@entrorove/skill 0.1.23 → 0.1.25

package/local-contracts.mjs

@@ -0,0 +1,126 @@
+import { FINAL_GATE16_INPUT_SCHEMA, FINAL_GATE16_READ_INPUT_SCHEMA } from './local-final-gate16-contract.mjs';
+import { SWARM_LOCAL_OPERATION_SCHEMAS } from './local-swarm-contracts.mjs';
+import Ajv from 'ajv';
+import { CALCTOOL_LOCAL_OPERATION_SCHEMAS } from './local-calctool-contracts.mjs';
+import { HANDOFF_BUDGET_INIT_PROPERTIES, HANDOFF_BUDGET_INIT_CONDITION, handoffBudgetOperationSchema } from './local-budget-handoff-contracts.mjs';
+import { ARCHGUARD_LOCAL_OPERATION_SCHEMAS } from './local-archguard-contracts.mjs';
+import { MERGE_LOCAL_OPERATION_SCHEMAS } from './local-merge-contracts.mjs';
+import { WORKFLOW_LOCAL_OPERATION_SCHEMA } from './workflow-local-contracts.mjs';
+import { HANDOFF_WRITE_PASS_SCHEMA, HANDOFF_PROVISIONAL_LEASE_SCHEMA, HANDOFF_SNAPSHOT_CANDIDATE_SCHEMA } from './local-task-handoff-contracts.mjs';
+import { LOCAL_CHAIN_OPERATION_SCHEMAS } from './local-chain-contracts.mjs';
+import { array, binding, change, confirmation, enumeration, evidence, evidenceArray, executionContext, executionPlan,
+  formula, formulaDefinitions, formulaEntry, decimalValues, identifier, integer, ledgerIdentifier, modes, nullable, object, paths, record, relativePath, sha256, text } from './local-contract-types.mjs';
+
+const schemas = {};
+const base = { repositoryRoot: text, home: text };
+const flow = { ...base, flowId: identifier };
+const step = { ...flow, stepId: identifier };
+function add(names, properties, required = [], alternatives) {
+  const schema = object(properties, required);
+  if (JSON.stringify(properties).includes('#/$defs/formula')) schema.$defs = formulaDefinitions;
+  if (alternatives) schema.anyOf = alternatives.map(field => ({ required: [field] }));
+  for (const name of names.split('|')) schemas[name] = schema;
+}
+add('capabilities|help', {});
+add('snapshot-plan', { ...step, paths, snapshotId: identifier, contractDigest: nullable(sha256), handoffCandidate: HANDOFF_SNAPSHOT_CANDIDATE_SCHEMA }, ['repositoryRoot', 'flowId', 'stepId', 'paths']);
+add('snapshot-verify', { ...step, snapshotId: identifier }, ['repositoryRoot', 'flowId', 'stepId', 'snapshotId']);
+const gate = { ...step, taskId: identifier, mutationPass: record };
+add('mutate-gate|gate-issue', gate, ['repositoryRoot', 'flowId', 'stepId', 'mutationPass']);
+add('mutation-snapshot-attest', { ...step, taskId: identifier, snapshotId: identifier, challenge: record, signerConfigPath: text },
+  ['repositoryRoot', 'flowId', 'stepId', 'snapshotId', 'challenge', 'signerConfigPath']);
+const write = { ...step, taskId: identifier, generation: integer(1), executionAttemptNonce: identifier, gatePassPath: text, targetPath: relativePath, workerId: identifier, leaseId: identifier };
+add('gate-verify', write, ['repositoryRoot', 'flowId', 'stepId', 'gatePassPath', 'targetPath']);
+add('guarded-write', { ...write, content: {}, expectedSha256: nullable(sha256) }, ['repositoryRoot', 'flowId', 'stepId', 'gatePassPath', 'targetPath', 'content']);
+schemas['guarded-write'] = { oneOf: [schemas['guarded-write'], object({ ...step, targetPath: relativePath, content: {},
+  expectedSha256: nullable(sha256), handoffId: ledgerIdentifier, epoch: integer(1, 2147483647),
+  handoffPass: HANDOFF_WRITE_PASS_SCHEMA, provisionalLease: HANDOFF_PROVISIONAL_LEASE_SCHEMA },
+['repositoryRoot', 'flowId', 'stepId', 'targetPath', 'content', 'handoffId', 'epoch', 'handoffPass', 'provisionalLease'])] };
+add('budget-init', { ...flow, mode: modes, executionContext, grant: record, ...HANDOFF_BUDGET_INIT_PROPERTIES }, ['repositoryRoot', 'flowId', 'mode', 'executionContext']);
+schemas['budget-init'].allOf = [{ if: { type: 'object', properties: { executionContext: { type: 'object', properties: { executionIsolation: { const: 'sandbox' } }, required: ['executionIsolation'] } }, required: ['executionContext'] }, then: { type: 'object', required: ['grant'] } }];
+schemas['budget-init'].allOf.push(HANDOFF_BUDGET_INIT_CONDITION);
+schemas['budget-handoff'] = handoffBudgetOperationSchema(flow, modes, executionContext);
