6ebc1a92b19d95948c
+  data.tar.gz: 5e8d30ea044003a071efca1ebf7c1f616d13aaecda536f5f2379f776f33913cf9b56cfb12863363760a3b53b9c99f2b1f17c159d9c7ec3d59e6b400590095c93

data/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.61.0] - 2026-10-16
+
+### Added
+
+- Add source-owned nonsemantic head assessments to the existing campaign history, retaining the original reviewed head, fresh checks, and an exact predecessor chain without consuming or resetting review budgets. Accepted-result v2 distinguishes reviewed and accepted heads; unavailable assessment authority keeps acceptance closed.
+- Let an installed campaign evidence owner verify real reviewer independence for agents sharing an account, while preserving the default distinct-actor requirement.
+- Expose the closed 128MiB complete-head-context ceiling as `CampaignContract::MAX_HEAD_CONTEXT_BYTES` so campaign head assessments and the Assign-side candidate comparison share one explicit bound; ace-assign consumes this constant directly.
+
+## [0.60.3] - 2026-10-16
+
+### Fixed
+
+- Keep campaign execution receipts stable across unrelated journal appends, preserve historical-head evidence joins, and make delta reports uniquely attributable without requiring a local branch checkout.
+
 ## [0.60.2] - 2026-10-16
 
 ### Changed

data/docs/campaigns.md

@@ -96,7 +96,7 @@ Expected: complete coverage increments `completed_rounds` once. Identical replay
 
 ## Current approval and finish
 
-Delivery defaults are three completed rounds and two consecutive rounds without confirmed High/Critical. The default scope is `full` and required check name is `tests`. Configure `campaign.profiles.delivery` in `.ace/review/config.yml`, or supply `start --policy FILE` with exactly `revision`, `minimum_rounds`, `clean_rounds`, `required_scopes`, `required_checks`. Explicit false/null or otherwise malformed policy files fail instead of selecting defaults. The campaign freezes that revision and policy. R1 does not implement discovery profiles, round caps, automatic retries or escalation.
+Delivery defaults are three completed rounds and two consecutive rounds without confirmed High/Critical, bounded to five rounds in the initial phase. Discovery is bounded to two rounds. The default scope is `full` and required check name is `tests`. Configure `campaign.profiles.delivery` in `.ace/review/config.yml`, or supply `start --policy FILE` with exactly `revision`, `minimum_rounds`, `clean_rounds`, `required_scopes`, `required_checks`. Explicit false/null or otherwise malformed policy files fail instead of selecting defaults. The campaign freezes that revision and policy. Provider reservations retain the original execution when its outcome is running or uncertain; finite infrastructure retries and an explicit next-phase authorization are enforced by the existing campaign owner.
 
 The final round may reference an explicit approval artifact with `approval: {"path": ..., "sha256": ...}`. An approval binds an independently approved executed review already accepted by the assignment coordinator. Caller-written approval JSON alone cannot supply the verdict. It must contain:
 
@@ -144,10 +144,22 @@ The receipt retains ordinary attempt/assignment/project/scope binding, producer,
 
 Source-owned receipt composition can call `CampaignManager#with_verified_result!(result:, subject:, contract_identity:, policy:, head:, base:, producer:, reviewer:) { |current| ... }`. It requires a block and an existing campaign lock, revalidates current acceptance and the exact expected tuple, and yields a deeply frozen projection while holding one read transaction. Keep the entire receipt/CAS operation inside that block; a retained projection is not a later permission. Do not call public campaign methods from inside the block. Exceptions release the lock, and validation failures never yield. This API does not itself provide protected child linkage or authorize a journal mutation.
 
+### Source-owned head assessment capability
+
+`accepted_result_snapshot` emits `ace.review.accepted-result/v2`. Its `head` and `base` identify current acceptance; `reviewed_head` and `reviewed_base` retain the original independent approval. `head_assessment_digest` and the `head_assessments` prefix count bind the append-only assessment chain. The v1 compact result is refused. A direct approval has equal reviewed and accepted heads and an empty assessment chain.
+
+An installed source owner may supply `head_assessment_evidence` to `CampaignManager` and call `record_head_assessment(id, {"id", "reference", "predecessor"})`. The predecessor must be the exact current accepted prefix. The source callback authenticates the supervisor, derives complete bounded comparison context from retained candidates, and returns the bound assessment proof. The campaign separately revalidates each required current-head check through its existing execution-evidence reader. User-authored labels, hashes, local report files, or a callback-free manager cannot create this authority.
+
+A verified nonsemantic assessment may carry an independent approval across a head/base change. It adds no round, does not reset findings, clean streak, phase limits, provider reservations or retry limits, and does not rewrite historical reports. Substantial, uncertain or nontext changes refuse this carry path and require an actually executed independent delta review. The source comparison reads both complete bundles as Git objects, preserving binary data and symlink targets without following links or executing candidate hooks, filters or scripts. Oversized or incomplete source context refuses acceptance rather than truncating evidence.
+
+This API is a source capability. The ordinary installed Assign campaign composition and independent delta-round ingress are not enabled by adding it; those joins require their separate canonical owner and acceptance proof. The default local/protected actor-independence check stays strict. A composed native owner can supply `review_independence` to verify original process/session provenance for same-account agents; the callback is required again on historical consumption.
+
 ## Restart, contract changes and failures
 
