@entrorove/skill 0.1.22 → 0.1.24

package/AGREEMENT.md

@@ -1,6 +1,6 @@
 # entrorove 使用、隐私与广告信息协议
 
-版本：2026-10-02.1
+版本：2026-10-07.1
 
 本协议是首次使用 entrorove 技能时的合并告知与使用条款。只有用户明确选择“同意”后，技能请求才会发送。IDE 的“完全访问”权限只是本地权限，不代表同意本协议。
 
@@ -14,8 +14,8 @@
 
 - 安装包不会因安装本身自动扫描或上传项目文件。只有在发起技能调用时，才会向 entrorove API 发送 IDE 明确组装的请求负载。
 - 账号服务会处理登录邮箱、密钥哈希与前缀、加密保存的完整密钥、会话与安全记录、调用时间/数量，以及用户自愿提交的留言。已登录用户可再次复制自己的完整密钥。
-- 用户主动提交并明确同意公开的 IDE 评价会展示 IDE 名称、评分、评价文字和时间；公开列表最多展示最近 30 条。
-- 当前实现不将项目源文件或技能任务负载写入业务数据库，不出售个人信息。推广选择使用密钥的连续调用时长和调用次数判断展示时机，不分析项目内容或建立跨站画像。
+- IDE 评价须绑定同一账户最近 30 天内至少一次真实成功的技能调用，且用户另行明确同意按本版本告知公开其原文。服务保存原调用身份、结果摘要、用户原文、公开同意和时间；公开列表仅展示 IDE 名称、评分、原文和时间，最多最近 30 条，不展示账户、邮箱、调用身份或同意回执。每个账户每日最多提交 3 条。
+- 服务会持久保存明确提交的任务、需求、消息、工作流计划、合同、执行状态和验证证据，以便恢复及核对结果。明确提交的范围快照或审查证据可能包含源文件内容或副本；请只提交任务所需内容，避免密钥和其他不必要的私人数据。不出售个人信息。推广选择使用密钥的连续调用时长和调用次数判断展示时机，不分析项目内容或建立跨站画像。
 - 本地同意回执仅保存协议版本、同意结果和时间，不包含邮箱、项目内容或密钥。
 
 ## 3. 消息与广告
@@ -41,13 +41,13 @@
 
 # entrorove Terms, Privacy and Advertising Notice
 
-Version: 2026-10-02.1
+Version: 2026-10-07.1
 
 This combined notice applies on first use. A skill request is sent only after an explicit **Accept** choice. Granting an IDE “full access” permission does not accept this agreement.
 
 - **Use and access.** entrorove acts only on tasks, context and permissions supplied by the user and IDE. Elevated permissions may permit file changes, command execution and external calls. Review scope, keep backups and separately confirm consequential actions.
-- **Data.** Installation alone does not scan or upload project files. The account service processes login email, key hashes and prefixes, an encrypted copy of the full key that a signed-in user can copy again, sessions and security records, invocation time/count, and messages submitted voluntarily. Skill request payloads are received for execution; the current implementation does not store project source files or task payloads in its business database. It does not sell personal information. Promotion timing uses consecutive invocation duration and count for the same key, without examining project content or building a cross-site profile.
-- **Public reviews.** An IDE review is published only after the user submits it and explicitly consents to public display; the public list may show the IDE name, rating, review text and timestamp, limited to the latest 30 entries.
+- **Data.** Installation alone does not scan or upload project files. The account service processes login email, key hashes and prefixes, an encrypted copy of the full key that a signed-in user can copy again, sessions and security records, invocation time/count, and messages submitted voluntarily. Submitted tasks, requirements, messages, workflow plans, contracts, execution states and verification evidence are persisted for recovery and result checks. Scope snapshots or review evidence explicitly submitted for a task may contain source contents or copies. Submit only necessary material and avoid credentials or unnecessary private data. It does not sell personal information. Promotion timing uses consecutive invocation duration and count for the same key, without examining project content or building a cross-site profile.
+- **Public reviews.** An IDE review requires at least one actual successful skill invocation by the same account within the last 30 days, and a separate explicit consent to public display under this notice version. The service saves the original invocation identity, result digest, unchanged user text, consent and time. The public list shows only the IDE name, rating, original text and timestamp, limited to the latest 30 entries; account details, email, invocation identity and consent receipts stay private. Each account may submit at most three reviews per day.
 - **Advertising.** A configured message may appear beneath a long-running-task notice. Commercial content carries its configured category label as `【Category】` and includes an HTTPS link. Administrators set active dates, task-duration windows, selection weights and probability bounds. The service adjusts display probability using consecutive invocation duration and count, without inspecting task text or project files. Third-party links are governed by their operators.
 - **Risk.** The skill is provided as available without a guarantee that every result is correct, complete, uninterrupted or fit for a particular purpose. Review and test changes before production use. To the maximum extent permitted by applicable law, entrorove excludes indirect, incidental, special and consequential losses. Nothing excludes non-waivable liability, fraud, wilful misconduct or mandatory consumer rights.
 - **Choice.** Declining prevents the skill request from being sent. Material changes require a new explicit acceptance. Mandatory local laws may provide additional rights. Qualified counsel should review this notice before production release for the actual operating and user jurisdictions.

