@voybio/ace-swarm 2.4.8 → 2.4.10

package/CHANGELOG.md

@@ -1,6 +1,44 @@
 # Changelog
 
-## [Unreleased]
+## [2.4.10] - 2026-10-21
+
+### Added
+
+- **Host-driven goals.** Attached MCP hosts such as Claude Code and Codex can run multi-step filesystem goals themselves: `start_goal` with `executor: "host"`, then `next_step`, do the work, `complete_step`. ACE keeps the plan, updates linked todos and handoffs, returns the original reply for identical retries, and resumes after restarts.
+- **Background verification.** `complete_step` returns immediately while the goal's `verify` checks run as a durable background job. `get_goal_status` (compact view) shows the job, command duration, time since last output and an output tail. Verification recovers across server restarts.
+- **Stop and resume.** `stop_goal` and `resume_goal` keep accepted work and reject stale verification results. `host-min` now exposes 30 tools, including stop and resume.
+- **Optional native Vericify history.** `get_vericify_context`, `get_vericify_delta` and goal completion can read native Vericify history through a bundled read-only client, configured under `observability.vericify_bridge.native`. Native records are not yet linked to ACE attempts.
+- **Progress notifications.** Long blocking MCP calls send progress notifications; clients opt in with `resetTimeoutOnProgress`.
+
+### Changed
+
+- **No default time or turn limits.** Goals and detached runtimes run until done unless you set `budget_hours` or `max_replans`. Raising a limit goes through `resume_goal` and needs operator approval; status shows it as an `operator_proposal`, never as an executable option.
+- **Silence-based command limits.** Tests, verification and staged checks warn after 10 minutes without output and stop after 60. Each command can set `stall_min`, `kill_min` or `deadline_min`; there is no overall deadline by default.
+- **Repeated failures pause instead of burning retries.** Three identical failures in a row park the goal for review; changing failures keep going. A host that goes quiet keeps its assignment; ACE never reassigns work automatically.
+- MCP `start_goal` requires an explicit `executor`.
+- Automatic Vericify process posts are off by default. Manual posting and existing history are unaffected; `legacy_auto_posts: true` restores the old behavior.
+- Required final `expected_artifacts` are rechecked when a goal closes. Mark outputs needed only during a step with `transient: true`.
+- Todo updates keep existing statuses and metadata and pick up edits made directly in the todo file.
+- The lockfile is refreshed within existing version ranges (`@modelcontextprotocol/sdk` 1.32.1, `hono` 4.13, `express` 5.3, `proxy-addr` 2.0.8 and others), clearing published security advisories in the previously pinned versions.
+
+### Fixed
+
+- Engine goal starts no longer fail status-event validation (`source_module`), and a status-event validation failure no longer breaks a goal transition.
+- MCP server startup no longer rewrites the store when handoff and scheduler state are unchanged.
+- Accepted 2.4.x handoffs without a completion receipt are reported as `needs_completion` with the `ack_handoff` remedy, not as startup failures.
+
+### Compatibility
+
+- Workspaces from 2.4.x open in place. No migration is needed and existing state is not rewritten.
+- Goal limits from earlier versions that differ from the old defaults (4 hours, 200 ticks, 3 replans) stay enforced. Values equal to those defaults are treated as unlimited, so a 2.4.x `--budget-hours 4` is read as unlimited.
+- Goals written by 2.4.10 remain readable by the 2.4.8 goal reader, and its budget check does not treat them as exhausted.
+- Compact status offers `resume_goal`, not `next_step`, for engine goals.
+
+## [2.4.9] - 2026-10-13
+
+### Fixed
+
+- Scheduler leases are retained and released correctly, and handoff dispatch follows its lifecycle, with scheduler, worker and supervisor regression tests.
 
 ## [2.4.6] - 2026-07-15
 
@@ -43,25 +81,25 @@
 
 ## [2.4.5] - 2026-07-09
 
-Mitigations from `REPORT_ACE_DEEP_INVESTIGATION_2026-07-01.md` (WS-A/B/C/D/E/G plus the WS-H telemetry seam), with code-review tightening of the already-landed trenches.
+Reliability and safety fixes across Hermes, orchestration, scheduling, model bridging and editing.
 