 Campaign authority lives in `.ace-local/review/campaigns/`; retain this directory and source evidence across process/context restarts. Records are serialized with a lock and replaced atomically with checksums. Every retained completed session, including earlier rounds and partial coverage, must keep its immutable accepted review-collection authority. Historical reads use `ace-assign attempt evidence --kind review-collection --historical-head EXACT_RECORDED_HEAD` to validate that receipt and its artifacts. This read-only mode cannot certify current checks; check-purpose proofs always require the live head. Losing/corrupting evidence from any retained counted round or assessment makes it unavailable; historical counters remain diagnostic and do not manufacture acceptance. These records are durable local artifacts, not a second assignment execution journal.
 
+The accepted-result v2 format cut requires the `head_assessments` history in stored campaigns and rejects v1 receipts. Pre-v2 records remain historical evidence but cannot be loaded or verified by this version; there is no automatic migration or fallback that manufactures acceptance. Retain their original bytes and provenance when changing versions.
+
 Start with changed requirements and `--reason "Requirement X changed"` to create a linked successor; `--predecessor ID` selects it explicitly. Same active subject/requirements/policy starts reuse one campaign, including concurrently. Requirements A → B → A create a new A successor of B; the superseded first A remains history. Restore missing active records rather than creating an orphan campaign that forgets them. Conflicting policy for an existing contract fails rather than rewriting history. A successor durably supersedes its predecessor: status keeps predecessor history and exposes `active_contract: false` and `superseded_by`, while collection, new recordings and acceptance are blocked. Old results cannot pass the assignment receipt verifier.
 
 The checksummed `.identity-index.json` retains each subject’s campaign IDs and is published before a new campaign record. A missing indexed record blocks that subject’s start/reuse, including deletion of its first record; restore the retained record to recover. Missing or corrupt indexes and unregistered records fail closed; no automatic reconstruction discards history. Subject lookup reads only its indexed records, so unrelated missing/corrupt campaign records do not block reuse. Retain the index together with the records. Existing campaign `status` and `finish` inspect their own checksummed record and successor marker.

data/lib/ace/review/atoms/campaign_contract.rb

@@ -11,6 +11,7 @@ module Ace
       # Pure campaign input contracts and canonical identities.
       module CampaignContract
         class Invalid < ArgumentError; end
+        MAX_HEAD_CONTEXT_BYTES = 128 * 1024 * 1024
         SHA = /\A[0-9a-f]{40}(?:[0-9a-f]{24})?\z/.freeze
         ID = /\A[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}\z/.freeze
 

data/lib/ace/review/molecules/campaign_evidence.rb

@@ -28,9 +28,10 @@ module Ace
             !entry["completed_at"].to_s.empty?
         end
 
-        def initialize(repo_root:, check_evidence: nil, review_evidence: nil, approval_evidence: nil, artifact_paths: {})
+        def initialize(repo_root:, check_evidence: nil, review_evidence: nil, approval_evidence: nil, artifact_paths: {}, review_independence: nil)
           @repo_root = File.realpath(repo_root)
           @artifact_paths = artifact_paths.dup.freeze
+          @review_independence = review_independence
           authority = CampaignExecutionEvidence.new(repo_root: @repo_root)
           @check_evidence = check_evidence || authority.method(:check)
           @review_evidence = review_evidence || authority.method(:review)
@@ -164,6 +165,7 @@ module Ace
           proof = @approval_evidence.call(approval.fetch("receipt"), head: approval.fetch("head"),
             artifacts: approval.fetch("reports"), producer: approval.fetch("producer"),
             reviewer: approval.fetch("reviewer"), historical: historical)
+          verify_independence!(producer: approval.fetch("producer"), reviewer: approval.fetch("reviewer"), proof: proof)
           verify_execution_linkage!(approval["execution_proof"], proof)
           approval.fetch("checks").each do |check|
             accepted = @check_evidence.call(check.fetch("receipt"), head: approval.fetch("head"), name: check.fetch("name"), historical: historical)
@@ -180,6 +182,20 @@ module Ace
           true
         end
 