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.24 — 2026-10-07
+
+- 更新已验收能力并完成发布前校验。
+- Updated accepted capabilities and completed release preflight validation.
+
+## 0.1.23 — 2026-10-06
+
+- 修复受管安装漏装能力映射文档的问题；旧安装自动补齐，用户编辑仍受保护。
+- Fixed the missing capability map in managed installations; older installations are repaired while user edits remain protected.
+
 ## 0.1.22 — 2026-10-04
 
 - 完整补齐隔离检测、运行时生成、基线契约、云任务取消与事件流、能力覆盖映射及隐私告知。

package/SKILL.md

@@ -5,7 +5,7 @@ description: An engineering skill that understands a task, chooses a fitting wor
 
 # entrorove · 熵巡
 
-Version: 0.1.22.
+Version: 0.1.24.
 
 Read the user's goal and repository instructions first. Preserve the original task through planning, execution and verification. Use the workflow only where it helps; a small, low-risk edit can proceed directly. Never claim a reported step is a verified result.
 
@@ -13,11 +13,13 @@ Install or update the managed copy with `npx @entrorove/skill install`. The inst
 
 Register or sign in by email at https://entrorove.com. Enter the account key once with `npx @entrorove/skill configure` and `{"token":"..."}` on standard input. The credential persists in the current OS user's restricted local store across skill upgrades. Before asking again, use the stored credential; a missing or invalid credential must be reported explicitly. Never place the key in arguments, URLs, project files or logs. entrorove accounts and keys are independent of other services.
 
-On first use or after a material agreement revision, the CLI returns a Confirm Protocol-compatible agreement interaction. Render it with the IDE's native confirmation UI, or show its `chatFallback` text when no adapter exists. The user must explicitly accept with `npx @entrorove/skill agreement` and JSON `{"version":"2026-10-02.1","answer":"accept"}` on standard input before retrying the skill request. A full-access IDE permission never counts as agreement acceptance. The combined terms, privacy and advertising notice is installed as `AGREEMENT.md`.
+Every invocation rereads that same credential file, including clients already running. After an authenticated account page supplies the current key and `configure` synchronizes it once, all tasks under the same OS user automatically use the new value. A revoked or expired key cannot obtain new permissions for itself: return to the authenticated account page and synchronize once through JSON stdin. Status recovery only queries the original request; it never rotates credentials or repeats the operation.
+
+On first use or after a material agreement revision, the CLI returns a Confirm Protocol-compatible agreement interaction. Render it with the IDE's native confirmation UI, or show its `chatFallback` text when no adapter exists. The user must explicitly accept with `npx @entrorove/skill agreement` and JSON `{"version":"2026-10-07.1","answer":"accept"}` on standard input before retrying the skill request. A full-access IDE permission never counts as agreement acceptance. The combined terms, privacy and advertising notice is installed as `AGREEMENT.md`.
 