+add('budget-context', { ...flow, executionContext }, ['repositoryRoot', 'flowId', 'executionContext']);
+add('budget-read', { ...flow, path: relativePath }, ['repositoryRoot', 'flowId', 'path']);
+add('budget-status', flow, ['repositoryRoot', 'flowId']);
+add('budget-extend', { ...flow, confirmation, grant: record, additions: object({ files: integer(0), tokenEstimate: integer(0), durationMs: integer(0) }, ['files', 'tokenEstimate', 'durationMs']) }, ['repositoryRoot', 'flowId', 'additions'], ['grant', 'confirmation']);
+add('budget-transition', { ...flow, grant: record }, ['repositoryRoot', 'flowId', 'grant']);
+schemas['budget-extend'].properties.additions.anyOf = ['files', 'tokenEstimate', 'durationMs'].map(field => ({ type: 'object', properties: { [field]: integer(1) }, required: [field] }));
+Object.assign(schemas, SWARM_LOCAL_OPERATION_SCHEMAS);
+const signableEvidence = { ...evidence, required: evidence.required.filter(field => !['schemaVersion', 'runner'].includes(field)) };
+add('evidence-sign', { ...base, evidence: signableEvidence }, ['repositoryRoot', 'evidence']);
+add('evidence-verify', { ...base, evidence, receiptPublicKey: text }, ['evidence']);
+add('merge-verified', { ...step, sourceRef: text, targetRef: text, snapshotReceipt: record, evidence: evidenceArray, preflight: record, receiptPublicKey: text, changes: array(change) }, ['repositoryRoot', 'flowId', 'stepId', 'sourceRef', 'targetRef', 'snapshotReceipt', 'evidence', 'preflight']);
+add('rollback', { ...step, snapshotId: identifier }, ['repositoryRoot', 'flowId', 'snapshotId']);
+const check = { anyOf: [{ type: 'boolean' }, { type: 'object', properties: { status: text }, required: ['status'] }] };
+add('final-gate', { ...base, ...binding, audit: check, test: check, operations: check, evidence: array(evidence), preflight: record }, ['audit', 'test', 'operations', 'evidence']);
+schemas['final-gate'] = { oneOf: [schemas['final-gate'], FINAL_GATE16_INPUT_SCHEMA, FINAL_GATE16_READ_INPUT_SCHEMA] };
+add('formula-evaluate', { formula, values: decimalValues }, ['formula']);
+add('formula-graph', { formulas: array(formulaEntry), inputs: decimalValues }, ['formulas']);
+add('formula-final-gate', { engine: record, flowId: identifier, stepId: identifier }, ['engine']);
+add('calculation-final-gate', { ...step, enginePath: relativePath }, ['repositoryRoot', 'enginePath']);
+add('run-approved-plan', { repositoryRoot: text, planPath: relativePath, approvalPath: text, signerConfigPath: nullable(text) }, ['repositoryRoot', 'planPath', 'approvalPath', 'signerConfigPath']);
+schemas['run-approved-plan'] = { oneOf: [schemas['run-approved-plan'], object({ ...flow, planPath: relativePath, approvalPath: text, signerConfigPath: nullable(text) },
+  ['repositoryRoot', 'home', 'flowId', 'planPath', 'approvalPath', 'signerConfigPath'])] };
+schemas['workflow-run-step'] = WORKFLOW_LOCAL_OPERATION_SCHEMA;
+add('branch-create|branch-create-virtual', { ...base, name: ledgerIdentifier, branchName: ledgerIdentifier, fromRef: text, description: { type: 'string' }, snapshotId: nullable(ledgerIdentifier) }, ['repositoryRoot'], ['name', 'branchName']);
+add('branch-list', base, ['repositoryRoot']);
+add('branch-switch', { ...base, branchName: ledgerIdentifier, name: ledgerIdentifier }, ['repositoryRoot'], ['branchName', 'name']);
+add('diff-report', { ...base, baseRef: text, targetRef: nullable(text), limit: integer(1, 500) }, ['repositoryRoot']);
+add('preflight', { ...base, ...binding, archguard: record, preflight: record, evidence: array(evidence) }, ['repositoryRoot']);
+add('ledger-query|chain-ledger-query', { ...base, limit: integer(1, 500) }, ['repositoryRoot']);
+add('chain-init|chain-ledger-init', { ...base, plan: executionPlan, executionPlan }, ['repositoryRoot'], ['plan', 'executionPlan']);
+const chain = { ...base, chainId: ledgerIdentifier };
+add('chain-resume', { ...chain, stepId: ledgerIdentifier, status: enumeration(['running', 'waiting', 'reported', 'verified', 'blocked', 'failed']), output: {}, error: {} }, ['repositoryRoot', 'chainId']);
+add('chain-status|chain-ledger-status', chain, ['repositoryRoot', 'chainId']);
