ace-review 0.62.1 → 0.62.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 85eb924a04151633de9dcf220f3f3100368e6ce1e644afc16f8947a8c0d45049
-  data.tar.gz: 749a5cfb223ed50e7ee0d042bd230046108bc38e677373e3732e1f950c33f44e
+  metadata.gz: 0d5ed9b815de2be3f42f06d250cd67c0b9016b45af7a22a577e22627c3ecbd58
+  data.tar.gz: b1da6f44694b73e8cc155d1f71c9b7100a7f7cf794e955ae6ee8d4ba3504fd06
 SHA512:
-  metadata.gz: d590b1d79a950e8b701daa1975ef80e1e1b88b9e3f76ae4318e0cc3e27b7d46a4f06d812eca4599c3e00ecc0c9a79c65e904cbc58c3922e6a873b8a2ab411ab8
-  data.tar.gz: 3ccdb3905795e1641d2891d936a490954179908c499c09fcbc410d7709ecc05b5527965cabd215a12534f0b65de49f7c0a0e3861965840d2d3f22327dca9fe59
+  metadata.gz: 5f47911975e20b99a4f56dfe274db15f2f9fb1b237bb5cdd245d00d7d72653c07f586bde7c4957dad4f04c1c544a2969eeabf639c5ee5c0ea8cc0f7863b21819
+  data.tar.gz: 335d6fa500b2818b297477b08db95b1b4c5afbbe1d1c214fbe8236612b7dbd2a1f43ab43cc43a0d1f9fc08b7f3f7c7fdac2c3d8d5d08e32a786acb5927e0367b

data/CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.62.2] - 2026-10-23
+
+### Added
+
+- Formal reviewer-owned, exact-head provider approval and read-only approval verification through the forge-neutral review flow; comments do not substitute for approval.
+
+
 
 ## [0.62.1] - 2026-10-20
 

data/docs/usage.md

@@ -212,3 +212,13 @@ ace-review-feedback skip abc123 --reason "Design: intentional choice"
 ace-review --help
 ace-review-feedback --help
 ```
+
+
+Formal approval is a separate reviewer-owned operation after an accepted
+independent review and required executed checks: `ace-git pr approve PR
+--expected-head SHA --body-file REVIEW_REPORT --correlation REVIEW_ID --server
+SERVER --format json`. `--post-comment` still posts only a comment. Keep the
+verified approval receipt with the existing review artifacts; integrators read
+current evidence through `ace-git pr approval`, without publishing approval on
+the reviewer's behalf. Missing rights/capability or unknown outcomes block the
+integration handoff and require reconciliation through the configured account.

data/handbook/workflow-instructions/review/pr.wf.md

@@ -63,3 +63,30 @@ records each finished round with the deterministic 3/2/10 counter tooling
 That role workflow is the authority for role handoff and round-limit
 enforcement; this document stays the authority for running the review rounds
 themselves. Do not duplicate or re-implement the counters here.
+
+
+## Formal provider approval (reviewer-owned)
+
+After the accepted independent review and executed tests cover the current full
+head, a commissioned reviewer publishes the accepted report using
+`ace-git pr approve PR --expected-head SHA --body-file REVIEW_REPORT
+--correlation REVIEW_ID --server SERVER --format json` (or the retained
+`--default-server`). Preserve the returned effective approval receipt in the
+existing review/task/assignment artifacts. `--post-comment`, a description edit
+and `ace-git pr ready` remain separate operations and cannot substitute for a
+formal approval. Own-PR approval is refused; role instructions never grant
+provider credentials. Missing rights/capability and uncertain publication block
+a successful integration handoff. Reconcile the same target-scoped correlation
+after a lost response; do not blindly repeat a mutation or switch identities.
+The integrator consumes current evidence through read-only `ace-git pr approval`
+and the existing integration gate; it never publishes approval in place of the
+independent reviewer. Review-round and authorization rules above still apply.
+
+
+Deployment must provide a dedicated automation reviewer identity and one writer
+per actor/repository/PR before formal publication. Missing evidence of that
+mapping/ownership blocks live use; a role name grants no account permission.
+Do not share that identity with manual clients or another host writer. Preserve
+and report unrelated pending reviews/comments instead of publishing over them.
+Resume only when the provider's path preserves the accepted commit/content;
+unsafe or unsupported pending recovery remains blocked with retained evidence.

data/lib/ace/review/version.rb

@@ -2,6 +2,6 @@
 
 module Ace
   module Review
-    VERSION = "0.62.1"
+    VERSION = "0.62.2"
   end
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: ace-review
 version: !ruby/object:Gem::Version
-  version: 0.62.1
+  version: 0.62.2
 platform: ruby
 authors:
 - Michal Czyz
 bindir: exe
 cert_chain: []
-date: 2026-10-20 00:00:00.000000000 Z
+date: 2026-10-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json
@@ -133,42 +133,42 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.30'
+        version: '0.31'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.30'
+        version: '0.31'
 - !ruby/object:Gem::Dependency
   name: ace-git-github
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.3'
+        version: '0.5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.3'
+        version: '0.5'
 - !ruby/object:Gem::Dependency
   name: ace-git-forgejo
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.7'
+        version: '0.8'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.7'
+        version: '0.8'
 - !ruby/object:Gem::Dependency
   name: ace-support-nav
   requirement: !ruby/object:Gem::Requirement