 ## Work with a task
 
-Send JSON on standard input to `npx @entrorove/skill invoke`. Call `operation: "capabilities"` with `{}` first when an adapter needs the live operation and schema list. Adapters that expose the four-step task route can call `task-describe`, `message-route`, `message-accept` and `task-resume` in order; `start` remains the one-call workflow equivalent. Then start with `operation: "start"` and an `input.task` containing the goal, work type, risk, difficulty and observed scope facts. Work types are `implementation`, `documentation`, `calculation`, `merge`, `review`, `decision` and `diagnosis`. Assess facts from the real task and repository; do not invent certainty. entrorove chooses the workflow. A small task may return `decision: "direct"`, meaning the IDE should do the work without another service call. The public envelope is `entrorove.skill.request/2.0`; `requestId` is the SHA-256 digest of `operation + canonical(input)`. Version 1.0 remains accepted for older callers.
+Send JSON on standard input to `npx @entrorove/skill invoke`. Before every execution call, discover `operation: "capabilities"` with `{}` and validate input against the returned operation schema. The CLI performs remote discovery automatically; local adapters discover the installed contract before execution. Discovery failure stops execution. Adapters that expose the four-step task route can call `task-describe`, `message-route`, `message-accept` and `task-resume` in order; `start` remains the one-call workflow equivalent. Then start with `operation: "start"` and an `input.task` containing the goal, work type, risk, difficulty and observed scope facts. Work types are `implementation`, `documentation`, `calculation`, `merge`, `review`, `decision` and `diagnosis`. Assess facts from the real task and repository; do not invent certainty. entrorove chooses the workflow. A small task may return `decision: "direct"`, meaning the IDE should do the work without another service call. The public envelope is `entrorove.skill.request/2.0`; `requestId` is the SHA-256 digest of `operation + canonical(input)`. Version 1.0 remains accepted for older callers.
 
 ```json
 {"operation":"start","input":{"task":{"goal":"Update the checkout flow and verify it","workType":"implementation","risk":"medium","difficulty":"medium","crossModule":true,"parallel":false,"unclear":false,"architectureContract":false}}}
@@ -37,4 +39,10 @@ Use `npx @entrorove/skill status <requestId>` after a connection loss. It perfor
 
 The local execution layer is available through `npx @entrorove/skill local <operation> [repositoryRoot]` with a JSON object on standard input. `local capabilities` lists the complete contract. Operations include `snapshot-plan`, `snapshot-verify`, `mutate-gate`, `gate-issue`, `gate-verify`, `guarded-write`, `budget-init`, `budget-context`, `budget-read`, `budget-status`, `budget-extend`, budget renewal confirmation, `peer-coordinate`, `spawn-bind`, `peer-complete`, `lease-verify`, `probe`, `reassess`, execution ledger and virtual branch records, `chain-init`, `chain-resume`, `chain-status`, `chain-answer`, `evidence-sign`, `evidence-verify`, `merge-verified`, `rollback`, `formula-evaluate`, `formula-graph`, `formula-final-gate`, `run-approved-plan` and `final-gate`. State is kept only under `~/.entrorove/`; snapshots never create Git branches or worktrees. Guarded writes require a short-lived Ed25519 pass bound to the flow, step, snapshot digest and path set. Local evidence uses `entrorove.test-evidence/2.0`; unsigned local evidence remains incomplete and verified delivery requires a trusted receipt. Approved plan execution requires a frozen plan, matching approval and unchanged files; without a configured runner signer it reports local evidence as incomplete.
 
-When the user gives an actual evaluation after using the skill, offer to publish that feedback. Only after they explicitly agree to public display, send their own words, IDE name and 1–5 rating as JSON on standard input to `npx @entrorove/skill review` with `publicConsent: true`. Never invent, rewrite or infer a review from task completion. The website reads accepted reviews directly from entrorove's independent database.
+When the user gives an actual evaluation after using the skill, offer to publish that feedback. Only after they explicitly agree to public display under the current notice, send their unchanged words, IDE name and 1–5 rating as JSON on standard input to `npx @entrorove/skill review`, including `invocationRequestId` from their actual successful call, `publicConsent: true` and `noticeVersion: "2026-10-07.1"`. The same account must own that successful call within the last 30 days; a recorded usage event, failed call or unknown result does not qualify. Three public reviews per account per day share one server quota across API replicas. Public output exposes only IDE, rating, original text and time, never account or invocation identity. Never invent, rewrite or infer a review from task completion. The website reads accepted reviews directly from entrorove's independent database.
+
+Feedback command example (replace the request ID with the original successful invocation ID, and use only the user’s actual words after explicit public consent):
+
+```json
+{"invocationRequestId":"<original successful request ID>","ide":"Codex","rating":5,"comment":"<unchanged user words>","publicConsent":true,"noticeVersion":"2026-10-07.1"}
+```

package/archguard-runtime-build.mjs

@@ -0,0 +1,15 @@
+import { createHash } from 'node:crypto';
+import { readFile, writeFile, mkdir } from 'node:fs/promises';
+const file = 'archguard-runtime-v7.0.44.mjs';