+add('chain-answer', { ...chain, stepId: ledgerIdentifier, answer: { anyOf: [text, object({ id: text }, ['id'])] }, accepted: { type: 'boolean' }, actorId: nullable(text) }, ['repositoryRoot', 'chainId', 'answer']);
+Object.assign(schemas, LOCAL_CHAIN_OPERATION_SCHEMAS);
+const renewal = { ...flow, requestId: identifier, scope: object({ goal: text, allowedPaths: paths, forbiddenPaths: paths }, ['goal', 'allowedPaths']), policy: object({ intervalMs: integer(1), maxRenewals: integer(1, 100) }, ['intervalMs', 'maxRenewals']) };
+add('budget-auto-renew-request', renewal, ['repositoryRoot', 'flowId', 'requestId', 'scope', 'policy']);
+add('budget-auto-renew', { ...renewal, confirmation, grant: record }, ['repositoryRoot', 'flowId', 'requestId', 'scope', 'policy'], ['grant', 'confirmation']);
+add('budget-auto-renew-stop', { ...flow, reason: enumeration(['revoked', 'completed']) }, ['repositoryRoot', 'flowId', 'reason']);
+const probePaths = { anyOf: [paths, { const: ['.'] }] };
+const scopeRequirement = object({ id: ledgerIdentifier, description: { ...text, pattern: '\\S', maxLength: 12000 } }, ['id', 'description']);
+const scopeInteraction = object({ type: enumeration(['confirm', 'choice', 'multi', 'input']), question: text,
+  options: array(object({ id: ledgerIdentifier, label: text, hint: { type: 'string' } }, ['id', 'label'])), riskDescription: { type: 'string' },
+  callback: object({ operation: ledgerIdentifier, payload: record }, ['operation', 'payload']) }, ['type', 'question', 'options', 'callback']);
+const scopeTask = object({ goal: { ...text, pattern: '\\S', maxLength: 12000 }, workType: enumeration(['implementation', 'documentation', 'calculation', 'merge', 'review', 'decision', 'diagnosis']),
+  difficulty: enumeration(['low', 'medium', 'high']), risk: enumeration(['low', 'medium', 'high']), crossModule: { type: 'boolean' }, parallel: { type: 'boolean' }, needParallel: { type: 'boolean' },
+  unclear: { type: 'boolean' }, architectureContract: { type: 'boolean' }, explicitAimlockRequested: { type: 'boolean' }, explicitEntroroveRequested: { type: 'boolean' }, userSpecifiedSkills: array(text),
+  requirements: { ...array(scopeRequirement, 1), maxItems: 500 }, phase: enumeration(['plan', 'coordinate', 'architecture', 'verify', 'merge', 'decision']), baselineRef: text, interaction: scopeInteraction }, ['goal', 'workType', 'difficulty', 'risk']);
+const probe = { ...step, paths: probePaths, targetPaths: probePaths, task: scopeTask, baselineRef: text, snapshotId: identifier,
+  targetSymbols: array(text, 1), contextMapPath: relativePath, signerConfigPath: nullable(text), taskDigest: sha256, ownerId: ledgerIdentifier, chainDigest: sha256, repositoryId: identifier, challenge: ledgerIdentifier };
+add('probe', { ...probe, handoffCandidate: HANDOFF_SNAPSHOT_CANDIDATE_SCHEMA }, ['repositoryRoot']);
+schemas.probe.allOf = [{ if: { type: 'object', anyOf: ['flowId', 'stepId', 'snapshotId'].map(field => ({ required: [field] })) },
+  then: { type: 'object', required: ['flowId', 'stepId', 'snapshotId'], anyOf: ['paths', 'targetPaths', 'targetSymbols'].map(field => ({ required: [field] })) } },
+  { if: { type: 'object', properties: { signerConfigPath: text }, required: ['signerConfigPath'] },
+    then: { type: 'object', required: ['flowId', 'stepId', 'snapshotId', 'taskDigest', 'ownerId', 'chainDigest', 'repositoryId', 'challenge'] } },
+  { if: { type: 'object', required: ['handoffCandidate'] }, then: { type: 'object', required: ['flowId', 'stepId', 'snapshotId', 'paths', 'taskDigest', 'ownerId', 'chainDigest', 'repositoryId', 'challenge', 'signerConfigPath'],
+    properties: { signerConfigPath: text } } },
+  { if: { type: 'object', required: ['targetSymbols'] }, then: { type: 'object', required: ['contextMapPath'] } }];
+add('reassess', { ...probe, snapshotId: nullable(identifier), currentMode: modes, expectedRevision: integer(1) }, ['repositoryRoot']);
+schemas.reassess.allOf = [{ if: { type: 'object', anyOf: [
+  ...['flowId', 'stepId', 'expectedRevision', 'taskDigest', 'ownerId', 'chainDigest', 'repositoryId', 'challenge'].map(field => ({ required: [field] })),
