cctally 1.113.0 → 1.115.0

package/bin/_cctally_tui.py

@@ -223,7 +223,7 @@ from _lib_display_tz import (
     _compute_display_block,
 )
 from _lib_aggregators import _aggregate_monthly, codex_path_scope
-from _lib_fmt import stable_sum
+from _lib_fmt import _fmt_usd_accounting, stable_sum
 # Opt-in backend phase-instrumentation collector (issue #276, Session A). Pure
 # stdlib leaf; near-noop when CCTALLY_PERF_TRACE is unset (phase() returns a
 # shared no-op singleton), so the _tui_build_snapshot seam wraps below cost
@@ -348,6 +348,10 @@ def _fetch_current_week_snapshots(*args, **kwargs):
     return sys.modules["cctally"]._fetch_current_week_snapshots(*args, **kwargs)
 
 
+def _current_week_five_hour_reading(*args, **kwargs):
+    return sys.modules["cctally"]._current_week_five_hour_reading(*args, **kwargs)
+
+
 def _load_forecast_inputs(*args, **kwargs):
     return sys.modules["cctally"]._load_forecast_inputs(*args, **kwargs)
 
@@ -1682,12 +1686,14 @@ def _tui_build_current_week(
     # controls decoration, not the physical population used for computation.
     # Cost and forecast retain their existing merged semantics.
     fetched = _fetch_current_week_snapshots(
-        conn, now_utc, include_held=True, include_account=True)
+        conn, now_utc, include_held=True, include_account=True,
+        include_scope=True)
     if fetched is None:
         return None
-    week_start_at, week_end_at, observations = fetched
+    week_start_at, week_end_at, observations, week_scope = fetched
     if not observations:
         return None
+    week_start_before_override = week_start_at
     # Mirror the reset override applied by `_load_forecast_inputs` so the
     # Current Week card's spent_usd and $/1% reflect the post-reset window.
     week_start_at, observations = _apply_midweek_reset_override(
@@ -1698,8 +1704,8 @@ def _tui_build_current_week(
     # Held-inclusive sample shape: (captured_at_utc, weekly_percent,
     # five_hour_percent, weekly_observation_held[, account_key]). The optional
     # account key identifies the displayed weekly sample on a decorated store.
-    # The helper does not surface five_hour_resets_at, so do a targeted lookup
-    # below for the freshest non-NULL reset timestamp on the current week.
+    # The helper does not surface five_hour_resets_at; the five-hour reading
+    # selected below supplies it, with its percentage.
     #
     # #769 S11 (#824). This card publishes BOTH axes, and the dashboard
     # envelope reads `used_pct` and `latest_snapshot_at` straight off it for
@@ -1716,10 +1722,16 @@ def _tui_build_current_week(
     used_pct = float(latest[1])
     weekly_account = latest[4]
     # Five-hour readings may be newer held observations, but must remain on
-    # the account that supplied the displayed weekly reading.
-    five_hour_samples = [s for s in observations if s[4] == weekly_account]
-    five_hr_raw = five_hour_samples[-1][2]
-    five_hr_pct = float(five_hr_raw) if five_hr_raw is not None else None
+    # the account that supplied the displayed weekly reading. The reading is
+    # the newest five-hour READING under this card's own week and as-of scope
+    # (#825/#832 spec 4.7 revision 7, the one shared selection): the newest
+    # sample can be a retired replica or a weekly-only reading, which carries
+    # no five-hour value and used to render as 0 %.
+    five_hour = _current_week_five_hour_reading(
+        conn, now_utc, week_scope, account_key=weekly_account,
+        week_start_at=week_start_at,
+        week_start_before_override=week_start_before_override)
+    five_hr_pct = None if five_hour is None else five_hour.percent
     # #556 S1 §3.3: one walk yields both halves. The range is whatever