+const expected = '836f20b270139371bef43e3934fa7232371e42d46371c513db2a5e3c5622b215';
+const source = await readFile(new URL(`../../assets/runtime-source/${file}`, import.meta.url));
+if (createHash('sha256').update(source).digest('hex') !== expected) throw new Error('Archguard pinned generation source digest mismatch');
+const target = new URL(`./runtime/${file}`, import.meta.url);
+if (process.argv.includes('--check')) {
+  const actual = await readFile(target);
+  if (!source.equals(actual)) throw new Error('Packaged Archguard runtime differs from its pinned first-party generation source');
+} else {
+  await mkdir(new URL('./runtime/', import.meta.url), { recursive: true });
+  await writeFile(target, source);
+}
+process.stdout.write(`${file} ${expected}\n`);

package/blueprint-criterion-runner.mjs

@@ -0,0 +1,110 @@
+import { sign } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { canonical, sha256 as sha } from './local-integrity.mjs';
+import { withStateLock } from './local-state-lock.mjs';
+import { atomic, json, context } from './local-task-handoff-storage.mjs';
+import { loadTaskHandoffSigner } from './local-task-handoff-observation.mjs';
+import { consumeTaskHandoffExecutionAuthority, beginTaskHandoffExecution, finishTaskHandoffExecution,
+  readTaskHandoffFence, withTaskHandoffWriteFence } from './local-task-handoff-fence.mjs';
+import { runApprovedPlanObject } from './local-approved-plan.mjs';
+import { verifyBlueprintCriterionAttempt, blueprintCriterionSubject } from './blueprint-criterion-wire.mjs';
+
+function fail(message) { throw Object.assign(new Error(message), { code: 'ENTROROVE_BLUEPRINT_CRITERION_STATE' }); }
+async function prepare(input, allowExpired = false) {
+  verifyBlueprintCriterionAttempt(input.attempt, allowExpired);
+  const ctx = await context({ repositoryRoot: input.repositoryRoot, home: input.home, flowId: input.attempt.flowId }, true);
+  if (ctx.repo !== input.attempt.localRepositoryDigest) fail('criterion repository differs from its actual signed runner identity');
+  const home = await fs.realpath(ctx.home), directory = path.join(home, '.entrorove', 'blueprint-criterion', ctx.repo, ctx.flowId, input.attempt.attemptId);
+  let current = home;
+  for (const part of path.relative(home, directory).split(path.sep)) {
+    current = path.join(current, part);
+    try { await fs.mkdir(current, { mode: 0o700 }); } catch (error) { if (error.code !== 'EEXIST') throw error; }
+    const value = await fs.lstat(current);
+    if (!value.isDirectory() || value.isSymbolicLink() || (value.mode & 0o077)
+      || (typeof process.getuid === 'function' && value.uid !== process.getuid())) fail('criterion state requires its real original owned private execution home');
+  }
+  return { ...ctx, home, file: path.join(directory, 'state.json'), attempt: input.attempt };
+}
+async function read(ctx) {
+  let state; try { state = await json(ctx.file, 8 * 1024 * 1024); }
+  catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+  const stat = await fs.lstat(ctx.file);
+  if ((stat.mode & 0o777) !== 0o600 || stat.nlink !== 1 || (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+    || state.schemaVersion !== 'entrorove.blueprint-criterion-local-state/1.0' || state.attemptDigest !== sha(canonical(ctx.attempt))
+    || state.attemptId !== ctx.attempt.attemptId || state.executionHome !== ctx.home || state.flowId !== ctx.flowId
+    || state.originalBusinessStepId !== ctx.attempt.originalBusinessStepId) fail('criterion local state lost its original signed attempt or execution home');
+  if (state.result && state.resultDigest !== sha(canonical(state.result))) fail('criterion actual result digest is invalid');
+  return state;
+}
+export async function consumeBlueprintCriterionExecutionAuthority(input) {
+  const ctx = await prepare(input), attempt = ctx.attempt;
+  return consumeTaskHandoffExecutionAuthority({ repositoryRoot: ctx.root, home: ctx.home, flowId: ctx.flowId,
+    taskId: attempt.taskId, leaseId: attempt.lease.leaseId, generation: 1, attemptNonce: attempt.lease.attemptNonce,
+    authority: attempt.executionAuthority });
+}
+async function claim(ctx) {
+  return withStateLock(ctx.file, async () => {
+    const prior = await read(ctx);
+    if (prior) {
+      if (!['reported', 'failed'].includes(prior.status) || !prior.result) fail('criterion result is running or unknown; reconcile it without a new process');
+      return { ...structuredClone(prior.result), cached: true };
+    }
+    verifyBlueprintCriterionAttempt(ctx.attempt);
+    await atomic(ctx.file, { schemaVersion: 'entrorove.blueprint-criterion-local-state/1.0', attemptId: ctx.attempt.attemptId,
+      attemptDigest: sha(canonical(ctx.attempt)), executionHome: ctx.home, flowId: ctx.flowId,
+      originalBusinessStepId: ctx.attempt.originalBusinessStepId, status: 'running', pid: process.pid,
+      startedAt: new Date().toISOString(), finishedAt: null, result: null, resultDigest: null });
+    return null;
+  });
+}
+function signedResult(ctx, execution, signer) {
+  const attempt = ctx.attempt, processResult = { ...execution.process, spawned: execution.process.started === true,
+    executable: attempt.executionPlan.policy.executable, args: attempt.executionPlan.policy.args };
+  if (!Number.isInteger(processResult.exitCode) || !processResult.spawned) fail('criterion actual process outcome is interrupted or unknown');
+  const evidence = { schemaVersion: 'entrorove.test-evidence/2.0', evidenceId: attempt.evidenceId, kind: 'test', runner: 'trusted-runner',
+    command: attempt.command, artifactSha256: attempt.artifactSha256, exitCode: processResult.exitCode,