+  ...['snapshotId', 'signerConfigPath'].map(field => ({ properties: { [field]: text }, required: [field] }))] },
+  then: { type: 'object', required: ['flowId', 'stepId', 'snapshotId', 'expectedRevision'], properties: { snapshotId: identifier },
+    anyOf: ['paths', 'targetPaths', 'targetSymbols'].map(field => ({ required: [field] })) } },
+  { if: { type: 'object', required: ['targetSymbols'] }, then: { type: 'object', required: ['contextMapPath'] } }];
+const task = { ...base, taskId: ledgerIdentifier };
+add('task-describe', { ...task, goal: { ...text, pattern: '\\S' }, ownerId: nullable(text), checkpoint: {}, createdAt: text }, ['repositoryRoot', 'goal']);
+add('message-route', { ...task, messageId: ledgerIdentifier, body: {}, destination: nullable(text) }, ['repositoryRoot', 'taskId']);
+add('message-accept', { ...task, messageId: ledgerIdentifier, ownerId: nullable(text) }, ['repositoryRoot', 'taskId', 'messageId']);
+add('task-resume', task, ['repositoryRoot', 'taskId']);
+
+Object.assign(schemas, ARCHGUARD_LOCAL_OPERATION_SCHEMAS, CALCTOOL_LOCAL_OPERATION_SCHEMAS, MERGE_LOCAL_OPERATION_SCHEMAS);
+export const LOCAL_OPERATION_SCHEMAS = Object.freeze(schemas);
+const ajv = new Ajv({ strict: true, strictRequired: false, allErrors: true });
+const validators = new Map(Object.entries(schemas).map(([operation, schema]) => [operation, ajv.compile(schema)]));
+export function validateLocalInput(operation, input) {
+  const validate = validators.get(operation);
+  if (!validate) throw Object.assign(new Error(`Unsupported local operation: ${operation}`), { code: 'ENTROROVE_OPERATION_UNKNOWN' });
+  if (!validate(input)) {
+    const details = validate.errors.map(error => `${error.instancePath || '/'} ${error.message}`).join('; ');
+    throw Object.assign(new Error(`Invalid ${operation} input: ${details}`), { code: 'ENTROROVE_INPUT_INVALID' });
+  }
+  return input;
+}
+export const operationSchemasFor = operations => Object.freeze(Object.fromEntries(Object.keys(operations).map(name => [name, schemas[name]])));

package/local-credential.mjs

@@ -0,0 +1,101 @@
+import { constants, promises as fs } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import os from 'node:os';
+import { withStateLock } from './local-state-lock.mjs';
+import path from 'node:path';
+
+const SCHEMA = 'entrorove.credential/1.0';
+const TOKEN = /^ent_[A-Za-z0-9_-]{43}$/;
+const error = (code, message) => Object.assign(new Error(message), { code });
+
+export function credentialPath(home = os.homedir()) {
+  if (typeof home !== 'string' || !path.isAbsolute(home)) throw error('ENTROROVE_CREDENTIAL_HOME', 'Credential home must be absolute');
+  if (process.platform === 'win32') {
+    const appData = process.env.LOCALAPPDATA;
+    if (!appData || !path.isAbsolute(appData)) throw error('ENTROROVE_CREDENTIAL_HOME', 'LOCALAPPDATA must be absolute');
+    return path.join(appData, 'Entrorove', 'credential.json');
+  }
+  const parts = process.platform === 'darwin' ? ['Library', 'Application Support', 'Entrorove']
+    : process.platform === 'win32' ? ['AppData', 'Local', 'Entrorove'] : ['.local', 'share', 'entrorove'];
+  return path.join(home, ...parts, 'credential.json');
+}
+
+function owned(stat) {
+  return process.platform === 'win32' || stat.uid === process.getuid();
+}
+
+export async function credentialDirectory(home = os.homedir(), create = false) {
+  const homeStat = await fs.lstat(home).catch(() => { throw error('ENTROROVE_CREDENTIAL_HOME', 'Credential home is unavailable'); });
+  if (!homeStat.isDirectory() || homeStat.isSymbolicLink() || !owned(homeStat)) {
+    throw error('ENTROROVE_CREDENTIAL_DIRECTORY', 'Credential home must be an owned real directory');
+  }
+  const root = process.platform === 'win32' ? path.parse(credentialPath(home)).root : await fs.realpath(home);
+  let current = root;
+  const relative = path.relative(process.platform === 'win32' ? root : home, path.dirname(credentialPath(home)));
+  for (const part of relative.split(path.sep)) {
+    current = path.join(current, part);
+    if (create) await fs.mkdir(current, { mode: 0o700 }).catch(cause => { if (cause.code !== 'EEXIST') throw cause; });