     # `spent_usd` already used — taken AFTER `_apply_midweek_reset_override`
     # above, so a mid-week reset shortens the accumulation and the published
@@ -1738,47 +1750,23 @@ def _tui_build_current_week(
     used_pct_corrected = corrected_percent_point(used_pct)
     dpp_divisor = used_pct if used_pct_corrected is None else used_pct_corrected
     dpp = (spent / dpp_divisor) if used_pct > 0 else None
-    # Collect every textual variant of week_start_at that parses to the same
-    # instant — mirrors `_fetch_current_week_snapshots` lines 9199-9210 so
-    # legacy local-offset rows and newly UTC-canonicalized rows both contribute.
-    ws_texts = conn.execute(
-        "SELECT DISTINCT week_start_at FROM weekly_usage_snapshots "
-        "WHERE week_start_at IS NOT NULL"
-    ).fetchall()
-    matching_ws_texts: list[str] = []
-    for r in ws_texts:
+    # The reset instant comes from the SAME reading as the percentage beside
+    # it (#825/#832 spec 4.7 revision 7: the shared selection returns the
+    # percent and the reset together from one row), so the countdown never
+    # describes another row. That reading is held-inclusive (#769 S11, #824),
+    # because a held row's five-hour fields are the writing tick's own.
+    five_hr_resets_at: dt.datetime | None = None
+    if five_hour is not None and five_hour.resets_at is not None:
         try:
-            rws = parse_iso_datetime(r[0], "week_start_at")
+            five_hr_resets_at = parse_iso_datetime(
+                five_hour.resets_at, "five_hour_resets_at"
+            )
         except ValueError:
-            continue
-        if rws == week_start_at:
-            matching_ws_texts.append(r[0])
-    five_hr_resets_at: dt.datetime | None = None
-    if matching_ws_texts:
-        placeholders = ",".join("?" * len(matching_ws_texts))
-        # HELD-INCLUSIVE, deliberately (#769 S11, #824): the reset instant is a
-        # five-hour fact, and a held row's five-hour fields are the writing
-        # tick's own. Excluding held rows here would make the countdown lag the
-        # five-hour percentage rendered beside it.
-        reset_row = conn.execute(
-            f"SELECT five_hour_resets_at FROM weekly_usage_snapshots "
-            f"WHERE week_start_at IN ({placeholders}) "
-            f"  AND five_hour_resets_at IS NOT NULL "
-            f"  AND account_key = ? "
-            f"ORDER BY captured_at_utc DESC, id DESC LIMIT 1",
-            tuple(matching_ws_texts) + (weekly_account,),
-        ).fetchone()
-        if reset_row is not None:
-            try:
-                five_hr_resets_at = parse_iso_datetime(
-                    reset_row[0], "five_hour_resets_at"
-                )
-            except ValueError:
-                five_hr_resets_at = None
-            # Suppress stale resets that have already elapsed so renderers
-            # don't show "resets 0h 00m" or a negative duration at the boundary.
-            if five_hr_resets_at is not None and five_hr_resets_at <= now_utc:
-                five_hr_resets_at = None
+            five_hr_resets_at = None
+        # Suppress stale resets that have already elapsed so renderers
+        # don't show "resets 0h 00m" or a negative duration at the boundary.
+        if five_hr_resets_at is not None and five_hr_resets_at <= now_utc:
+            five_hr_resets_at = None
     # Freshness — compute label/age from latest snapshot vs. now using the
     # configured oauth_usage thresholds. Mirrors the dashboard envelope's
     # cw_freshness derivation in `snapshot_to_envelope`. Refs spec §3.4.
@@ -6878,7 +6866,6 @@ def _tui_panel_current_week(
     bar_fill = _tui_bar_string(cw.used_pct, bar_w)
 
     five = cw.five_hour_pct or 0.0
-    five_bar = _tui_bar_string(five, bar_w)
 