 ### Fixed
 
-- **D1 / WS-A — Hermes zero-tool shadow:** `defaultToolScopeForPolicy` is now total (never returns `undefined`/`[]`); undefined scopes resolve to the role's `ROLE_TOOL_DEFAULTS` (with a new `builder` entry) and unknown roles to orchestrator defaults minus mutation tools. The Hermes executor and `ace mcp-shadow --tools ""` now hard-fail with `reason_code=hermes_empty_tool_scope`. Each Hermes-local turn records a capability snapshot. `ace doctor --hermes` now asserts a computed non-coders (orchestrator) scope is actually served (>=3 tools), not just `get_all_agents_summary`.
-- **D2 / WS-B — fake green:** no-model-runtime orchestrator steps now return `blocked`/`no_model_runtime` instead of `completed`; the supervisor maps `blocked` bridge results to blocked steps; `run_orchestrator` short-circuits to a plan envelope (`execution_backend:"none"`) and gained an explicit `mode:"plan_only"`.
-- **D6 (partial) / WS-A step 6 — Hermes secret leak & context:** the Python worker env is now allowlisted (`PATH`/`HOME`/`HERMES_*`/`ACE_*`/provider base-URL vars) instead of forwarding the full `process.env`; the hard-coded 65536 context length is replaced by a probed-or-8192 conservative default.
-- **D14 — promotion predicate:** structural-edit `promotable` now keys on the unified-diff result, not the set-membership `diffContents` (display-only).
-- **D5 / WS-G step 3 — version truth:** the MCP server now reports the real `package.json` version instead of the stale `0.2.1`.
-- **D11 / §14 — hygiene:** removed the stray `src/.vericify/` dogfood state and git-ignored dogfood/staging litter paths.
+- **Hermes zero-tool shadow:** `defaultToolScopeForPolicy` is now total (never returns `undefined`/`[]`); undefined scopes resolve to the role's `ROLE_TOOL_DEFAULTS` (with a new `builder` entry) and unknown roles to orchestrator defaults minus mutation tools. The Hermes executor and `ace mcp-shadow --tools ""` now hard-fail with `reason_code=hermes_empty_tool_scope`. Each Hermes-local turn records a capability snapshot. `ace doctor --hermes` now asserts a computed non-coders (orchestrator) scope is actually served (>=3 tools), not just `get_all_agents_summary`.
+- **Fake green:** no-model-runtime orchestrator steps now return `blocked`/`no_model_runtime` instead of `completed`; the supervisor maps `blocked` bridge results to blocked steps; `run_orchestrator` short-circuits to a plan envelope (`execution_backend:"none"`) and gained an explicit `mode:"plan_only"`.
+- **Hermes secret leak & context:** the Python worker env is now allowlisted (`PATH`/`HOME`/`HERMES_*`/`ACE_*`/provider base-URL vars) instead of forwarding the full `process.env`; the hard-coded 65536 context length is replaced by a probed-or-8192 conservative default.
+- **Promotion predicate:** structural-edit `promotable` now keys on the unified-diff result, not the set-membership `diffContents` (display-only).
+- **Version truth:** the MCP server now reports the real `package.json` version instead of the stale `0.2.1`.
+- **Hygiene:** removed the stray `src/.vericify/` dogfood state and git-ignored dogfood/staging litter paths.
 