+    const stat = await fs.lstat(current).catch(() => { throw error('ENTROROVE_CREDENTIAL_MISSING', 'Stored credential is unavailable; configure the account key privately'); });
+    if (!stat.isDirectory() || stat.isSymbolicLink() || !owned(stat)) {
+      throw error('ENTROROVE_CREDENTIAL_DIRECTORY', 'Credential directory must be an owned real directory');
+    }
+  }
+  if (create && process.platform !== 'win32') await fs.chmod(current, 0o700);
+  const stat = await fs.lstat(current);
+  if (process.platform !== 'win32' && (stat.mode & 0o077)) throw error('ENTROROVE_CREDENTIAL_PERMISSIONS', 'Credential directory permissions must be 0700');
+  return current;
+}
+
+function privateFile(stat) {
+  if (!stat.isFile() || stat.nlink !== 1 || !owned(stat)) throw error('ENTROROVE_CREDENTIAL_FILE', 'Credential path must be an owned private regular file');
+  if (process.platform !== 'win32' && (stat.mode & 0o777) !== 0o600) throw error('ENTROROVE_CREDENTIAL_PERMISSIONS', 'Credential permissions must be 0600');
+}
+
+export async function readCredential(home = os.homedir()) {
+  const directory = await credentialDirectory(home);
+  let handle;
+  try {
+    handle = await fs.open(path.join(directory, 'credential.json'), constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    const stat = await handle.stat(); privateFile(stat);
+    if (stat.size > 4096) throw error('ENTROROVE_CREDENTIAL_INVALID', 'Invalid credential file');
+    let value;
+    try { value = JSON.parse(await handle.readFile('utf8')); }
+    catch { throw error('ENTROROVE_CREDENTIAL_INVALID', 'Invalid credential file'); }
+    if (!value || value.schemaVersion !== SCHEMA || !TOKEN.test(value.token)
+      || Object.keys(value).sort().join(',') !== 'schemaVersion,token') throw error('ENTROROVE_CREDENTIAL_INVALID', 'Invalid credential file');
+    return value.token;
+  } catch (cause) {
+    if (cause.code?.startsWith('ENTROROVE_CREDENTIAL_')) throw cause;
+    throw error('ENTROROVE_CREDENTIAL_MISSING', 'Stored credential is unavailable; configure the account key privately');
+  } finally { await handle?.close(); }
+}
+
+export async function writeCredential(token, home = os.homedir()) {
+  if (typeof token !== 'string' || !TOKEN.test(token)) throw error('ENTROROVE_CREDENTIAL_INVALID', 'Invalid entrorove key');
+  const directory = await credentialDirectory(home, true);
+  const file = path.join(directory, 'credential.json');
+  const prior = await fs.lstat(file).catch(cause => { if (cause.code !== 'ENOENT') throw cause; return null; });
+  if (prior) privateFile(prior);
+  return withStateLock(file, async () => {
+  const locked = await fs.lstat(file).catch(cause => { if (cause.code !== 'ENOENT') throw cause; return null; });
+  if (locked) privateFile(locked);
+  if (Boolean(locked) !== Boolean(prior) || locked && (locked.ino !== prior.ino || locked.dev !== prior.dev)) {
+    throw error('ENTROROVE_CREDENTIAL_CHANGED', 'Credential changed before the private rotation lock was acquired');
+  }
+  const stage = path.join(directory, `.credential-${randomUUID()}.tmp`);
+  let handle;
+  try {
+    handle = await fs.open(stage, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 0o600);
+    await handle.writeFile(`${JSON.stringify({ schemaVersion: SCHEMA, token })}\n`);
+    await handle.sync(); await handle.close(); handle = undefined;
+    const current = await fs.lstat(file).catch(cause => { if (cause.code !== 'ENOENT') throw cause; return null; });
+    if (current) privateFile(current);
+    if (Boolean(current) !== Boolean(prior) || current && (current.ino !== prior.ino || current.dev !== prior.dev)) {
+      throw error('ENTROROVE_CREDENTIAL_CHANGED', 'Credential changed during configuration; read the current credential before replacing it');
+    }
+    await fs.rename(stage, file);
+    const parent = await fs.open(directory, constants.O_RDONLY);
+    try { await parent.sync(); } finally { await parent.close(); }
+  } finally { await handle?.close(); await fs.rm(stage, { force: true }); }
+  });
+}

package/local-decimal.mjs

@@ -0,0 +1,85 @@
+export const DECIMAL_SCALE = 28;