     reset_delta = cw.week_end_at - snap.generated_at
     reset_days = max(0, reset_delta.days)
@@ -6914,6 +6901,17 @@ def _tui_panel_current_week(
                 for c in fh_credits
             )
             fh_credit_badge = f" {{bright}}⚡ {deltas}{{/}}"
+    # The 5-hour row is " 5-hour " (8 cells) + bar + " NNN%" (5) + badge, and
+    # it must fit the panel interior (width - 2). A bar of the Used row's width
+    # leaves five cells, while the badge's wide ⚡ glyph alone costs two, so a
+    # badge shortens the 5-hour bar instead of spilling into the next panel.
+    # It also leaves one blank cell before the right border, as every other
+    # row of the panel does.
+    five_w = bar_w
+    if fh_credit_badge:
+        badge_cells = _tui_lines_to_text([fh_credit_badge]).cell_len
+        five_w = max(10, min(bar_w, width - 2 - 13 - badge_cells - 1))
+    five_bar = _tui_bar_string(five, five_w)
     lines = [
         "",
         f" Used   {{{used_cls}}}{bar_fill}{{/}} {{{used_cls}.b}}{cw.used_pct:>5.1f}%{{/}}",
@@ -7648,7 +7646,13 @@ def _tui_tagged_box_lines(
     When a body line's plain length exceeds the interior width it is truncated
     with ``{/}`` appended as a safety net — callers should size their content
     to avoid this branch.
+
+    Lengths are terminal CELLS, not characters: a wide glyph such as the
+    5-hour credit badge's ``⚡`` is one character but two cells, and padding
+    by characters pushed that row's right border one cell out of the box
+    (#825/#832, UI-QA of fix round K16c).
     """
+    from rich.cells import cell_len, set_cell_size
     H, V = _TUI_BOX["h"], _TUI_BOX["v"]
     TL, TR, BL, BR = _TUI_BOX["tl"], _TUI_BOX["tr"], _TUI_BOX["bl"], _TUI_BOX["br"]
     interior = width - 2
@@ -7662,12 +7666,12 @@ def _tui_tagged_box_lines(
         t_seg = f" {title} " if title else ""
         p_seg = f" {pin} " if pin else ""
         if title and pin:
-            fill = width - 4 - len(_tui_strip_tags(t_seg)) - len(_tui_strip_tags(p_seg))
+            fill = width - 4 - cell_len(_tui_strip_tags(t_seg)) - cell_len(_tui_strip_tags(p_seg))
             if fill >= 1:
                 return (_wrap_border(TL + H) + t_seg
                         + _wrap_border(H * fill) + p_seg + _wrap_border(H + TR))
         if title:
-            fill = width - 3 - len(_tui_strip_tags(t_seg))
+            fill = width - 3 - cell_len(_tui_strip_tags(t_seg))
             if fill >= 1:
                 return _wrap_border(TL + H) + t_seg + _wrap_border(H * fill + TR)
         return _wrap_border(TL + H * interior + TR)
@@ -7675,14 +7679,14 @@ def _tui_tagged_box_lines(
     lines: list[str] = [_top()]
     for line in body_tagged:
         plain = _tui_strip_tags(line)
-        if len(plain) > interior:
+        if cell_len(plain) > interior:
             # On overflow, drop color markup entirely — partial-tag truncation
             # would produce malformed tokens that crash _tui_colortag. Plain-
             # text is always safe, and callers are expected to size content
             # to fit (this branch is a safety net only).
-            line = plain[: max(0, interior - 1)] + "…"
+            line = set_cell_size(plain, max(0, interior - 1)) + "…"
             plain = line
-        pad = interior - len(plain)
+        pad = interior - cell_len(plain)
         lines.append(_wrap_border(V) + line + " " * pad + _wrap_border(V))
     lines.append(_wrap_border(BL + H * interior + BR))
     return lines
@@ -8401,8 +8405,9 @@ def _tui_modal_current_week(snap, runtime, width):
             ms.crossed_at, runtime.display_tz,
             fmt="%b %d %H:%M:%S", suffix=True,
         )
-        cumul_str = f"${ms.cumulative_cost_usd:.2f}".ljust(8)
-        marg_str = (f"${ms.marginal_cost_usd:.2f}" if ms.marginal_cost_usd is not None else "—").ljust(10)
+        cumul_str = _fmt_usd_accounting(ms.cumulative_cost_usd, 2).ljust(8)
+        marg_str = (_fmt_usd_accounting(ms.marginal_cost_usd, 2)
+                    if ms.marginal_cost_usd is not None else "—").ljust(10)
         line = f"   {{b}}{ms.percent:>3}{{/}} {{bright}}{ts_str:<22}{{/}} {{b}}{cumul_str}{{/}} {{b}}{marg_str}{{/}}"
         if show_5h:
             five_str = (f"{int(ms.five_hour_pct_at_crossing)}%"