+    durationMs: processResult.durationMs, summary: processResult.stdout.trim().slice(0, 4_000) || `Actual criterion exited ${processResult.exitCode}` };
+  const subject = blueprintCriterionSubject(attempt, evidence, processResult), issuedAt = new Date().toISOString();
+  const core = { schemaVersion: 'validator.execution-receipt/1.0', keyId: attempt.runnerKeyId, subjectDigest: sha(canonical(subject)),
+    nonce: attempt.lease.attemptNonce, issuedAt, expiresAt: new Date(Date.now() + signer.config.receiptTtlMs).toISOString(),
+    result: { runner: 'trusted-runner', passed: processResult.exitCode === 0 && processResult.status === 'succeeded',
+      exitCode: processResult.exitCode, durationMs: evidence.durationMs, summary: evidence.summary } };
+  const receipt = { ...core, signature: sign(null, Buffer.from(canonical(core)), signer.privateKey).toString('base64url') };
+  return { status: core.result.passed ? 'reported' : 'failed', cached: false, process: processResult,
+    evidence: { ...evidence, subject, subjectDigest: core.subjectDigest, receipt } };
+}
+async function finalize(ctx, result) {
+  return withStateLock(ctx.file, async () => {
+    const state = await read(ctx);
+    if (state?.status !== 'running' || state.pid !== process.pid) fail('criterion actual running ownership changed');
+    await atomic(ctx.file, { ...state, status: result.status, finishedAt: result.process.finishedAt,
+      result, resultDigest: sha(canonical(result)) });
+    return result;
+  });
+}
+export async function runBlueprintCriterionAttempt(input) {
+  const ctx = await prepare(input, true), attempt = ctx.attempt;
+  const original = { repositoryRoot: ctx.root, home: ctx.home, flowId: ctx.flowId };
+  const fence = { ...original, epoch: (await readTaskHandoffFence(original)).epoch, leaseId: attempt.lease.leaseId };
+  const cached = await withTaskHandoffWriteFence(fence, () => claim(ctx));
+  if (cached) return cached;
+  let activity;
+  try {
+    activity = await beginTaskHandoffExecution({ ...fence, stepId: attempt.criterionStepId, generation: 1,
+      attemptNonce: attempt.lease.attemptNonce, executionId: `criterion-run-${attempt.attemptId}` });
+    if (canonical(activity.authority) !== canonical(attempt.executionAuthority)) fail('criterion running authority differs from its formal server attempt');
+    const signer = await loadTaskHandoffSigner(ctx, input.signerConfigPath, attempt.runnerKeyId);
+    const execution = await runApprovedPlanObject({ repositoryRoot: ctx.root, executionPlan: attempt.executionPlan,
+      approvalPath: input.approvalPath, signerConfigPath: input.signerConfigPath,
+      executionDeadlineAt: attempt.expiresAt });
+    // The approved runner checks this signed deadline immediately before its actual spawn, after all control/manifest IO.
+    return await finalize(ctx, signedResult(ctx, execution, signer));
+  } catch (error) {
+    await withStateLock(ctx.file, async () => {
+      const state = await read(ctx);
+      if (state?.status === 'running' && state.pid === process.pid) await atomic(ctx.file, { ...state, status: 'unknown' });
+    });
+    throw error;
+  } finally { if (activity) await finishTaskHandoffExecution({ ...fence, ...activity }); }
+}

package/blueprint-criterion-wire.mjs

@@ -0,0 +1,78 @@
+import { createPublicKey, verify } from 'node:crypto';
+import { canonical, sha256 as sha } from './local-integrity.mjs';
+
+const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const SHA = /^[a-f0-9]{64}$/;
+const FIELDS = ['schemaVersion', 'attemptId', 'flowId', 'blueprintSha256', 'compilationReceiptDigest', 'compilationReceiptRevision',
+  'planDigest', 'scopeArtifactDigest', 'criterionId', 'taskRef', 'ownerId', 'taskId', 'taskDigest', 'chainDigest', 'chainRevision',
+  'blueprintId', 'blueprintRevision', 'nodeRefs', 'criterionStepId', 'originalBusinessStepId', 'businessEvidenceDigest',
+  'businessVerifiedAt', 'runnerKeyId', 'localRepositoryDigest', 'executionPlan', 'executionPlanSha256', 'command',
+  'artifactSha256', 'verifiedDependencies', 'evidenceId', 'lease', 'executionAuthority', 'issuedAt', 'expiresAt'];
+function fail(message) { throw Object.assign(new Error(message), { code: 'ENTROROVE_BLUEPRINT_CRITERION_AUTHORITY' }); }
+function exact(value, fields) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || Object.keys(value).sort().join('|') !== [...fields].sort().join('|')) fail('criterion authority has invalid exact fields');
+  return value;
+}
+function signed(value, fields) {
+  const { authorityReceipt: receipt, ...body } = exact(value, [...fields, 'authorityReceipt']);
+  exact(receipt, ['schemaVersion', 'keyId', 'payloadDigest', 'signature']);
+  const encoded = process.env.ENTROROVE_WORKFLOW_PLAN_PUBLIC_KEY, bytes = Buffer.from(encoded ?? '', 'base64');
+  let key; try { key = createPublicKey({ key: bytes, type: 'spki', format: 'der' }); } catch { fail('criterion cloud verification key is unavailable'); }
+  const signature = Buffer.from(receipt.signature ?? '', 'base64url');
+  if (key.asymmetricKeyType !== 'ed25519' || key.export({ type: 'spki', format: 'der' }).toString('base64') !== encoded
+    || receipt.schemaVersion !== 'entrorove.workflow-authority-receipt/1.0' || receipt.keyId !== sha(bytes)
+    || receipt.payloadDigest !== sha(canonical(body)) || signature.length !== 64 || signature.toString('base64url') !== receipt.signature
+    || !verify(null, Buffer.from(canonical(body)), key, signature)) fail('criterion cloud signature or exact binding is invalid');
+  return body;
+}
+export function verifyBlueprintCriterionAttempt(attempt, allowExpired = false) {
+  const fields = Object.hasOwn(attempt ?? {}, 'retryOf') ? [...FIELDS, 'retryOf'] : FIELDS;