 ### Added
 
-- **WS-J — Experience Playbook (experimental):** added fs-backed playbook bullet storage under `agent-state/playbook/`, deterministic reflection/curation, `ACE_PLAYBOOK`-gated prompt injection, direct-lane attribution, adaptation reports via `ace eval --adapt`, and `ace playbook` CLI/projection support. The legacy `get_lessons`/`add_lesson` MCP tools now read/write playbook bullets instead of appending a second markdown memory family. Injection remains off by default pending adaptation evidence; no paper-magnitude gains are claimed.
-- **WS-C — forward-pacing gate:** the completion gate is now conjunctive — a `completed` claim is demoted to `blocked`/`forward_pacing_incomplete` unless every declared `expected_artifact` and `required_evidence_ref` is satisfied (unstructured steps unchanged). `run_orchestrator` threads both into the bridge. Added a tool doom-loop brake (identical tool+result 3x warns, 4x blocks with a native blocker post; polling with changing results is exempt) and an inter-turn text-loop brake for envelopes that execute no tool (e.g. repeated empty `tool_calls`). Per-step `PLAN_UPDATE` status events carry `{plan_id, step_id, from, to, in_progress_step_id}`. Coders/builder guardrails forbid `status:complete` while artifacts/evidence are missing.
-- **WS-H (seam) — token truth:** provider usage (`prompt_eval_count`/`eval_count`, OpenAI usage) is threaded into `BridgeResult.usage_totals`; a context-overflow sentinel blocks and emits `MODEL_CONTEXT_OVERFLOW_SUSPECTED` at >=98% of `num_ctx`; an output cap (`num_predict`/`max_tokens`) bounds runaway generation; retries are restricted to transport-class errors (5xx/408/429/network), never deterministic 4xx; envelope-required roles request JSON mode (`format:"json"` / `response_format`); a per-run NDJSON bridge trace is written under `agent-state/bridge-traces/`.
-- **WS-E — surgical-edit cost & concurrency:** full-workspace staging only when validation is requested; staging prunes `node_modules`/`.git` at any depth (not just top-level); `expected_base_hash` fail-closed precondition; a source-mutation lease coordinator with `SOURCE_EDIT_*` events; backups moved under `.ace-staging/`; `gcStaging` GC wired into `ace mcp`/`ace cache`.
-- **WS-G — premium-host profile & governance throttle:** `ace mcp --profile host-min|full` (host-min = 22 curated tools, ~22 KB vs 113/~68 KB); governance mutation guidance is now delta-only (append on digest change or every 10th call) and the bootstrap nudge is throttled per session; `buildAceDigest` is memoized with a 60s TTL to stop per-call file I/O.
-- **D3 / WS-D — in-process job worker & heartbeat watchdog:** the scheduler was a pure planner — `dispatch_jobs` moved jobs to `running` and grabbed locks but nothing ever executed a job body or called `complete_job`, and `dispatchJobs` re-stamped every running lock's heartbeat each tick, which *masked* a dead worker and left jobs stuck `running` forever. Dispatch no longer renews running-job heartbeats: only a live worker (`heartbeat_job`) or a fresh start proves liveness, so a missing heartbeat reliably signals a dead worker. A heartbeat watchdog (`DEFAULT_HEARTBEAT_STALE_MS`, default 120 s; tunable per tick via `heartbeat_stale_seconds`) now runs inside every `dispatch_jobs` tick and as a standalone `reap_stale_jobs` tool, moving stale running jobs into `unknown_recovery` and releasing their locks (`SCHEDULER_WATCHDOG` events, `reason_code=heartbeat_stale`) — unlike lease recovery this fires even under the same owner with a valid lease. New `src/job-worker.ts` closes the execution loop: a `kind`→handler registry plus `runJobWorkerOnce` that dispatches, executes each running job's handler (heartbeating throughout, never holding the scheduler lock across a handler), and finalizes via `complete_job`. New MCP tools `heartbeat_job` and `reap_stale_jobs` (full surface now 115 tools). Prerequisite for the WS-F Goal Engine.
+- **Experience Playbook (experimental):** added fs-backed playbook bullet storage under `agent-state/playbook/`, deterministic reflection/curation, `ACE_PLAYBOOK`-gated prompt injection, direct-lane attribution, adaptation reports via `ace eval --adapt`, and `ace playbook` CLI/projection support. The legacy `get_lessons`/`add_lesson` MCP tools now read/write playbook bullets instead of appending a second markdown memory family. Injection remains off by default pending adaptation evidence; no paper-magnitude gains are claimed.
+- **Forward-pacing gate:** the completion gate is now conjunctive — a `completed` claim is demoted to `blocked`/`forward_pacing_incomplete` unless every declared `expected_artifact` and `required_evidence_ref` is satisfied (unstructured steps unchanged). `run_orchestrator` threads both into the bridge. Added a tool doom-loop brake (identical tool+result 3x warns, 4x blocks with a native blocker post; polling with changing results is exempt) and an inter-turn text-loop brake for envelopes that execute no tool (e.g. repeated empty `tool_calls`). Per-step `PLAN_UPDATE` status events carry `{plan_id, step_id, from, to, in_progress_step_id}`. Coders/builder guardrails forbid `status:complete` while artifacts/evidence are missing.
+- **Token truth:** provider usage (`prompt_eval_count`/`eval_count`, OpenAI usage) is threaded into `BridgeResult.usage_totals`; a context-overflow sentinel blocks and emits `MODEL_CONTEXT_OVERFLOW_SUSPECTED` at >=98% of `num_ctx`; an output cap (`num_predict`/`max_tokens`) bounds runaway generation; retries are restricted to transport-class errors (5xx/408/429/network), never deterministic 4xx; envelope-required roles request JSON mode (`format:"json"` / `response_format`); a per-run NDJSON bridge trace is written under `agent-state/bridge-traces/`.
+- **Surgical-edit cost & concurrency:** full-workspace staging only when validation is requested; staging prunes `node_modules`/`.git` at any depth (not just top-level); `expected_base_hash` fail-closed precondition; a source-mutation lease coordinator with `SOURCE_EDIT_*` events; backups moved under `.ace-staging/`; `gcStaging` GC wired into `ace mcp`/`ace cache`.
+- **Premium-host profile & governance throttle:** `ace mcp --profile host-min|full` (host-min = 22 curated tools, ~22 KB vs 113/~68 KB); governance mutation guidance is now delta-only (append on digest change or every 10th call) and the bootstrap nudge is throttled per session; `buildAceDigest` is memoized with a 60s TTL to stop per-call file I/O.
+- **In-process job worker & heartbeat watchdog:** the scheduler was a pure planner — `dispatch_jobs` moved jobs to `running` and grabbed locks but nothing ever executed a job body or called `complete_job`, and `dispatchJobs` re-stamped every running lock's heartbeat each tick, which *masked* a dead worker and left jobs stuck `running` forever. Dispatch no longer renews running-job heartbeats: only a live worker (`heartbeat_job`) or a fresh start proves liveness, so a missing heartbeat reliably signals a dead worker. A heartbeat watchdog (`DEFAULT_HEARTBEAT_STALE_MS`, default 120 s; tunable per tick via `heartbeat_stale_seconds`) now runs inside every `dispatch_jobs` tick and as a standalone `reap_stale_jobs` tool, moving stale running jobs into `unknown_recovery` and releasing their locks (`SCHEDULER_WATCHDOG` events, `reason_code=heartbeat_stale`) — unlike lease recovery this fires even under the same owner with a valid lease. New `src/job-worker.ts` closes the execution loop: a `kind`→handler registry plus `runJobWorkerOnce` that dispatches, executes each running job's handler (heartbeating throughout, never holding the scheduler lock across a handler), and finalizes via `complete_job`. New MCP tools `heartbeat_job` and `reap_stale_jobs` (full surface now 115 tools). Prerequisite for the Goal Engine.
 
 ## [2.4.4] - 2026-06-25
 

package/README.md

@@ -10,7 +10,11 @@ Autonomous Coding Entity (ACE) is a local MCP server and CLI for agent-assisted
 
 Modern coding agents can already read files, write code, run commands, and call tools. The missing layer is coordination that survives restarts, model switches, and multi-agent work. ACE keeps the workflow in the store and projects only the files external clients still need. For provider-backed runs, ACE supplies task context, tool surfaces, status events, evidence trails, and resumable state.
 
-The full MCP surface spans **119 registered tools** across 13 domain modules — handoffs, scheduler, goals, file ops, drift detection, git, memory, discovery, skills, lifecycle events, vericify, tracker, and framework orchestration — plus resources and prompts. For premium hosts (Claude Code, Codex) a curated **`ace mcp --profile host-min`** exposes 22 high-value tools; the rest remain reachable via `run_orchestrator` delegation or `--profile full`. See the [MCP Tool Reference](docs/mcp-tool-reference.md) for the full catalog.
+The full MCP surface spans **121 registered tools** across 13 domain modules — handoffs, scheduler, goals, file ops, drift detection, git, memory, discovery, skills, lifecycle events, vericify, tracker, and framework orchestration — plus resources and prompts. For premium hosts (Claude Code, Codex), **`ace mcp --profile host-min`** exposes 30 tools covering host work, recovery, stop/resume and structural editing. Optional local execution and manual posting remain available through `--profile full`. See the [MCP Tool Reference](docs/mcp-tool-reference.md) for the full catalog.
+
+Attached hosts can also run multi-step goals themselves: `start_goal` with `executor: "host"`, then loop `next_step` → do the work → `complete_step`. ACE keeps the plan, runs the goal's verification in the background and picks up again after restarts. Goals have no default time limit; `stop_goal` and `resume_goal` pause and continue without losing accepted work.
+
+ACE can optionally read Vericify's native history through a bundled read-only client. Vericify keeps ownership of capture and history; ACE only reads its references. Configuration is described in the [MCP Tool Reference](docs/mcp-tool-reference.md).
 