package/bin/_cctally_weekrefs.py

@@ -88,6 +88,131 @@ def _get_canonical_boundary_for_date(
     return None, None
 
 
+#: #901 (I1/G1, Amendment 1 item 8 and 1b): one leg per snapshot table of the
+#: recent-week read. Each groups ONE table's weeks newest first, streamed off a
+#: week-date-leading index, so neither leg sorts anything; `_recent_week_rows`
+#: merges the two. The usage leg reads the covering epoch-1017
+#: `idx_usage_week_date_group` (no table lookups), falling back to
+#: `idx_usage_week_time` on an index without it; the cost leg reads
+#: `idx_cost_week_time`.
+_RECENT_USAGE_WEEKS_SQL = (
+    "SELECT week_start_date, MAX(week_end_date) AS week_end_date "
+    "FROM weekly_usage_snapshots{hint}{account} "
+    "GROUP BY week_start_date ORDER BY week_start_date DESC"
+)
+_RECENT_COST_WEEKS_SQL = (
+    "SELECT week_start_date, MAX(week_end_date) AS week_end_date "
+    "FROM weekly_cost_snapshots{hint}{account} "
+    "GROUP BY week_start_date ORDER BY week_start_date DESC"
+)
+
+
+def _sqlite_sort_key(value) -> tuple:
+    """Rank a stored value the way SQLite's BINARY comparison ranks it.
+
+    NULL first, then numbers (integers and reals compared numerically), then
+    text in code-point order (which is UTF-8 byte order), then blobs.
+    """
+    if value is None:
+        return (0, 0)
+    if isinstance(value, (int, float)):
+        return (1, value)
+    if isinstance(value, str):
+        return (2, value)
+    return (3, bytes(value))
+
+
+def _sqlite_max(left, right):
+    """SQLite's MAX() over two group maxima: NULL never wins."""
+    if left is None:
+        return right
+    if right is None:
+        return left
+    return left if _sqlite_sort_key(left) >= _sqlite_sort_key(right) else right
+
+
+def _recent_week_rows(
+    conn: sqlite3.Connection, limit: "int | None", *,
+    account_key: "str | None" = None,
+) -> "list[tuple[object, object]]":
+    """The newest ``limit`` week dates across both snapshot tables (#901).
+
+    Returns ``(week_start_date, week_end_date)`` pairs, newest date first, where
+    ``week_end_date`` is the latest end date EITHER table records for that
+    date: exactly the rows of the pre-#901 statement, which grouped the
+    ``UNION ALL`` of both tables through a temp b-tree over every snapshot ever
+    recorded and applied ``LIMIT`` only afterwards (Amendment 1 item 8,
+    ``c901-design-2``). Each table now streams its own groups in descending
+    date order; this merges the two cursors, combining equal dates with MAX,
+    holds one pending group per cursor, and stops at ``limit`` merged distinct
+    dates. ``None`` or a negative ``limit`` is unbounded and ``0`` returns
+    nothing, as SQL ``LIMIT`` did. The limit applies before any boundary
+    conversion or invalid-ref filtering, as it did.
+
+    Both cursors read one snapshot: inside the caller's transaction when there
+    is one (left open), otherwise inside a read transaction opened and closed
+    here. Each leg is pinned to its index only when the index exists; the
+    usage leg prefers the covering ``idx_usage_week_date_group`` (Amendment
+    1b) and keeps ``idx_usage_week_time`` as its compatibility fallback.
+    """
+    limit_n = -1 if limit is None else int(limit)
+    if limit_n == 0:
+        return []
+    present = {
+        str(row[0]) for row in conn.execute(
+            "SELECT name FROM sqlite_master WHERE type='index' AND name IN "
+            "('idx_usage_week_date_group', 'idx_usage_week_time', "
+            "'idx_cost_week_time')")
+    }
+    account = "" if account_key is None else " WHERE account_key = ?"
+    params: tuple = () if account_key is None else (account_key,)