+        def head_checks(checks, head:, required:, historical: false)
+          unless checks.is_a?(Array) && !checks.empty? && checks.all? { |item|
+              item.is_a?(Hash) && item.keys.sort == %w[name receipt] && item["name"].is_a?(String) } &&
+              checks.map { |item| item["name"] }.uniq.size == checks.size &&
+              (required - checks.map { |item| item["name"] }).empty?
+            raise Contract::Invalid, "head assessment requires all executed checks"
+          end
+          checks.map do |check|
+            proof = @check_evidence.call(check.fetch("receipt"), head: head, name: check.fetch("name"), historical: historical)
+            raise Contract::Invalid, "canonical head check evidence is unavailable" unless proof.is_a?(Hash) && !proof.empty?
+            check.merge("execution_proof" => proof)
+          end
+        end
+
         def reassessment(previous)
           directory = previous["source_id"].split("#", 2).first
           finding = feedback(File.expand_path(directory, @repo_root)).find do |source|
@@ -208,7 +224,6 @@ module Ace
           end
           producer = Contract.string!(data["producer"], "approval producer")
           reviewer = Contract.string!(data["reviewer"], "approval reviewer")
-          raise Contract::Invalid, "independent reviewer required (self-approval)" if producer == reviewer
           # Approval explicitly identifies completed reviewer reports, rather
           # than treating a model response or arbitrary file as a verdict.
           review_refs = data["reports"]
@@ -249,6 +264,7 @@ module Ace
           approval_receipt = data.fetch("receipt")
           approval_proof = @approval_evidence.call(approval_receipt, head: binding["head"], artifacts: review_refs,
             producer: producer, reviewer: reviewer)
+          verify_independence!(producer: producer, reviewer: reviewer, proof: approval_proof)
           checks = data["checks"]
           raise Contract::Invalid, "approval requires executed checks" unless checks.is_a?(Array) && !checks.empty?
           check_refs = []
@@ -282,6 +298,16 @@ module Ace
 
         private
 
+        def verify_independence!(producer:, reviewer:, proof:)
+          accepted = if @review_independence
+            @review_independence.call(producer: producer, reviewer: reviewer, proof: proof) == true
+          else
+            producer != reviewer
+          end
+          raise Contract::Invalid, "independent reviewer required (self-approval)" unless accepted
+          true
+        end
+
         def json_keys(value)
           case value
           when Hash then value.to_h { |k, v| [k.to_s, json_keys(v)] }

data/lib/ace/review/molecules/campaign_execution_evidence.rb

@@ -68,7 +68,10 @@ module Ace
               data["head"] == head && data["kind"] == kind && data["historical"] == historical
             raise Atoms::CampaignContract::Invalid, "accepted execution receipt identity/head/kind mismatch"
           end
-          data
+          # The journal tip is a read cursor, not the identity of an accepted
+          # receipt. Unrelated attempts advance it without changing this proof.
+          # Keep the receipt digest, exact head and canonical ref in the proof.
+          data.except("journal_commit")
         rescue Gem::LoadError, JSON::ParserError, SystemCallError => e
           raise Atoms::CampaignContract::Invalid, "ace-assign execution authority unavailable: #{e.message}"
         end

data/lib/ace/review/molecules/campaign_store.rb

@@ -68,7 +68,7 @@ module Ace
               envelope["sha256"] == Atoms::CampaignContract.digest(record)
             raise Atoms::CampaignContract::Invalid, "corrupt campaign #{id}: identity or checksum mismatch"
           end
-          %w[subject contract_identity contract policy profile bounds phases execution_attempts inherited_findings assessments attempts rounds head_transitions].each do |key|
+          %w[subject contract_identity contract policy profile bounds phases execution_attempts inherited_findings assessments attempts rounds head_transitions head_assessments].each do |key|
             raise Atoms::CampaignContract::Invalid, "corrupt campaign #{id}: missing #{key}" unless record.key?(key)
           end
           contract = Atoms::CampaignContract
@@ -80,7 +80,7 @@ module Ace
             raise contract::Invalid, "corrupt campaign #{id}: requirements digest mismatch"
           end
           contract.policy!(record["policy"])
-          %w[phases execution_attempts inherited_findings assessments attempts rounds head_transitions].each do |key|
+          %w[phases execution_attempts inherited_findings assessments attempts rounds head_transitions head_assessments].each do |key|
             unless record[key].is_a?(Array) && record[key].all? { |entry| entry.is_a?(Hash) }
               raise contract::Invalid, "corrupt campaign #{id}: invalid #{key} records"
             end

data/lib/ace/review/molecules/delta_resolver.rb

@@ -2,6 +2,7 @@
 
 require "open3"
 require "yaml"
+require "ace/git/atoms/server_url"
 
 module Ace
   module Review
@@ -46,6 +47,10 @@ module Ace
           return {success: false, error: "Delta reference '#{reference}' is not a commit SHA"} unless reference_head.match?(SHA_PATTERN)
           return {success: false, error: "Delta reference head #{reference_head} is not an ancestor of the current PR head #{head}; history was likely rewritten — re-run a full review round"} unless ancestor?(reference_head, head, project_root: project_root)
 