 ## ACE Manifesto
 
@@ -140,7 +144,7 @@ Developer or MCP host
   │       ├── ace-state.ace              (ACEPACK binary store)
   │       └── STATUS.md / kanban.html / HANDOFF.json projections
   │
-  ├── ace mcp [--profile host-min|full]  (full surface 119 tools; host-min 22)
+  ├── ace mcp [--profile host-min|full]  (full surface 121 tools; host-min 30)
   │       │
   │       ├── tools, prompts, resources
   │       ├── typed handoff validation
@@ -172,15 +176,16 @@ Developer or MCP host
 +----------------------+--------------------------------------------------------------+
 | Runtime roles        | ACE-Orchestrator, Coders, QA, Spec, Docs, Research, Ops,     |
 |                      | Security, Memory, Release, Eval, Skeptic, astgrep, Builder   |
-| MCP server           | 119 tools across 13 domain modules (stdio); host-min         |
-|                      | profile exposes 22 curated tools                             |
+| MCP server           | 121 tools across 13 domain modules (stdio); host-min 30      |
+|                      | curated tools for attached hosts                             |
 | Durable state        | Single `agent-state/ace-state.ace` authority for handoffs,   |
 |                      | status events, todos, run ledger, job queue, and discovery   |
 | Projections          | Hook context, todo surface, and host config bundles          |
 | Coordination         | Scheduler queues, dependency gates, leases, resource locks,  |
 |                      | in-process job worker, heartbeat watchdog, circuit breakers  |
-| Goal engine          | `ace goal` self-paced objective loop with evidence-gated     |
-|                      | completion, tick/replan budgets, and operator stop           |
+| Goal engine          | `ace goal` engine loop and host-driven goals (`next_step` /  |
+|                      | `complete_step`) with background verification, stop/resume,  |
+|                      | and no default time limit                                    |
 | Change intelligence  | Delta scan, semantic snapshots, drift reports, rewrite hints |
 | Structural editing   | ast-grep query, locate, rewrite, compile, patch              |
 | Hermes bridge        | Optional, user-supplied subprocess engine selected only with |
@@ -188,8 +193,8 @@ Developer or MCP host
 | Terminal UI          | Provider-aware TUI with chat, tabs, telemetry, and agent UI  |
 | Local models         | Ollama and llama.cpp bootstrap, doctor checks, and bridges   |
 | Tracker integration  | GitHub Issues, Linear adapter layer with snapshot cache      |
-| Vericify             | Test evidence log, process post trail (incl. blocker         |
-|                      | routing), bridge snapshot                                    |
+| Vericify             | Optional read-only native history, manual process posts,     |
+|                      | bridge snapshot                                              |
 | Skills               | Packaged skills with catalog, audit, and triage              |
 | Experience playbook  | Evidence-gated lessons store (experimental, injection off by |
 |                      | default; `ace playbook` / `ace eval --adapt`)                |
@@ -249,7 +254,7 @@ Tool evidence, not model prose, authorizes completion: a `completed` claim from
 | Reference | Contents |
 |---|---|
 | [CLI Reference](docs/cli-reference.md) | Every `ace` command and worked examples |
-| [MCP Tool Reference](docs/mcp-tool-reference.md) | The full 119-tool surface across 13 domain modules |
+| [MCP Tool Reference](docs/mcp-tool-reference.md) | The full 121-tool surface across 13 domain modules |
 | [ACEPACK State Model](docs/state-model.md) | On-disk binary format, KV region, columnar event log |
 | [Hermes Companion Engine](docs/hermes.md) | Bridge architecture, frame protocol, doctor checks, evidence model |
 | [TUI Operator Guide](docs/tui-operator-guide.md) | Provider setup, navigation, interrupt behavior, and recovery |
@@ -258,7 +263,6 @@ Tool evidence, not model prose, authorizes completion: a `completed` claim from
 | [Troubleshooting](docs/troubleshooting.md) | Symptom-driven diagnostics and recovery commands |
 | [Library API](docs/library-api.md) | Supported programmatic entry points and stability boundaries |
 | [Experience Playbook](docs/experience-playbook.md) | Experimental evidence-gated lessons store |
-| [Development](docs/development.md) | Build, test, live driver, and key source files |
 | [CHANGELOG](./CHANGELOG.md) | Release history |
 
 ## References

package/assets/.agents/ACE/ACE_coders/AGENTS.md

@@ -38,35 +38,31 @@ You are TDD‑obsessed, CI/CD‑native, and relentlessly focused on shipping cle
 | Principle | Rule |
 |---|---|
 | **Modular** | You own `./engineering-state/` and `./src/`. Do NOT define business strategy (VOS), design UX (UI), or ratify quality gates (agent-skeptic). |
-| **Interoperable** | Handoffs validate against `HANDOFF.json` schema. Build artifacts emit `ARTIFACT_PRODUCED` events conforming to `STATUS_EVENT.schema.json`. |
+| **Interoperable** | Use the existing assignment and handoff schemas for work transfer. Do not add separate bookkeeping calls. |
 | **Customizable** | Read `TEAL_CONFIG.md` for pipeline position. In `genesis` topology: VOS → UI → **Coders**. In `pivot`: VOS → Orchestrator → **Coders**. |
 | **Extensible** | If a required tool/runtime/framework is missing, emit `CAPABILITY_REQUEST`. Never simulate or stub infrastructure you don't have. |
 
 ## Prime Directives
 
-- **Hermetic execution**: operate strictly inside the spec you are given. No spec → no code. Ambiguous spec → `BLOCKER_EVENT` to Orchestrator.
-- **TDD absolutism**: write failing tests before implementation. Zero exceptions.
+- **Contract-driven execution**: work from the current assignment and its contract. Resolve routine choices from existing code. If a required decision is missing, explain what is needed and continue independent work.
+- **Test-first repairs**: reproduce behavior failures in the existing project test suite, then repair and verify the affected behavior and recovery paths.
 - **Artifact purity**: treat the repository as a temple — no dead code, no noisy logs, and clear documentation.
 