+  const body = signed(attempt, fields), lease = exact(body.lease, ['leaseId', 'generation', 'attemptNonce', 'epoch', 'issuedAt', 'expiresAt']);
+  const authority = signed(body.executionAuthority, ['schemaVersion', 'authorityId', 'attemptNonce', 'taskId', 'flowId', 'ownerId',
+    'taskDigest', 'chainDigest', 'leaseId', 'generation', 'epoch', 'status', 'runnerKeyId', 'localRepositoryDigest', 'issuedAt', 'expiresAt']);
+  for (const field of ['attemptId', 'flowId', 'criterionId', 'taskRef', 'ownerId', 'taskId', 'blueprintId', 'criterionStepId',
+    'originalBusinessStepId', 'evidenceId']) if (!ID.test(body[field] ?? '')) fail('criterion identifier is invalid');
+  for (const field of ['compilationReceiptDigest', 'planDigest', 'scopeArtifactDigest', 'taskDigest', 'chainDigest',
+    'businessEvidenceDigest', 'runnerKeyId', 'executionPlanSha256', 'artifactSha256']) if (!SHA.test(body[field] ?? '')) fail('criterion digest is invalid');
+  if (Object.hasOwn(body, 'retryOf')) {
+    const prior = exact(body.retryOf, ['attemptId', 'attemptDigest', 'resultDigest', 'verifiedAt']);
+    if (!ID.test(prior.attemptId ?? '') || prior.attemptId === body.attemptId || !SHA.test(prior.attemptDigest ?? '')
+      || !SHA.test(prior.resultDigest ?? '') || !Number.isFinite(Date.parse(prior.verifiedAt))
+      || Date.parse(prior.verifiedAt) >= Date.parse(body.issuedAt)) fail('criterion retry lost its immutable failed predecessor binding');
+  }
+  const issued = Date.parse(body.issuedAt), expires = Date.parse(body.expiresAt), verified = Date.parse(body.businessVerifiedAt);
+  const command = [body.executionPlan.policy.executable, ...body.executionPlan.policy.args].map(value => JSON.stringify(value)).join(' ');
+  const manifest = sha(`validator.file-manifest/1.0\n${body.executionPlan.files.map(file => `${file.path}\0${file.sha256}`).join('\n')}`);
+  if (body.schemaVersion !== 'entrorove.blueprint-criterion-attempt/1.0' || authority.schemaVersion !== 'entrorove.task-execution-epoch-authority/1.0'
+    || authority.status !== 'active' || !/^sha256:[a-f0-9]{64}$/.test(body.blueprintSha256) || !Number.isFinite(verified)
+    || !Number.isFinite(issued) || !Number.isFinite(expires) || issued <= verified || issued > Date.now() || expires <= issued
+    || expires - issued > 30_000 || (!allowExpired && expires <= Date.now()) || lease.generation !== 1
+    || !Number.isSafeInteger(lease.epoch) || lease.epoch < 0
+    || body.command !== command || body.artifactSha256 !== manifest || body.executionPlan.artifactSha256 !== manifest
+    || body.executionPlanSha256 !== sha(canonical(body.executionPlan) + '\n') || body.evidenceId !== `criterion:${body.attemptId}`
+    || ['flowId', 'ownerId', 'taskId', 'taskDigest', 'chainDigest', 'runnerKeyId', 'localRepositoryDigest', 'issuedAt', 'expiresAt']
+      .some(field => authority[field] !== body[field])
+    || ['leaseId', 'generation', 'attemptNonce', 'epoch', 'issuedAt', 'expiresAt'].some(field => authority[field] !== lease[field])) {
+    fail('criterion attempt changed its real independent lease, verified original business step or frozen command/manifest');
+  }
+  return body;
+}
+export function blueprintCriterionExecutionBinding(attempt, processResult) {
+  return { schemaVersion: 'entrorove.blueprint-criterion-execution/1.0', attemptId: attempt.attemptId,
+    attemptDigest: sha(canonical(attempt)), executionAuthorityDigest: sha(canonical(attempt.executionAuthority)),
+    leaseId: attempt.lease.leaseId, generation: 1, attemptNonce: attempt.lease.attemptNonce,
+    ownerId: attempt.ownerId, taskId: attempt.taskId, taskDigest: attempt.taskDigest, chainDigest: attempt.chainDigest,
+    planDigest: attempt.planDigest, taskRef: attempt.taskRef, originalBusinessStepId: attempt.originalBusinessStepId,
+    businessEvidenceDigest: attempt.businessEvidenceDigest, businessVerifiedAt: attempt.businessVerifiedAt,
+    executionPlanSha256: attempt.executionPlanSha256, manifestDigest: attempt.artifactSha256,
+    verifiedDependencies: attempt.verifiedDependencies, processResultSha256: sha(canonical(processResult)),
+    executionStartedAt: processResult.startedAt, executionFinishedAt: processResult.finishedAt };
+}
+export function blueprintCriterionSubject(attempt, evidence, processResult) {
+  return { schemaVersion: 'entrorove.blueprint-acceptance-subject/1.1', flowId: attempt.flowId, stepId: attempt.criterionStepId,
+    blueprintId: attempt.blueprintId, revision: attempt.blueprintRevision, blueprintSha256: attempt.blueprintSha256,
+    criterionId: attempt.criterionId, nodeRefs: [...attempt.nodeRefs].sort(), evidenceId: evidence.evidenceId,
+    kind: evidence.kind, artifactSha256: evidence.artifactSha256, policy: { command: evidence.command, requiredExitCode: 0,
+      criterionExecution: blueprintCriterionExecutionBinding(attempt, processResult) } };
+}

package/calctool-runtime-build.mjs

@@ -0,0 +1,59 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { readFile, writeFile, mkdir, rename, rm } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const directory = dirname(fileURLToPath(import.meta.url));
+const file = 'calctool-runtime-v7.0.43.mjs';
+const pinnedSha256 = '74571381daa3426547d2a19c7f61fce1895163f5d1c4e6b5c451197d9aec823b';
+const modules = ['local-decimal.mjs', 'local-formula-ast.mjs', 'local-formula-engine.mjs', 'local-formula-tests.mjs', 'calctool-runtime-entry.mjs'];
+const sha = bytes => createHash('sha256').update(bytes).digest('hex');
+function isolated(source) {
+  if (/cli[._-]?tax/i.test(source)) throw new Error('Calctool generation contains forbidden external coupling');
+}
+function bundle(source, name) {