+          if reference_head == head && newer_local_head?(head, pr_metadata, project_root: project_root)
+            return {success: false, error: "PR metadata still reports the reviewed head #{head}, but the local PR branch is newer; reconcile the push and refresh PR metadata before recording an empty delta"}
+          end
+
           diff = run_git(["diff", "#{reference_head}..#{head}"], project_root: project_root)
           return diff unless diff[:success]
 
@@ -53,6 +58,48 @@ module Ace
            session_dir: session_dir, diff: diff[:stdout]}
         end
 
+        # Repeated provider reads can return the same stale snapshot after a
+        # push. A local descendant is evidence against certifying that no code
+        # changed. Select the PR branch explicitly; an unrelated checkout does
+        # not define that PR's head.
+        def self.newer_local_head?(head, metadata, project_root:)
+          branch = metadata["headRefName"].to_s
+          repository = metadata["head_repository_url"].to_s
+          return false if branch.empty? || repository.empty?
+          remote = run_git(["for-each-ref", "--format=%(push:remotename)%00%(push:remoteref)", "refs/heads/#{branch}"], project_root: project_root)
+          return false unless remote[:success]
+          remote_name, remote_ref = remote[:stdout].strip.split("\0", -1)
+          return false if remote_name.to_s.empty?
+          remote_ref = default_push_ref(branch, remote_name, project_root: project_root) if remote_ref.to_s.empty?
+          return false unless remote_ref == "refs/heads/#{branch}"
+          urls = run_git(["remote", "get-url", "--push", "--all", remote_name], project_root: project_root)
+          return false unless urls[:success] && urls[:stdout].lines.any? do |url|
+            Ace::Git::Atoms::ServerUrl.match?(repository, url.strip)
+          end
+          local = rev_parse("refs/heads/#{branch}", project_root: project_root)
+          local[:success] && local[:stdout] != head && ancestor?(head, local[:stdout], project_root: project_root)
+        end
+        private_class_method :newer_local_head?
+
+        # Git exposes push:remoteref for explicit push refspecs only. Its
+        # default policies use branch names/upstream, not that empty atom.
+        def self.default_push_ref(branch, remote, project_root:)
+          explicit = run_git(["config", "--get-all", "remote.#{remote}.push"], project_root: project_root)
+          return nil if explicit[:success] && !explicit[:stdout].empty?
+          policy = run_git(["config", "--get", "push.default"], project_root: project_root)
+          upstream = run_git(["config", "--get", "branch.#{branch}.merge"], project_root: project_root)
+          case policy[:stdout].to_s.strip
+          when "", "simple"
+            target = upstream[:stdout].to_s.strip
+            fetch = run_git(["config", "--get", "branch.#{branch}.remote"], project_root: project_root)
+            triangular = fetch[:success] && fetch[:stdout].strip != remote
+            "refs/heads/#{branch}" if triangular || target.empty? || target == "refs/heads/#{branch}"
+          when "current", "matching" then "refs/heads/#{branch}"
+          when "upstream" then upstream[:stdout].to_s.strip
+          end
+        end
+        private_class_method :default_push_ref
+
         # Find the head SHA recorded by the most recent prior session of this PR.
         #
         # @param pr_url [String] canonical PR URL stored in session metadata

data/lib/ace/review/molecules/review_evidence.rb

@@ -23,8 +23,9 @@ module Ace
             end
             # Reviewer reports are written as review-report-<model>.md (Ruby API
             # path) or review-<model>.md (CLI provider path); prompt/context and
-            # dev-feedback files are not reports.
-            reports = Dir.glob(File.join(dir, "review-*.md")).select do |path|
+            # dev-feedback files are not reports. Single-model and no-op rounds
+            # use the maintained review.md output.
+            reports = Dir.glob(File.join(dir, "{review-*,review}.md")).select do |path|
               base = File.basename(path)
               !base.end_with?(".prompt.md", ".context.md") &&
                 !%w[review-dev-feedback.md].include?(base)