 ## Goal Orientation
 
 - **DELETE_PROTOCOL**: If a code change doesn't advance a requirement in `SPEC_CONTRACT.json`, delete it.
-- **ARTIFACT_PROTOCOL**: Every cycle MUST produce: test files, source files, `BUILD_STATUS.md` update, or `TEST_LOG.md` entry. Discussion-only cycles = failure.
-- **AGENCY_PROTOCOL**: Read `SPEC_CONTRACT.json`, `BUILD_STATUS.md`, `TEST_LOG.md`, `ARCHITECTURE.md`. Determine what tests are failing, what specs are unimplemented, what refactors are pending. State your plan. Execute. Never ask "what should I build?"
+- **ARTIFACT_PROTOCOL**: Advance the assigned work through implementation, verification or a concrete clarification. Report the semantic outcome through the existing assignment or handoff.
+- **AGENCY_PROTOCOL**: Read the current assignment, its contract and relevant code and tests. Identify what is failing or unimplemented, state your plan and execute.
 
 ## Inputs and Outputs
 
 - **Input**: `SPEC_CONTRACT.json` describing behaviors, constraints, and interfaces.
-- **Output**: passing tests, clean implementations, updated `BUILD_STATUS.md`, `TEST_LOG.md`, and a truthful build status.
-- Missing requirements are never guessed; they are raised as `BLOCKER_EVENT` to the Orchestrator with specific questions.
+- **Output**: passing tests, clean implementations and a truthful work outcome with unresolved dependencies.
+- Missing decisions are identified precisely; continue independent work while awaiting the answer.
 
-## Event Contract
+## Work State
 
-| Emits | Consumes |
-|---|---|
-| `ARTIFACT_PRODUCED` — after passing tests + committed code | `SPEC_UPDATED` — triggers new RED phase |
-| `BLOCKER_EVENT` — when spec is ambiguous or missing | `FIX_REQUIRED` — from QA failure routing |
-| `BUILD_STATUS_UPDATE` — on every test suite run | `GATE_DECISION` — from skeptic quality ratification |
+Submit results through the existing assignment or handoff. ACE holds work state; Vericify owns observation when available. State updates accompany the outcome and require no separate event or process-post calls.
 
 ## Clarity Protocol (Mandatory 5-Phase Loop)
 
@@ -74,7 +70,7 @@ You are TDD‑obsessed, CI/CD‑native, and relentlessly focused on shipping cle
 - Read the spec line by line and resolve ambiguity.
 - Identify precise inputs, outputs, side effects, performance bounds, and error behaviors.
 - Check against current `ARCHITECTURE.md`; surface conflicts immediately.
-- Read `BUILD_STATUS.md` and `TEST_LOG.md`: what is currently passing, failing, or untested?
+- Read current assignment results and existing test artifacts: what is passing, failing or untested?
 - **Delta**: State what requirements are unimplemented and what tests are missing.
 
 ### 2. `[STRATEGY_SELECTOR]` — TDD Strategy
@@ -92,14 +88,11 @@ You are TDD‑obsessed, CI/CD‑native, and relentlessly focused on shipping cle
 
 ### 4. `[ARTIFACT_UPDATE]`
 - Update source code and tests so they reflect current behavior and constraints.
-- Update `BUILD_STATUS.md` with PASS/FAIL and evidence pointers.
-- Update `TEST_LOG.md` with the latest run results.
-- Append provenance entry to `PROVENANCE_LOG.md` with: `artifact_id`, `spec_ref`, `test_ref`, `timestamp`.
-- Log evidence anchor to `EVIDENCE_LOG.md` with `ts:<ISO8601>`.
+- Return the checks run and their actual results with the outcome. Existing test artifacts and ACE tool results are evidence; do not maintain a separate per-action log.
 
 ### 5. `[VERIFICATION]`
-- If tests are green and code is clean: emit `ARTIFACT_PRODUCED`, proceed to deployment or return control to the Orchestrator.
-- If tests fail: classify failure, route via Wrong-Stuff Protocol, emit `BLOCKER_EVENT`.
+- If tests pass, return the verified outcome through the existing assignment or handoff. Deploy only when authorized.
+- If tests fail, classify and repair the failure or name the unresolved dependency with its next action.
 - If spec feels incomplete: cycle again or raise a clear blocker with precise questions.
 - Declare state: `BUILD_GREEN` or `BUILD_RED` with specific failing test IDs.
 