+  if (source.split('\n').length > 501) throw new Error(`Calctool first-party source exceeds 500 lines: ${name}`);
+  const withoutImports = source.replace(/^import\s+[^;]+;\n/gm, '');
+  if (/^\s*import\s/m.test(withoutImports)) throw new Error(`Calctool source has an unsupported import: ${name}`);
+  return withoutImports.replace(/^export /gm, '').trim();
+}
+async function sourceContent() {
+  const pinned = await readFile(resolve(directory, '../../assets/runtime-source', file), 'utf8');
+  if (sha(pinned) !== pinnedSha256) throw new Error('Calctool pinned generation source digest mismatch');
+  isolated(pinned);
+  const core = pinned.replace(/^import\s+[^;]+;\n/gm, '').replace(/^export \{\n[\s\S]*?^\}\s*;?\n/gm, '')
+    .replace(/^export \{[^\n]+\};\n/gm, '').replace(/^export async function run/m, 'async function run');
+  if (/^export /m.test(core)) throw new Error('Calctool pinned core export boundary changed');
+  const parts = [];
+  for (const name of modules) {
+    const source = await readFile(resolve(directory, name), 'utf8'); isolated(source); parts.push(bundle(source, name));
+  }
+  return '// Generated by calctool-runtime-build.mjs from the pinned Calctool snapshot and first-party formula modules.\n'
+    + "import { createHash } from 'node:crypto';\nimport { existsSync } from 'node:fs';\nimport { join } from 'node:path';\n"
+    + 'const calctoolCore = (() => {\n' + core + '\nreturn { run, validateRequest, blockedResponse, validateRunPlan, mergeSwarmArtifacts, decomposeRequirementsToRunPlan, readyTasks, probeEnvironment, adaptEnvironment };\n})();\n\n'
+    + parts.join('\n\n') + '\n\nexport const run = createCalctoolEntrypoint(calctoolCore);\n'
+    + 'export const runLocalCore = (operation, input) => runCalctoolCoreOperation(calctoolCore, operation, input);\n'
+    + 'export const probeLocalEnvironment = calctoolCore.probeEnvironment;\nexport const adaptLocalEnvironment = calctoolCore.adaptEnvironment;\n'
+    + 'export const evaluateCompiledProgram = evaluateFormulaProgram;\nexport const verifyCompiledProgram = verifyFormulaTests;\n';
+}
+export async function buildCalctoolRuntime({ outputPath = resolve(directory, 'runtime', file), checkOnly = false } = {}) {
+  const destination = resolve(outputPath);
+  if (destination === resolve(directory, '../../assets/runtime-source', file) || destination === fileURLToPath(import.meta.url)) throw new Error('Calctool generator cannot overwrite its pinned source');
+  const content = await sourceContent(); isolated(content);
+  if (checkOnly) {
+    const current = await readFile(destination);
+    if (!current.equals(Buffer.from(content))) throw new Error('Generated Calctool runtime is stale');
+  } else {
+    await mkdir(dirname(destination), { recursive: true }); const temporary = `${destination}.tmp-${randomUUID()}`;
+    try { await writeFile(temporary, content, { flag: 'wx', mode: 0o644 }); await rename(temporary, destination); }
+    finally { await rm(temporary, { force: true }); }
+  }
+  return { outputPath: destination, sha256: sha(content), bytes: Buffer.byteLength(content), pinnedSha256, firstPartyModules: modules };
+}
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const args = process.argv.slice(2); const checkOnly = args.includes('--check');
+  const outputIndex = args.indexOf('--output'); const outputPath = outputIndex >= 0 ? args[outputIndex + 1] : undefined;
+  if (args.some((arg, index) => arg !== '--check' && arg !== '--output' && index !== outputIndex + 1) || (outputIndex >= 0 && !outputPath)) throw new Error('Invalid Calctool generator arguments');
+  try { process.stdout.write(JSON.stringify(await buildCalctoolRuntime({ outputPath, checkOnly })) + '\n'); }
+  catch (cause) { process.stderr.write(cause.message + '\n'); process.exitCode = 1; }
+}

package/calctool-runtime-entry.mjs

@@ -0,0 +1,92 @@
+import { buildFormulaEngine, compileFormulaEngine, validateFormulaEngine, formulaDigest } from './local-formula-engine.mjs';
+import { formulaError } from './local-decimal.mjs';
+import { FORMULA_OPERATORS } from './local-formula-ast.mjs';
+
+const CLOUD_OPERATIONS = ['capabilities', 'help', 'intake', 'validate', 'compile-inline'];
+const LOCAL_OPERATIONS = ['run', 'compile', 'generate', 'verify', 'estimate', 'impact', 'status', 'inventory', 'purge',
+  'brain-handshake', 'brain-invoke', 'brain-events', 'brain-cancel', 'brain-complete', 'brain-resume', 'brain-status',
+  'probe-env', 'adapt-config', 'intake-round', 'compile-tool', 'blueprint-orchestrate', 'auto-pipeline', 'final-gate', 'swarm-orchestrate'];
+function failure(request, cause) {
+  return { schemaVersion: 'calctool.skill.response/1.0', requestId: request?.requestId ?? 'unknown', status: 'blocked',
+    validation: { valid: false, guarantee: 'blocked', findings: [{ severity: 'P0', ruleId: cause.code ?? 'FORMULA_INVALID', entityRef: 'input', message: cause.message }] } };
+}
+function compiled(request, engine) {
+  const program = compileFormulaEngine(engine);
+  return { schemaVersion: 'calctool.skill.response/1.0', requestId: request.requestId, status: 'succeeded', state: 'reported',
+    revision: program.engineVersion, engine: program.engine, program,
+    validation: { valid: true, guarantee: 'formula-compiled', findings: [] },
+    artifacts: [{ path: `${program.engineId}/engine.json`, kind: 'engine-definition', engineId: program.engineId,
+      engineVersion: program.engineVersion, digest: program.engineDigest },
+    { path: `${program.engineId}/program.json`, kind: 'formula-program', engineId: program.engineId,
+      engineVersion: program.engineVersion, runtimeVersion: program.runtimeVersion, digest: program.programDigest }],