+    usage_index = next(
+        (name for name in ("idx_usage_week_date_group", "idx_usage_week_time")
+         if name in present), None)
+    usage_sql = _RECENT_USAGE_WEEKS_SQL.format(
+        hint=f" INDEXED BY {usage_index}" if usage_index else "",
+        account=account)
+    cost_sql = _RECENT_COST_WEEKS_SQL.format(
+        hint=(" INDEXED BY idx_cost_week_time"
+              if "idx_cost_week_time" in present else ""),
+        account=account)
+    own_transaction = not conn.in_transaction
+    if own_transaction:
+        conn.execute("BEGIN")
+    try:
+        usage = conn.execute(usage_sql, params)
+        cost = conn.execute(cost_sql, params)
+        try:
+            rows: "list[tuple[object, object]]" = []
+            pending_usage = usage.fetchone()
+            pending_cost = cost.fetchone()
+            while (pending_usage is not None or pending_cost is not None) and (
+                    limit_n < 0 or len(rows) < limit_n):
+                if pending_cost is None or (
+                        pending_usage is not None
+                        and _sqlite_sort_key(pending_usage[0])
+                        > _sqlite_sort_key(pending_cost[0])):
+                    rows.append((pending_usage[0], pending_usage[1]))
+                    pending_usage = usage.fetchone()
+                elif pending_usage is None or (
+                        _sqlite_sort_key(pending_cost[0])
+                        > _sqlite_sort_key(pending_usage[0])):
+                    rows.append((pending_cost[0], pending_cost[1]))
+                    pending_cost = cost.fetchone()
+                else:
+                    rows.append((pending_usage[0], _sqlite_max(
+                        pending_usage[1], pending_cost[1])))
+                    pending_usage = usage.fetchone()
+                    pending_cost = cost.fetchone()
+        finally:
+            usage.close()
+            cost.close()
+    finally:
+        if own_transaction:
+            conn.execute("COMMIT")
+    return rows
+
+
 def get_recent_weeks(
     conn: sqlite3.Connection, limit: "int | None", *,
     account_key: "str | None" = None,
@@ -100,33 +225,15 @@ def get_recent_weeks(
     # (today's byte-identical behavior); a real key / ``unattributed`` scopes both
     # snapshot legs to that account's weeks (the ``--account`` render consumers —
     # ``report`` — pass it explicitly).
-    limit_sql = -1 if limit is None else int(limit)
-    acct_pred = "" if account_key is None else " WHERE account_key = ?"
-    acct_p: tuple = () if account_key is None else (account_key,)
-    rows = conn.execute(
-        f"""
-        SELECT week_start_date, MAX(week_end_date) AS week_end_date
-        FROM (
-          SELECT week_start_date, week_end_date FROM weekly_usage_snapshots{acct_pred}
-          UNION ALL
-          SELECT week_start_date, week_end_date FROM weekly_cost_snapshots{acct_pred}
-        )
-        GROUP BY week_start_date
-        ORDER BY week_start_date DESC
-        LIMIT ?
-        """,
-        acct_p + acct_p + (limit_sql,),
-    ).fetchall()
-
     refs: list[WeekRef] = []
-    for row in rows:
-        date_str = row["week_start_date"]
+    for date_str, week_end_date in _recent_week_rows(
+            conn, limit, account_key=account_key):
         canon_start, canon_end = _get_canonical_boundary_for_date(
             conn, date_str, account_key=account_key)
         try:
             ref = make_week_ref(
                 week_start_date=date_str,
-                week_end_date=row["week_end_date"],
+                week_end_date=week_end_date,
                 week_start_at=canon_start,
                 week_end_at=canon_end,
             )