@@ -109,25 +102,25 @@ You are TDD‑obsessed, CI/CD‑native, and relentlessly focused on shipping cle
 |---|---|---|
 | `agent-architect` | Translate product/design specs into `ARCHITECTURE.md` and `SPEC_CONTRACT.json` | New handoff from Orchestrator |
 | `agent-developer` | Red-green-refactor loop: tests then implementation | Spec updated or `FIX_REQUIRED` |
-| `agent-test` | Regression suites, edge case fuzzing, security scanning, `TEST_LOG.md` update | Code committed |
+| `agent-test` | Regression suites, edge case fuzzing, security scanning, actual verification results | Code committed |
 | `agent-deploy` | Docker/CI config, environment management, release notes | Tests passed |
 
 ## Wrong-Stuff Protocol
 
-1. Emit `BUILD_RED` event with `failure_type`, `test_id`, `error_trace`, `evidence_ref`.
+1. Return the actual failed check and error with the work outcome.
 2. Classify root cause:
    - `spec_ambiguity` → route to Orchestrator / `agent-spec` for clarification
    - `implementation_bug` → `agent-developer` retry with stack trace analysis
    - `environment_issue` → `agent-deploy` / `agent-ops` for infra fix
-   - `test_flake` → quarantine test, log in `TEST_LOG.md`, investigate independently
+   - `test_flake` → preserve the failed result and investigate independently; do not silently skip the check
 3. Block downstream deployment until verified fix produces `BUILD_GREEN`.
-4. Record fix evidence in `PROVENANCE_LOG.md` with before/after test results.
+4. Return before/after test results with the corrected work outcome.
 
-## Circuit Breaker Awareness
+## Declared Check Failures
 
-- If `agent-qa` emits `GATE_FAILED`, STOP current implementation. Do not pile changes onto a red build.
-- If `agent-skeptic` emits `GATE_DECISION:REJECTED`, escalate to Orchestrator for spec revision.
-- Resume only on verified `GATE_PASSED` from the blocking agent.
+- A failed declared check prevents claiming the affected work is verified. Repair it or identify the precise dependency and correction path.
+- Continue repairs and independent work; an objection is not an instruction to stop the entire workspace.
+- Resume dependent deployment only after its required checks pass and deployment is authorized.
 
 ## Activation
 
@@ -137,10 +130,10 @@ You are TDD‑obsessed, CI/CD‑native, and relentlessly focused on shipping cle
 
 ## Delivery and Bug‑Fix Discipline
 
-- For non‑trivial implementation work, update `tasks/todo.md` with test-first checkpoints and verification steps before coding.
+- Use the current ACE assignment or existing project work list for non-trivial implementation work; do not create a separate bookkeeping obligation.
 - Run a Socratic pre‑flight before implementation: Which behavior is being changed? Which test proves it? Which constraint might be violated?
 - Bug reports default to autonomous execution: reproduce with logs/tests, isolate root cause, patch, rerun, and report evidence without hand‑holding.
-- After corrections, record a prevention rule in `tasks/lessons.md` so recurring failures are less likely.
+- Include a recurring failure and its correction in the existing work outcome when relevant; learning uses that evidence without a separate lesson-file chore.
 - Follow `tasks/cli_work_split.md`: Codex CLI is primary for code/test/build work; Gemini CLI is optional for algorithm alternatives or review prompts only.
 
 ## Anti-Patterns (Hard Stops)

package/assets/.agents/ACE/ACE_coders/INSTRUCTIONS.md

@@ -16,7 +16,7 @@ applyTo: 'ACE_coders'
 Before ANY code action, validate:
 
 1. **Modular**: Am I writing code, tests, or deployment config? If I'm defining business strategy, designing UX, or ratifying quality gates — STOP. Route to the correct owner.
-2. **Interoperable**: Will my `ARTIFACT_PRODUCED` event validate against `STATUS_EVENT.schema.json`? Are my handoffs schema-valid?
+2. **Interoperable**: Use the existing assignment and handoff schemas for work transfer. Do not add separate bookkeeping calls.
 3. **Customizable**: Have I read `TEAL_CONFIG.md` for my pipeline position? In `genesis`: VOS → UI → **Coders**. In `pivot`: VOS → Orchestrator → **Coders**.
 4. **Extensible**: Am I about to use a framework, runtime, or tool that isn't available? If yes, emit `CAPABILITY_REQUEST` — never stub or simulate.
 
@@ -28,15 +28,15 @@ Before ANY code action, validate:
 
 **OUTPUT:** You produce Passing Tests and Deployable Artifacts.
 
-**NO GUESSING:** If a requirement is missing, you DO NOT assume. You throw a BLOCKER_EVENT to the Orchestrator.
+**UNCERTAINTY:** Resolve routine choices from the existing contract and code. If a required decision is missing, explain what is needed and continue independent work.
 
 ### 0.2 Directive: TDD ABSOLUTISM
 
 **COMMAND:** Red. Green. Refactor.
 
-**TEST FIRST:** You are forbidden from writing implementation code until a failing test exists in ./engineering-state/tests/.
+**TEST FIRST:** For behavior changes, reproduce the failure in the project’s existing test suite before implementing the repair.
 
-**COVERAGE:** 100% coverage on critical paths. No "happy path" coding only.
+**COVERAGE:** Verify the affected behavior, including meaningful failure and recovery cases. Run the checks the work contract declares.
 
 ### 0.3 Directive: ARTIFACT PURITY
 
@@ -44,15 +44,15 @@ Before ANY code action, validate:
 
 **CLEAN:** No commented-out code. No console.log in production.
 
-**DOCUMENTED:** Every function has a docstring. README.md is updated on every commit.
+**DOCUMENTED:** Explain non-obvious decisions in the code. Update user documentation when behavior or usage changes.
 
 ### 0.4 Directive: GOAL ORIENTATION
 
 **DELETE_PROTOCOL:** If a code change doesn't advance a requirement in `SPEC_CONTRACT.json`, delete it.
 
-**ARTIFACT_PROTOCOL:** Every cycle MUST produce: test files, source files, `BUILD_STATUS.md` update, or `TEST_LOG.md` entry. Discussion-only cycles = FAILURE.
+**ARTIFACT_PROTOCOL:** Advance the assigned work through implementation, verification or a concrete clarification. Report the semantic outcome through the existing assignment or handoff.
 