data/lib/ace/review/organisms/campaign_head_assessments.rb

@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+
+module Ace
+  module Review
+    module Organisms
+      # A head assessment extends one accepted campaign prefix. Only an
+      # installed evidence owner can supply the source comparison, supervisor
+      # provenance and check receipts. This is the existing campaign history,
+      # not another execution or reviewer ledger.
+      # Host: CampaignManager supplies the store, evidence, immutable projection,
+      # exact-prefix verification, revisions, observation and acceptance helpers.
+      module CampaignHeadAssessments
+        Contract = Atoms::CampaignContract
+        SNAPSHOT_PREFIX_FIELDS = %w[assessments attempts execution_attempts head_assessments phases rounds].freeze
+        HEAD_PROOF_FIELDS = %w[authority campaign_id checks classification context from predecessor_identity rationale schema to].freeze
+
+        def record_head_assessment(id, input, dry_run: false, consumer_profiles: nil)
+          unless @head_assessment_evidence && input.is_a?(Hash) && input.keys.sort == %w[id predecessor reference]
+            raise Contract::Invalid, "head assessment requires its canonical evidence owner"
+          end
+          Contract.id!(input["id"], "head assessment ID")
+          Contract.object!(input["reference"], "head assessment reference")
+          digest = Contract.digest(input)
+          store.transaction(dry_run: dry_run) do
+            record = store.read(id)
+            if (prior = record.fetch("head_assessments").find { |entry| entry["id"] == input["id"] })
+              raise Contract::Invalid, "conflicting head assessment replay" unless prior["input_digest"] == digest
+              next projection(record).merge("replayed" => true, "dry_run" => dry_run)
+            end
+            raise Contract::Invalid, "campaign contract is superseded" if record["successor"]
+            verify_consumer_policy!(record, consumer_profiles) if consumer_profiles
+            predecessor = input.fetch("predecessor")
+            prefix = accepted_snapshot_prefix!(record, predecessor)
+            unless SNAPSHOT_PREFIX_FIELDS.all? { |field| prefix.fetch(field).size == record.fetch(field).size }
+              raise Contract::Invalid, "head assessment predecessor is not the current campaign prefix"
+            end
+            verify_retained_acceptance!(prefix, predecessor)
+            head, base = current_revisions(record)
+            unless clean_candidate? && [head, base] != predecessor.values_at("head", "base")
+              raise Contract::Invalid, "head assessment requires a changed clean candidate"
+            end
+            proof, checks = head_assessment_proof!(record, reference: input.fetch("reference"), predecessor: predecessor,
+              head: head, base: base, historical: false)
+            event = immutable_projection(input.merge("input_digest" => digest, "proof" => proof, "checks" => checks))
+            record.fetch("head_assessments") << event
+            observe(record, head, base)
+            store.write(record) unless dry_run
+            projection(record).merge("dry_run" => dry_run)
+          end
+        end
+
+        private
+
+        def head_assessment_proof!(record, reference:, predecessor:, head:, base:, historical:)
+          raise Contract::Invalid, "head assessment evidence owner is unavailable" unless @head_assessment_evidence
+          proof = @head_assessment_evidence.call(reference, campaign: record.slice("id", "subject", "contract_identity", "policy"),
+            predecessor: predecessor, head: head, base: base, historical: historical)
+          unless proof.is_a?(Hash) && proof.keys.sort == HEAD_PROOF_FIELDS &&
+              proof["schema"] == "ace.review.head-assessment/v1" && proof["campaign_id"] == record.fetch("id") &&
+              proof["predecessor_identity"] == predecessor.fetch("result_identity") &&
+              proof["from"] == predecessor.slice("head", "base") && proof["to"] == {"head" => head, "base" => base} &&
+              proof["authority"].is_a?(Hash) && !proof["authority"].empty? &&
+              proof["rationale"].is_a?(String) && proof["rationale"].strip.bytesize.between?(1, 8192) &&
+              JSON.generate(proof).bytesize <= 65_536
+            raise Contract::Invalid, "canonical head assessment binding differs"
+          end
+          context = proof["context"]
+          unless context.is_a?(Hash) && context.keys.sort == %w[bytes sha256 text_only] &&
+              context["sha256"].is_a?(String) && context["sha256"].match?(/\A[0-9a-f]{64}\z/) &&
+              context["bytes"].is_a?(Integer) && context["bytes"].between?(1, Contract::MAX_HEAD_CONTEXT_BYTES) &&
+              [true, false].include?(context["text_only"])
+            raise Contract::Invalid, "complete canonical head context is unavailable"
+          end
+          # This path carries a prior independent review. Material or uncertain
+          # changes need an actually executed delta round through the campaign
+          # owner; a classification label cannot replace that review.
+          unless proof["classification"] == "nonsemantic" && context["text_only"]
+            raise Contract::Invalid, "head change requires independent delta review"
+          end
+          checks = @evidence.head_checks(proof.fetch("checks"), head: head,
+            required: record.fetch("policy").fetch("required_checks"), historical: historical)
+          [immutable_projection(proof), immutable_projection(checks)]
+        rescue KeyError, TypeError
+          raise Contract::Invalid, "canonical head assessment is incomplete"
+        end
+
+        def verify_head_carry!(record, head:, base:, historical:)
+          current = record
+          target_head, target_base = head, base
+          first = true
+          loop do
+            round = current.fetch("rounds").last
+            raise Contract::Invalid, "head carry has no independent reviewed round" unless round && round["approval"]
+            return true if round.fetch("binding").values_at("head", "base") == [target_head, target_base]
+            event = current.fetch("head_assessments").last
+            raise Contract::Invalid, "head change has no canonical assessment" unless event
+            predecessor = event.fetch("predecessor")
+            prefix = accepted_snapshot_prefix!(current, predecessor)
+            unless SNAPSHOT_PREFIX_FIELDS.all? { |field|
+                prefix.fetch(field).size == current.fetch(field).size - (field == "head_assessments" ? 1 : 0) }
+              raise Contract::Invalid, "head assessment no longer follows its accepted prefix"
+            end
+            proof, checks = head_assessment_proof!(current, reference: event.fetch("reference"), predecessor: predecessor,
+              head: target_head, base: target_base, historical: historical || !first)
+            unless event.fetch("proof") == proof && event.fetch("checks").map { |check| check.except("execution_proof") } ==
+                checks.map { |check| check.except("execution_proof") }
+              raise Contract::Invalid, "retained canonical head assessment changed"
+            end
+            event.fetch("checks").zip(checks).each do |recorded, observed|
+              @evidence.verify_execution_linkage!(recorded.fetch("execution_proof"), observed.fetch("execution_proof"))
+            end
+            current = prefix
+            target_head, target_base = predecessor.values_at("head", "base")
+            first = false
+          end
+        rescue KeyError, TypeError
+          raise Contract::Invalid, "retained head assessment chain is unavailable"
+        end
+
+        def verify_retained_acceptance!(record, result)
+          projected = Atoms::CampaignProjection.build(record)
+          blockers = projected.fetch("open_findings").any? { |finding| %w[critical high medium].include?(finding["priority"]) }
+          unless projected.fetch("search_converged") && !blockers && projected.fetch("recurring_blockers").empty? && !execution_failure(record)
+            raise Contract::Invalid, "retained campaign prefix was not accepted"
+          end
+          record.fetch("attempts").each do |attempt|
+            attempt.fetch("sessions").select { |session| session["completed"] }.each do |session|
+              @evidence.verify_session_authority(session, head: attempt.fetch("binding").fetch("head"), historical: true)
+            end
+            @evidence.verify_approval_authority(attempt.fetch("approval"), historical: true) if attempt["approval"]
+          end
+          verify_head_carry!(record, head: result.fetch("head"), base: result.fetch("base"), historical: true)
+        end
+      end
+    end
+  end
+end