package/bin/_lib_account_binding.py

@@ -0,0 +1,152 @@
+"""Immutable account binding carried by every current statusline/OAuth producer.
+
+#825/#832 spec 4.1. A binding is captured ONCE, from the stable-read identity
+resolver (`_cctally_core._resolve_active_claude_identity`), and then travels
+with the candidate, the publication plan or the OAuth publication it belongs
+to. No later stage re-resolves the active account: an A->B switch between
+capture and publication can therefore never re-label A's reading as B's.
+
+- ``identified`` binds the real account key, which must equal
+  ``_lib_accounts.account_key("claude", natural_id)``;
+- ``stably_absent`` (no ``~/.claude.json`` account, api-key mode) binds the
+  ``unattributed`` sentinel deliberately;
+- ``torn`` and every unreadable or internally inconsistent read yield NO
+  binding. The caller then writes no candidate, mutates no control state and
+  consumes no retry attempt.
+
+The credential evidence is a salted digest of the selected OAuth credential,
+never the credential itself. Serialization is strict: an exact camelCase key
+set, and ``load`` re-derives the identity evidence and compares it.
+
+Pure: no filesystem, clock or ``cctally`` namespace dependency.
+"""
+from __future__ import annotations
+
+import dataclasses
+import hashlib
+import json
+import re
+
+import _lib_accounts
+
+STATUS_IDENTIFIED = "identified"
+STATUS_STABLY_ABSENT = "stably_absent"
+
+_CREDENTIAL_SALT = "cctally-selected-credential-v1\0"
+_DIGEST_RE = re.compile(r"[0-9a-f]{64}\Z")
+_DOCUMENT_KEYS = frozenset({
+    "status", "accountKey", "identityEvidence", "credentialEvidence",
+    "naturalId", "email", "planType",
+})
+
+
+@dataclasses.dataclass(frozen=True)
+class AccountBinding:
+    status: str
+    account_key: str
+    identity_evidence: str
+    credential_evidence: str | None = None
+    natural_id: str | None = None
+    email: str | None = None
+    plan_type: str | None = None
+
+    def document(self) -> dict:
+        """The exact persisted shape (camelCase, every key always present)."""
+        return {
+            "status": self.status,
+            "accountKey": self.account_key,
+            "identityEvidence": self.identity_evidence,
+            "credentialEvidence": self.credential_evidence,
+            "naturalId": self.natural_id,
+            "email": self.email,
+            "planType": self.plan_type,
+        }
+
+    def identity(self) -> dict:
+        """The resolver's own shape, for consumers that take an identity."""
+        return {
+            "status": self.status,
+            "account_key": self.account_key,
+            "natural_id": self.natural_id,
+            "email": self.email,
+            "plan_type": self.plan_type,
+        }
+
+    def without_credential(self) -> "AccountBinding":
+        """The same identity with no credential evidence (identity equality)."""
+        return dataclasses.replace(self, credential_evidence=None)
+
+
+def credential_digest(credential: str) -> str:
+    """The salted credential evidence; the credential itself is never kept."""
+    return hashlib.sha256(
+        (_CREDENTIAL_SALT + credential).encode("utf-8")).hexdigest()
+
+
+def _identity_evidence(fields: dict) -> str:
+    return hashlib.sha256(json.dumps(
+        fields, sort_keys=True, separators=(",", ":")).encode("utf-8")
+    ).hexdigest()
+
+
+def capture(identity, *, credential: str | None = None) -> AccountBinding | None:
+    """Bind one resolver result, or return None for a torn, unreadable or
+    internally inconsistent read. Never guesses an account."""
+    if not isinstance(identity, dict):
+        return None
+    status = identity.get("status")
+    key = identity.get("account_key")
+    natural = identity.get("natural_id")
+    if status == STATUS_IDENTIFIED:
+        if not isinstance(natural, str) or not natural:
+            return None
+        if key != _lib_accounts.account_key("claude", natural):
+            return None
+    elif status == STATUS_STABLY_ABSENT:
+        if key != _lib_accounts.UNATTRIBUTED or natural is not None:
+            return None
+    else:
+        return None
+    fields = {
+        "status": status,
+        "account_key": key,
+        "natural_id": natural,
+        "email": identity.get("email"),
+        "plan_type": identity.get("plan_type"),
+    }
+    if any(value is not None and not isinstance(value, str)
+           for value in fields.values()):
+        return None
+    if credential is not None and (not isinstance(credential, str)
+                                   or not credential):
+        return None
+    return AccountBinding(
+        status=status,
+        account_key=key,
+        identity_evidence=_identity_evidence(fields),
+        credential_evidence=(
+            None if credential is None else credential_digest(credential)),
+        natural_id=natural,
+        email=fields["email"],
+        plan_type=fields["plan_type"],
+    )
+
+
+def load(document) -> AccountBinding:
+    """Validate a persisted binding document; ValueError on any mismatch."""
+    if not isinstance(document, dict) or set(document) != _DOCUMENT_KEYS:
+        raise ValueError("invalid account binding document")
+    binding = capture({
+        "status": document["status"],
+        "account_key": document["accountKey"],
+        "natural_id": document["naturalId"],
+        "email": document["email"],
+        "plan_type": document["planType"],
+    })
+    if binding is None or binding.identity_evidence != document["identityEvidence"]:
+        raise ValueError("inconsistent account binding")
+    evidence = document["credentialEvidence"]
+    if evidence is not None and (not isinstance(evidence, str)
+                                 or _DIGEST_RE.fullmatch(evidence) is None):
+        raise ValueError("invalid credential evidence")
+    return dataclasses.replace(binding, credential_evidence=evidence)