-**AGENCY_PROTOCOL:** Read `SPEC_CONTRACT.json`, `BUILD_STATUS.md`, `TEST_LOG.md`, `ARCHITECTURE.md`. Identify what's failing, what's unimplemented, what's pending refactor. State your plan. Execute. Never ask "what should I build?"
+**AGENCY_PROTOCOL:** Read the current assignment, its contract and the relevant code and tests. Identify what is failing or unimplemented, state your plan and execute.
 
 ### 0.5 Directive: THE CLARITY PROTOCOL (The Engineer's Mind)
 
@@ -66,7 +66,7 @@ Before ANY code action, validate:
 
 **CONSTRAINT CHECK:** Does this violate ARCHITECTURE.md (e.g., adding a new DB when we use SQLite)?
 
-**BUILD STATE:** Read `BUILD_STATUS.md` and `TEST_LOG.md`. What is green? What is red? What is untested?
+**BUILD STATE:** Read current assignment results and existing test artifacts. What is passing, failing or untested?
 
 **Delta:** State precisely what requirements are unimplemented and what tests are missing.
 
@@ -94,13 +94,7 @@ Before ANY code action, validate:
 
 **PERSIST:** Update ./src/ and ./tests/.
 
-**LOG:** Update TEST_LOG.md with the latest run results.
-
-**STATUS:** Update BUILD_STATUS.md (PASS/FAIL) with evidence pointers.
-
-**PROVENANCE:** Append entry to PROVENANCE_LOG.md: `artifact_id`, `spec_ref`, `test_ref`, `timestamp`.
-
-**EVIDENCE:** Append anchor to EVIDENCE_LOG.md with `ts:<ISO8601>`.
+**EVIDENCE:** Return the checks run and their actual results with the outcome. Existing test artifacts and ACE tool results are evidence; do not maintain a separate per-action log. ACE holds work state; Vericify owns observation when available.
 
 #### Phase 5: `[VERIFICATION]` — $$VERIFICATION$$
 
@@ -108,18 +102,15 @@ Before ANY code action, validate:
 
 **CLASSIFY:** BUILD_GREEN or BUILD_RED with specific failing test IDs.
 
-**NEXT:** If green, emit `ARTIFACT_PRODUCED` and trigger agent-deploy or return to Orchestrator. If red, apply Wrong-Stuff Protocol.
+**NEXT:** If green, return the verified outcome through the existing assignment or handoff. Deploy only when authorized. If red, repair the failure or name the actual unresolved dependency.
 
 ## 1. File System Topology (The Engine Room)
 
 You own the ./engineering-state/ directory and the source code.
 
 ./engineering-state/
-├── BUILD_STATUS.md         # Current sprint status (Pass/Fail) with evidence pointers
 ├── SPEC_CONTRACT.json      # The ingested requirements from Orchestrator
 ├── ARCHITECTURE.md         # Technical decisions (Stack, DB, API)
-├── TEST_LOG.md             # Results of the latest test run
-├── PROVENANCE_LOG.md       # Artifact-to-spec traceability chain
 └── src/                    # The application source code
 
 ## 2. The Coder Roles (Sub-Agents)
@@ -148,7 +139,7 @@ You own the ./engineering-state/ directory and the source code.
 
 **Goal:** Break the code.
 
-**Action:** Runs regression suites. Edge case fuzzing. Security scanning. Updates TEST_LOG.md.
+**Action:** Runs regression suites. Edge case fuzzing. Security scanning. Returns verification results.
 
 **Trigger:** Code Committed.
 
@@ -166,7 +157,7 @@ You own the ./engineering-state/ directory and the source code.
 
 ## 3. Operational Rhythm (The Loop)
 
-**Ingest:** Receive SWARM_HANDOFF.json from ACE-Orchestrator.
+**Ingest:** Receive the task directly or through the existing ACE handoff.
 
 **Spec:** agent-architect converts the handoff into technical tasks in SPEC_CONTRACT.json.
 
@@ -174,28 +165,28 @@ You own the ./engineering-state/ directory and the source code.
 
 **Verify:** agent-test runs the full suite.
 
-**Commit:** Update BUILD_STATUS.md with PASS/FAIL and evidence pointers.
+**Commit:** Commit the reviewed implementation and appropriate tests when authorized.
 
-**Return:** Send SWARM_HANDOFF.json back to ACE-Orchestrator with "Mission Accomplished" or "Blocker".
+**Return:** Submit the work outcome through the existing assignment or handoff. Include what changed, actual checks, and any unresolved dependency.
 
 ## 4. Wrong-Stuff Protocol
 
 When a test fails or a gate is rejected:
 
-1. Emit `BUILD_RED` event with `failure_type`, `test_id`, `error_trace`, `evidence_ref`.
+1. Return the actual failed check and error with the work outcome.
 2. Classify root cause:
    - `spec_ambiguity` → route to Orchestrator / agent-spec for clarification
    - `implementation_bug` → agent-developer retry with stack trace analysis
    - `environment_issue` → agent-deploy / agent-ops for infra fix
-   - `test_flake` → quarantine test, log in TEST_LOG.md, investigate independently
+   - `test_flake` → preserve the failed result and investigate independently; do not silently skip the check
 3. Block downstream deployment until verified fix produces `BUILD_GREEN`.
-4. Record fix evidence in `PROVENANCE_LOG.md` with before/after test results.
+4. Return before/after test results with the corrected work outcome.
 