+export const DECIMAL_POLICY = Object.freeze({ precision: 28, rounding: 'half-away-from-zero', representation: 'decimal-string' });
+const LITERAL = /^[+-]?(?:\d+(?:\.\d*)?|\.\d+)$/;
+const MAX_DIGITS = 4096;
+
+export function formulaError(code, message, details = {}) {
+  return Object.assign(new Error(message), { code, ...details });
+}
+function scale(value, maximum = DECIMAL_SCALE) {
+  if (!Number.isSafeInteger(value) || value < 0 || value > maximum) throw formulaError('DECIMAL_SCALE_INVALID', `decimal places must be 0..${maximum}`);
+  return value;
+}
+function ten(power) { return 10n ** BigInt(scale(power, MAX_DIGITS * 2)); }
+function normalize(coefficient, places) {
+  while (places > 0 && coefficient % 10n === 0n) { coefficient /= 10n; places -= 1; }
+  return { coefficient, scale: places };
+}
+function rounded(coefficient, fromScale, toScale) {
+  if (fromScale <= toScale) return coefficient * ten(toScale - fromScale);
+  const divisor = ten(fromScale - toScale);
+  let quotient = coefficient / divisor;
+  const remainder = coefficient % divisor;
+  if ((remainder < 0n ? -remainder : remainder) * 2n >= divisor) quotient += coefficient < 0n ? -1n : 1n;
+  return quotient;
+}
+function requireCoefficient(value) {
+  if (typeof value !== 'bigint') throw formulaError('INVALID_DECIMAL', 'decimal coefficient must be a bigint');
+  if (value.toString().replace('-', '').length > MAX_DIGITS) throw formulaError('DECIMAL_LIMIT', 'decimal exceeds the supported digit limit');
+}
+
+export class Decimal {
+  constructor(value) {
+    if (value instanceof Decimal) { this.coefficient = value.coefficient; this.scale = value.scale; }
+    else {
+      if (!['string', 'number', 'bigint'].includes(typeof value) || (typeof value === 'number' && (!Number.isFinite(value) || (Number.isInteger(value) && !Number.isSafeInteger(value))))) {
+        throw formulaError('INVALID_DECIMAL', 'decimal must be a finite, lossless number or decimal string');
+      }
+      const source = String(value).trim();
+      if (source.length > MAX_DIGITS || !LITERAL.test(source)) throw formulaError('INVALID_DECIMAL', 'invalid decimal literal');
+      const negative = source[0] === '-';
+      const [integer = '0', fraction = ''] = source.replace(/^[+-]/, '').split('.');
+      const coefficient = BigInt(`${integer || '0'}${fraction}`) * (negative ? -1n : 1n);
+      Object.assign(this, normalize(rounded(coefficient, fraction.length, Math.min(fraction.length, DECIMAL_SCALE)), Math.min(fraction.length, DECIMAL_SCALE)));
+    }
+    this.value = Decimal.format(this.coefficient, this.scale);
+    this.s = this.value;
+    Object.freeze(this);
+  }
+  static from(value) { return value instanceof Decimal ? value : new Decimal(value); }
+  static fromParts(coefficient, places) {
+    requireCoefficient(coefficient); scale(places, MAX_DIGITS);
+    const boundedScale = Math.min(places, DECIMAL_SCALE);
+    const parts = normalize(rounded(coefficient, places, boundedScale), boundedScale);
+    return new Decimal(Decimal.format(parts.coefficient, parts.scale));
+  }
+  static format(coefficient, places) {
+    requireCoefficient(coefficient); scale(places, MAX_DIGITS);
+    const digits = (coefficient < 0n ? -coefficient : coefficient).toString().padStart(places + 1, '0');
+    const value = places === 0 ? digits : `${digits.slice(0, -places)}.${digits.slice(-places)}`;
+    return coefficient < 0n ? `-${value}` : value;
+  }
+  plus(other) {
+    const right = Decimal.from(other); const places = Math.max(this.scale, right.scale);
+    return Decimal.fromParts(this.coefficient * ten(places - this.scale) + right.coefficient * ten(places - right.scale), places);
+  }
+  minus(other) { return this.plus(Decimal.from(other).negate()); }
+  negate() { return Decimal.fromParts(-this.coefficient, this.scale); }
+  times(other) { const right = Decimal.from(other); return Decimal.fromParts(this.coefficient * right.coefficient, this.scale + right.scale); }
+  div(other) {
+    const right = Decimal.from(other);
+    if (right.isZero()) throw formulaError('DIV_ZERO', 'division by zero', { nodeId: 'div' });