data/lib/ace/review/organisms/campaign_manager.rb

@@ -5,6 +5,7 @@ require "time"
 require_relative "../atoms/campaign_projection"
 require_relative "../molecules/campaign_store"
 require_relative "../molecules/campaign_evidence"
+require_relative "campaign_head_assessments"
 
 module Ace
   module Review
@@ -12,16 +13,18 @@ module Ace
       # Campaign history authority. Assignment attempts and approvals remain
       # owned by ace-assign; finish produces only a validated local result.
       class CampaignManager
+        include CampaignHeadAssessments
         Contract = Atoms::CampaignContract
         Policy = Atoms::CampaignPolicy
         attr_reader :store
 
-        def initialize(repo_root: Dir.pwd, store: nil, revisions: nil, check_evidence: nil, review_evidence: nil, approval_evidence: nil, artifact_paths: {}, candidate_reader: nil)
+        def initialize(repo_root: Dir.pwd, store: nil, revisions: nil, check_evidence: nil, review_evidence: nil, approval_evidence: nil, artifact_paths: {}, candidate_reader: nil, head_assessment_evidence: nil, review_independence: nil)
           @repo_root = File.realpath(repo_root)
           raise ArgumentError, "canonical candidate cannot use a revision override" if candidate_reader && revisions
           @candidate_reader = candidate_reader
+          @head_assessment_evidence = head_assessment_evidence
           @store = store || Molecules::CampaignStore.new(root: File.join(@repo_root, ".ace-local/review/campaigns"))
-          @evidence = Molecules::CampaignEvidence.new(repo_root: @repo_root, check_evidence: check_evidence, review_evidence: review_evidence, approval_evidence: approval_evidence, artifact_paths: artifact_paths)
+          @evidence = Molecules::CampaignEvidence.new(repo_root: @repo_root, check_evidence: check_evidence, review_evidence: review_evidence, approval_evidence: approval_evidence, artifact_paths: artifact_paths, review_independence: review_independence)
           @live_git = revisions.nil?
           @revisions = revisions || method(:git_revision)
         end
@@ -70,7 +73,7 @@ module Ace
               "execution_attempts" => [], "created_at" => Time.now.utc.iso8601(6),
               "predecessor" => previous&.dig("id"), "successor_reason" => reason,
               "inherited_findings" => inherited, "assessments" => [], "attempts" => [], "rounds" => [],
-              "head_transitions" => []}
+              "head_transitions" => [], "head_assessments" => []}
             unless dry_run
               if previous
                 # Publish supersession first: an interrupted successor write
@@ -312,7 +315,7 @@ module Ace
           end
         end
 