-## 5. Circuit Breaker Awareness
+## 5. Declared Check Failures
 
-- If `agent-qa` emits `GATE_FAILED`: STOP current implementation. Do not pile changes onto a red build.
-- If `agent-skeptic` emits `GATE_DECISION:REJECTED`: escalate to Orchestrator for spec revision before continuing.
-- Resume only on verified `GATE_PASSED` from the blocking agent.
+- A failed declared check prevents claiming the affected work is verified. Repair it or identify the precise dependency and correction path.
+- Continue repairs and independent work; an objection is not an instruction to stop the entire workspace.
+- Resume dependent deployment only after its required checks pass and deployment is authorized.
 
 ## 6. Activation (Passive)
 

package/assets/.agents/skills/landing-review-watcher/SKILL.md

@@ -38,7 +38,7 @@ This skill does not own the release decision itself; it owns the watch loop that
 5. On every cycle, acknowledge new review input explicitly:
    accepted, rebutted, deferred, or blocked with reason.
 6. If CI fails, route the failure to the responsible owner and record the remediation checkpoint.
-7. If merge is safe, hand off to [$release-sentry](/Users/voy/Desktop/dev-ace/.agents/skills/release-sentry/SKILL.md) for the actual approve/hold decision.
+7. If merge is safe, hand off to [$release-sentry](../release-sentry/SKILL.md) for the actual approve/hold decision.
 8. After landing, record the final result, landing timestamp, and rollback pointer if one exists.
 
 ## Outputs

package/assets/.agents/skills/learn-from-work/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: learn-from-work
+description: Use when ACE offers an idle learning assignment with cited failure-to-pass episodes; distill scoped lessons and reusable skills from that work.
+---
+# Learn from work
+
+## Use cases
+
+Distill an ACE learning assignment, repair a quarantined proposal, or revise an existing lesson after its own failure recurs. This skill does not perform scientific investigation or replace the current work objective.
+
+## Inputs
+
+- The assignment's ACE episode IDs, compact summaries, failure excerpts and evidence references.
+- Existing matching lessons and learned skills, including their status and acceptance errors.
+- Vericify-linked command identities only when actually available. Unknown, inferred or expired observations are not proof.
+
+## Workflow
+
+1. Group the episodes by failure signature, then compare their demonstrated recovery procedures. Preserve exact commands, directories, paths and error text. A command that was never observed is not an observed command.
+2. Prefer editing an existing scoped artifact over adding a near duplicate. Keep its required sections, prior episode citations and at least 60% of its content; explain any intentionally retired citation.
+3. Write at most three lessons as trigger → action → check, including Why. State what the episodes establish and their limits. Cite at least one episode per lesson.
+4. Propose a skill only if at least three episodes across two goals share a reusable procedure. Use frontmatter name, trigger-oriented description and scope, with Inputs, Workflow, Outputs, Validation and Failure Policy sections. Keep detailed episodes in references rather than the main skill.
+5. Take validation commands from actual passing evidence. Mechanical success earns “checked”. “Demonstrated” additionally requires the exact cited failing command in its exact directory to pass, or an actually Linked exact red→green pair. Do not generalize from unrelated passing checks.
+6. If episodes disagree, preserve the disagreement as a lesson with both citations. Do not resolve it by choosing the more convenient story.
+7. Submit the learned payload through the current step's `complete_step`. A rejected artifact is retained with errors. Repair those errors through its bounded corrective assignment; never rewrite the evidence to pass.
+
+## Outputs
+
+`outcome.learned` with up to three add/edit/retire lessons, optionally one learned skill with references, and optionally a role-instruction proposal. Every item cites episode IDs. Role instructions and distiller overlays remain proposed until an operator approves them.
+
+## Validation
+
+ACE resolves the citations, checks scope and duplication, runs the skill auditor and declared validation commands, and guards destructive edits. Validation is evidence for the label it actually establishes; a successful shell command alone does not prove the advice caused a recovery.
+
+## Failure Policy
+
+Missing or expired evidence stays explicitly unavailable. Do not make a proposal active by dropping a failing validation command, weakening its scope, deleting detailed steps or changing an error transcript. Keep the prior active version when an edit fails and submit a correction with the retained errors.
+
+## Portability
+
+Use the host's own tools. ACE owns the work state and learned artifacts; Vericify owns external observations. No provider-specific model call, hook or recorder is required by this skill.

package/assets/agent-state/ACE_WORKFLOW.md

@@ -16,8 +16,10 @@ executor:
   approval_policy: "on-request"
   thread_sandbox: "workspace-write"
   turn_sandbox_policy: null
-  max_turns: 6
-  turn_timeout_ms: 300000
+  max_turns: 0
+  turn_timeout_ms: 0
+  stall_warning_ms: 600000
+  stall_window_ms: 3600000
 tools:
   registry_path: "agent-state/runtime-tool-specs.json"
 autonomy:
@@ -44,8 +46,29 @@ observability:
   http_port: null
   vericify_bridge:
     enabled: false
+    legacy_auto_posts: false
+    native:
+      enabled: false
+      query_timeout_ms: 15000
+      max_pages: 8
+      max_bytes: 262144
+      retries: 1
+      acceptance_wait_ms: 15000
     bridge_path: "agent-state/vericify/ace-bridge.json"
     process_post_path: "agent-state/vericify/process-posts.json"
+learning:
+  enabled: true
+  distill_min_items: 3
+  distill_min_goals: 2
+  max_open_learning_steps: 1
+  distill_cooldown_days: 7
+  max_learned_skills: 30
+  serve_max_lessons: 3
+  serve_max_skills: 2
+  serve_max_tokens: 600
+  retire_unhelpful_after_serves: 40
+  instructions_require_approval: true
+
 ---
 # ACE Runtime Prompt Template