+    const numerator = this.coefficient * ten(right.scale + DECIMAL_SCALE);
+    const denominator = right.coefficient * ten(this.scale);
+    let quotient = numerator / denominator;
+    const remainder = numerator % denominator;
+    if ((remainder < 0n ? -remainder : remainder) * 2n >= (denominator < 0n ? -denominator : denominator)) quotient += (numerator < 0n) !== (denominator < 0n) ? -1n : 1n;
+    return Decimal.fromParts(quotient, DECIMAL_SCALE);
+  }
+  rounded(dp) { scale(dp); return this.scale <= dp ? this : Decimal.fromParts(rounded(this.coefficient, this.scale, dp), dp); }
+  toDecimalPlaces(dp) { return this.rounded(dp); }
+  isZero() { return this.coefficient === 0n; }
+  isNegative() { return this.coefficient < 0n; }
+  toString() { return this.value; }
+}
+export const Decimal28 = Decimal;

package/local-error.mjs

@@ -0,0 +1,23 @@
+export const LOCAL_ERROR_SCHEMA = 'entrorove.local-error/1.0';
+
+const BLOCKED_CODES = new Set([
+  'ENTROROVE_MUTATE_NOT_ACCEPTED', 'ENTROROVE_MUTATION_AUTHORITY_REQUIRED',
+  'ENTROROVE_MUTATION_PASS_INVALID', 'ENTROROVE_MUTATION_PASS_EXPIRED',
+  'ENTROROVE_BUDGET_LEASE_EXPIRED', 'ENTROROVE_BUDGET_AUTHORITY_REQUIRED',
+  'ENTROROVE_SWARM_AUTHORITY_INVALID', 'ENTROROVE_SWARM_CLOUD_AUTHORITY_REQUIRED',
+  'ENTROROVE_HANDOFF_FENCE', 'ENTROROVE_HANDOFF_WRITE_REVOKED',
+  'ENTROROVE_HANDOFF_WRITE_BINDING', 'ENTROROVE_HANDOFF_WRITE_SNAPSHOT',
+  'ENTROROVE_SNAPSHOT_CORRUPT', 'ENTROROVE_SNAPSHOT_INVALID',
+]);
+
+export function localErrorStatus(error) {
+  const code = typeof error?.code === 'string' ? error.code : '';
+  return BLOCKED_CODES.has(code) || /(?:AUTHORITY_REQUIRED|LEASE_EXPIRED|NOT_ACCEPTED|REVOKED)$/.test(code)
+    ? 'blocked' : 'failed';
+}
+
+export function localErrorEnvelope(error, fallbackCode = 'ENTROROVE_LOCAL_FAILURE') {
+  const code = typeof error?.code === 'string' && error.code ? error.code : fallbackCode;
+  const message = typeof error?.message === 'string' && error.message ? error.message : 'Local operation failed';
+  return { schemaVersion: LOCAL_ERROR_SCHEMA, status: localErrorStatus({ ...error, code }), code, message };
+}

package/local-evidence-verification.mjs

@@ -0,0 +1,199 @@
+import { createHash, createPublicKey, verify } from 'node:crypto';
+
+const EVIDENCE_SCHEMA = 'entrorove.test-evidence/2.0';
+const EXECUTION_SCHEMA = 'validator.execution-receipt/1.0';
+const GENERIC_SCHEMA = 'entrorove.runner-receipt/1.0';
+const KINDS = new Set(['test', 'build', 'lint', 'security', 'benchmark']);
+const RUNNERS = new Set(['local', 'trusted-runner', 'sandbox']);
+const SHA = /^[0-9a-f]{64}$/;
+const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const FIELDS = new Set(['schemaVersion', 'evidenceId', 'kind', 'runner', 'command', 'exitCode', 'durationMs',
+  'summary', 'artifactSha256', 'subject', 'subjectDigest', 'receipt', 'flowId', 'stepId']);
+const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+const digest = value => createHash('sha256').update(value).digest('hex');
+const text = (value, max) => typeof value === 'string' && value.trim().length > 0 && value.length <= max;
+function fail(code, message) { throw Object.assign(new Error(message), { code }); }
+
+function canonical(value) {
+  if (value === null || typeof value === 'boolean' || typeof value === 'string') return JSON.stringify(value);
+  if (typeof value === 'number' && Number.isFinite(value)) return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`;
+  if (!object(value)) fail('ENTROROVE_EVIDENCE_JSON', 'Evidence must contain finite JSON values');
+  return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}`;
+}
+
+function state(status, details = {}) {
+  return { verified: false, authentic: false, successful: false, status, evidenceState: status, ...details };
+}
+
+function validateEvidence(evidence) {
+  if (!object(evidence) || Object.keys(evidence).some(key => !FIELDS.has(key)) || evidence.schemaVersion !== EVIDENCE_SCHEMA
+    || !text(evidence.evidenceId, 200) || !KINDS.has(evidence.kind) || !RUNNERS.has(evidence.runner)
+    || !text(evidence.command, 2000) || !Number.isInteger(evidence.exitCode) || evidence.exitCode < -128 || evidence.exitCode > 255