-        ACCEPTED_SNAPSHOT_FIELDS = %w[accepted base campaign_id contract_identity dry_run effective_policy head prefix producer result_identity reviewer schema subject].freeze
+        ACCEPTED_SNAPSHOT_FIELDS = %w[accepted base campaign_id contract_identity dry_run effective_policy head head_assessment_digest prefix producer result_identity reviewed_base reviewed_head reviewer schema subject].freeze
 
         # Bounded serialization of the same accepted record, not new authority.
         def accepted_result_snapshot(id)
@@ -326,14 +329,17 @@ module Ace
 
         private def accepted_snapshot(record, current)
           approval = current.fetch("rounds").last.fetch("approval")
-          immutable_projection({"schema" => "ace.review.accepted-result/v1", "campaign_id" => record.fetch("id"),
+          immutable_projection({"schema" => "ace.review.accepted-result/v2", "campaign_id" => record.fetch("id"),
             "accepted" => true, "dry_run" => false, "subject" => current.fetch("subject"),
             "contract_identity" => current.fetch("contract_identity"), "effective_policy" => current.fetch("effective_policy"),
             "head" => current.fetch("evidence").fetch("current_head"), "base" => current.fetch("evidence").fetch("current_base"),
+            "reviewed_head" => approval.fetch("head"), "reviewed_base" => approval.fetch("base"),
+            "head_assessment_digest" => Contract.digest(record.fetch("head_assessments")),
             "producer" => approval.fetch("producer"), "reviewer" => approval.fetch("reviewer"),
             "result_identity" => current.fetch("result_identity"), "prefix" => {
               "attempts" => record.fetch("attempts").length, "rounds" => record.fetch("rounds").length,
               "assessments" => record.fetch("assessments").length,
+              "head_assessments" => record.fetch("head_assessments").length,
               "phases" => record.fetch("phases").length, "execution_attempts" => record.fetch("execution_attempts").length}})
         end
 
@@ -342,6 +348,9 @@ module Ace
         def with_verified_result!(result:, subject:, contract_identity:, policy:, head:, base:, producer:, reviewer:, consumer_profiles: nil)
           raise ArgumentError, "verified campaign result requires a block" unless block_given?
           Contract.object!(result, "campaign result")
+          if result.key?("schema") && result["schema"] != "ace.review.accepted-result/v2"
+            raise Contract::Invalid, "unsupported accepted campaign snapshot schema"
+          end
           subject = Contract.subject!(subject)
           policy = Contract.policy!(policy)
           id = Contract.id!(result["campaign_id"], "campaign ID")
@@ -350,10 +359,10 @@ module Ace
             verify_consumer_policy!(record, consumer_profiles) if consumer_profiles
             current = projection(record)
             approval = current["rounds"].last&.fetch("approval", nil)
-            compact = result["schema"] == "ace.review.accepted-result/v1"
+            compact = result["schema"] == "ace.review.accepted-result/v2"
             if compact
               prefix = accepted_snapshot_prefix!(record, result)
-              unless prefix.values_at("attempts", "rounds", "assessments", "phases", "execution_attempts").map(&:length) == record.values_at("attempts", "rounds", "assessments", "phases", "execution_attempts").map(&:length)
+              unless SNAPSHOT_PREFIX_FIELDS.all? { |field| prefix.fetch(field).size == record.fetch(field).size }
                 raise Contract::Invalid, "campaign result prefix is no longer current"
               end
             end
@@ -392,33 +401,30 @@ module Ace
               raise Contract::Invalid, "retained campaign result differs from original store evidence"
             end
             approval = rounds.last.fetch("approval")
-            unless approval && approval.values_at("producer", "reviewer", "head") == [producer, reviewer, head]
+            unless approval && approval.values_at("producer", "reviewer", "head", "base") ==
+                [producer, reviewer, result.fetch("reviewed_head"), result.fetch("reviewed_base")]
               raise Contract::Invalid, "retained campaign approval actors differ"
             end
-            attempts.each do |attempt|
-              attempt.fetch("sessions").select { |session| session["completed"] }.each do |session|
-                @evidence.verify_session_authority(session, head: attempt.fetch("binding").fetch("head"), historical: true)
-              end
-              @evidence.verify_approval_authority(attempt.fetch("approval"), historical: true) if attempt["approval"]
-            end
+            verify_retained_acceptance!(snapshot, result)
             true
           end
         end
 