+    nextStep: { operation: 'calctool-verify', instruction: 'Execute the compiled engine benchmark samples locally, then submit bound evidence to the independent validator.' } };
+}
+export function createCalctoolEntrypoint(core) {
+  return async function run(request, options = {}) {
+    const requestFindings = core.validateRequest(request);
+    if (requestFindings.length) return core.blockedResponse(request?.requestId ?? 'unknown', request, requestFindings);
+    try {
+      if (request.operation === 'capabilities') {
+        const output = await core.run(request, options);
+        return { ...output, capabilities: { ...output.capabilities, operations: CLOUD_OPERATIONS, localRunnerOperations: LOCAL_OPERATIONS,
+          formulaOperators: FORMULA_OPERATORS, engineSchema: 'engine.spec/1', formulaRuntime: 'decimal28-ast/1.0',
+          decimalPolicy: { precision: 28, rounding: 'half-away-from-zero', representation: 'decimal-string' } },
+          localRunner: { command: 'entrorove local calctool-<operation>', requiredFor: LOCAL_OPERATIONS } };
+      }
+      if (request.operation === 'validate') {
+        const findings = validateFormulaEngine(request.input?.engine);
+        if (findings.length) return core.blockedResponse(request.requestId, request, findings);
+        return { schemaVersion: 'calctool.skill.response/1.0', requestId: request.requestId, status: 'succeeded', state: 'reported',
+          validation: { valid: true, guarantee: 'formula-definition-valid', findings: [] } };
+      }
+      if (request.operation === 'compile-inline') return compiled(request, buildFormulaEngine(request.input?.requirements));
+      if (LOCAL_OPERATIONS.includes(request.operation)) return { schemaVersion: 'calctool.skill.response/1.0', requestId: request.requestId,
+        status: 'incomplete', validation: { valid: false, guarantee: 'local-runner-required', findings: [] },
+        localRunner: { required: true, operation: `calctool-${request.operation}`, command: `entrorove local calctool-${request.operation}` } };
+      return core.run(request, options);
+    } catch (cause) { return failure(request, cause); }
+  };
+}
+
+function resumeCalctoolRun(core, request) {
+  const input = request.input; const plan = input.runPlan;
+  const errors = core.validateRunPlan(plan);
+  if (errors.length) throw formulaError('RUN_PLAN_INVALID', errors.join('; '));
+  const known = new Set(plan.tasks.map(task => task.workItemId)); const seen = new Set();
+  const groups = ['completedWorkItemIds', 'inFlightWorkItemIds', 'uncertainWorkItemIds'].map(field => {
+    const ids = input[field] ?? [];
+    if (!Array.isArray(ids)) throw formulaError('RUN_RESUME_INVALID', 'resume checkpoints must contain work item arrays');
+    for (const id of ids) {
+      if (!known.has(id) || seen.has(id)) throw formulaError('RUN_RESUME_INVALID', 'resume checkpoint contains an unknown, duplicate or conflicting work item');
+      seen.add(id);
+    }
+    return new Set(ids);
+  });
+  const [completed, inFlight, uncertain] = groups;
+  for (const task of plan.tasks) if ((completed.has(task.workItemId) || inFlight.has(task.workItemId))
+    && task.dependsOn.some(id => !completed.has(id))) throw formulaError('RUN_RESUME_INVALID', 'completed or executing work items require completed dependencies');
+  const availableSlots = Math.max(0, plan.limits.maxParallel - inFlight.size - uncertain.size);
+  const ready = uncertain.size ? [] : core.readyTasks(plan, completed).filter(task => !inFlight.has(task.workItemId));
+  const dispatchable = ready.slice(0, Math.min(availableSlots, plan.limits.maxReadyPageSize));
+  const ordered = group => plan.tasks.filter(task => group.has(task.workItemId)).map(task => task.workItemId);
+  const checkpoint = { completedWorkItemIds: ordered(completed), inFlightWorkItemIds: ordered(inFlight), uncertainWorkItemIds: ordered(uncertain) };
+  const remaining = plan.tasks.filter(task => !completed.has(task.workItemId));
+  return { schemaVersion: 'calctool.skill.response/1.0', requestId: request.requestId, status: uncertain.size ? 'incomplete' : 'reported',
+    resumed: true, executed: false, runPlan: plan, runPlanRef: plan.runId, resumeDigest: formulaDigest({ runPlan: plan, checkpoint }), checkpoint,
+    completedWorkItems: checkpoint.completedWorkItemIds, readyNow: dispatchable.map(task => task.workItemId), remaining: remaining.length,
+    pendingWorkItems: remaining, dispatch: { maxParallel: plan.limits.maxParallel, availableSlots, readyNow: dispatchable },
+    reconciliation: { required: uncertain.size > 0, workItemIds: checkpoint.uncertainWorkItemIds },
+    nextStep: remaining.length === 0 ? { operation: 'brain-complete', instruction: 'Merge the original run artifacts.' }
+      : uncertain.size ? { operation: 'brain-events', instruction: 'Reconcile original work item results before dispatching any continuation.' }
+        : { operation: 'brain-events', instruction: 'Continue only the returned dispatch tasks in the original run and record their results.' } };
+}
+export async function runCalctoolCoreOperation(core, operation, input) {
+  const request = { schemaVersion: 'calctool.skill.request/1.0', requestId: 'local-calctool', operation, input };
+  if (operation === 'brain-resume') return resumeCalctoolRun(core, request);
+  if (operation === 'brain-complete') {
+    const errors = core.validateRunPlan(input.runPlan);
+    if (errors.length) return core.blockedResponse(request.requestId, request, errors.map(message => ({ severity: 'P0', ruleId: 'RUN_PLAN_INVALID', entityRef: 'input.runPlan', message })));
+    return compiled(request, core.mergeSwarmArtifacts(input.runPlan, input.artifacts));
+  }
+  return core.run(request);
+}