         private def accepted_snapshot_prefix!(record, result)
           prefix = result["prefix"]
-          unless result.keys.sort == ACCEPTED_SNAPSHOT_FIELDS && result["schema"] == "ace.review.accepted-result/v1" &&
-              prefix.is_a?(Hash) && prefix.keys.sort == %w[assessments attempts execution_attempts phases rounds] &&
+          unless result.keys.sort == ACCEPTED_SNAPSHOT_FIELDS && result["schema"] == "ace.review.accepted-result/v2" &&
+              prefix.is_a?(Hash) && prefix.keys.sort == SNAPSHOT_PREFIX_FIELDS &&
               prefix.all? { |key, count| count.is_a?(Integer) && count.between?(0, record.fetch(key).length) } &&
               prefix.fetch("rounds").positive? && result["accepted"] == true && result["dry_run"] == false &&
               result.values_at("campaign_id", "subject", "contract_identity", "effective_policy") ==
                 record.values_at("id", "subject", "contract_identity", "policy") &&
-              %w[head base].all? { |key| result[key].is_a?(String) && result[key].match?(/\A[0-9a-f]{40}\z/) }
+              %w[head base reviewed_head reviewed_base].all? { |key| result[key].is_a?(String) && result[key].match?(/\A[0-9a-f]{40}\z/) }
             raise Contract::Invalid, "accepted campaign snapshot selectors differ"
           end
           snapshot = record.merge(prefix.to_h { |key, count| [key, record.fetch(key).first(count)] }, "successor" => nil)
           approval = snapshot.fetch("rounds").last.fetch("approval")
-          unless approval && approval.values_at("producer", "reviewer", "head") == result.values_at("producer", "reviewer", "head") &&
+          unless approval && approval.values_at("producer", "reviewer", "head", "base") == result.values_at("producer", "reviewer", "reviewed_head", "reviewed_base") &&
+              Contract.digest(snapshot.fetch("head_assessments")) == result["head_assessment_digest"] &&
               result_identity_for(snapshot, result.fetch("head"), result.fetch("base")) == result["result_identity"]
             raise Contract::Invalid, "accepted campaign snapshot identity differs from retained prefix"
           end
@@ -431,6 +437,7 @@ module Ace
           Contract.digest({"campaign_id" => record["id"], "contract_identity" => record["contract_identity"],
             "policy" => record["policy"], "profile" => record["profile"], "bounds" => record["bounds"],
             "phases" => record["phases"], "execution_attempts" => record["execution_attempts"], "attempts" => record["attempts"], "assessments" => record["assessments"],
+            "head_assessments" => record.fetch("head_assessments"),
             "current_head" => head, "current_base" => base, "successor" => record["successor"]})
         end
 
@@ -710,7 +717,15 @@ module Ace
           later_blocker_update = later_attempts.flat_map { |attempt| attempt["assessments"] }.any? do |finding|
             blocker_ids.include?(finding["id"])
           end
-          current_evidence = !!(round && available && head && base && source_head == head && source_base == base &&
+          accepted_head = source_head == head && source_base == base
+          if !accepted_head && round && available && head && base
+            begin
+              accepted_head = verify_head_carry!(record, head: head, base: base, historical: false)
+            rescue Contract::Invalid => e
+              error = e.message
+            end
+          end
+          current_evidence = !!(round && available && head && base && accepted_head &&
             clean_candidate? && !later_blocker_update)
           blockers = result["open_findings"].select { |f| %w[critical high medium].include?(f["priority"]) }
           reasons = []

data/lib/ace/review/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Review
-    VERSION = "0.60.2"
+    VERSION = "0.61.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ace-review
 version: !ruby/object:Gem::Version
-  version: 0.60.2
+  version: 0.61.0
 platform: ruby
 authors:
 - Michal Czyz
@@ -415,6 +415,7 @@ files:
 - lib/ace/review/molecules/subject_filter.rb
 - lib/ace/review/molecules/task_report_saver.rb
 - lib/ace/review/molecules/task_resolver.rb
+- lib/ace/review/organisms/campaign_head_assessments.rb
 - lib/ace/review/organisms/campaign_manager.rb
 - lib/ace/review/organisms/feedback_manager.rb
 - lib/ace/review/organisms/prepared_candidate_review.rb