+    || !Number.isSafeInteger(evidence.durationMs) || evidence.durationMs < 0 || evidence.durationMs > 86_400_000
+    || !text(evidence.summary, 4000) || !SHA.test(String(evidence.artifactSha256 ?? ''))) {
+    fail('ENTROROVE_EVIDENCE_SCHEMA', 'Evidence schema is invalid');
+  }
+  canonical(evidence);
+}
+
+function publicKey(encoded) {
+  if (typeof encoded !== 'string' || !/^[A-Za-z0-9+/]+={0,2}$/.test(encoded)) fail('ENTROROVE_EVIDENCE_KEY', 'Independent receipt public key encoding is invalid');
+  const bytes = Buffer.from(encoded, 'base64');
+  if (bytes.toString('base64') !== encoded) fail('ENTROROVE_EVIDENCE_KEY', 'Receipt public key must use canonical base64');
+  let key; try { key = createPublicKey({ key: bytes, format: 'der', type: 'spki' }); }
+  catch { fail('ENTROROVE_EVIDENCE_KEY', 'Receipt public key is invalid'); }
+  if (key.asymmetricKeyType !== 'ed25519' || !key.export({ format: 'der', type: 'spki' }).equals(bytes)) {
+    fail('ENTROROVE_EVIDENCE_KEY', 'Receipt public key must be canonical Ed25519 SPKI');
+  }
+  return { key, keyId: digest(bytes) };
+}
+
+function verifySignature(receipt, payload, encoded) {
+  if (!object(receipt) || !SHA.test(String(receipt.keyId ?? '')) || typeof receipt.signature !== 'string'
+    || !/^[A-Za-z0-9_-]{86}$/.test(receipt.signature)) fail('ENTROROVE_EVIDENCE_SIGNATURE', 'Receipt signature fields are invalid');
+  const trusted = publicKey(encoded); const signature = Buffer.from(receipt.signature, 'base64url');
+  if (signature.length !== 64 || signature.toString('base64url') !== receipt.signature || trusted.keyId !== receipt.keyId
+    || (receipt.publicKey !== undefined && receipt.publicKey !== encoded)
+    || !verify(null, Buffer.from(canonical(payload)), trusted.key, signature)) {
+    fail('ENTROROVE_EVIDENCE_SIGNATURE', 'Receipt key identity or signature is invalid');
+  }
+  return trusted.keyId;
+}
+
+function receiptPayload(evidence) {
+  const receipt = evidence.receipt;
+  if (receipt?.schemaVersion === GENERIC_SCHEMA) return Object.fromEntries(Object.entries(evidence).filter(([key]) => key !== 'receipt'));
+  if (receipt?.schemaVersion !== EXECUTION_SCHEMA) fail('ENTROROVE_EVIDENCE_RECEIPT', 'Signed receipt schema is invalid');
+  if (!object(evidence.subject) || evidence.subjectDigest !== digest(canonical(evidence.subject))
+    || receipt.subjectDigest !== evidence.subjectDigest) fail('ENTROROVE_EVIDENCE_SUBJECT', 'Execution receipt subject digest is not bound');
+  return Object.fromEntries(Object.entries(receipt).filter(([key]) => key !== 'signature'));
+}
+
+function manifest(subject) {
+  if (!Array.isArray(subject.files) || !subject.files.length || subject.files.length > 512) fail('ENTROROVE_EVIDENCE_MANIFEST', 'Subject requires a nonempty bounded file manifest');
+  for (const [index, file] of subject.files.entries()) {
+    if (!object(file) || Object.keys(file).sort().join('|') !== 'path|sha256' || !text(file.path, 4096)
+      || file.path !== file.path.normalize('NFC') || file.path.startsWith('/') || /^[A-Za-z]:/.test(file.path)
+      || /[\\\u0000-\u001f\u007f]/.test(file.path) || file.path.split('/').some(part => !part || part === '.' || part === '..')
+      || !SHA.test(String(file.sha256 ?? '')) || (index > 0 && subject.files[index - 1].path >= file.path)) {
+      fail('ENTROROVE_EVIDENCE_MANIFEST', 'Subject manifest paths must be normalized, sorted and unique');
+    }
+  }
+  const actual = digest(`validator.file-manifest/1.0\n${subject.files.map(file => `${file.path}\0${file.sha256}`).join('\n')}`);
+  if (subject.artifactSha256 !== actual) fail('ENTROROVE_EVIDENCE_ARTIFACT', 'Subject artifact does not match its actual file manifest');
+}
+
+function validateSubject(evidence, options) {
+  const subject = evidence.subject; const policy = subject?.policy;
+  if (!object(subject) || subject.schemaVersion !== 'validator.validation-subject/1.0' || !object(policy)
+    || !ID.test(String(subject.planId ?? '')) || !ID.test(String(subject.validationRunId ?? ''))
+    || !text(subject.memberId, 128) || !ID.test(String(subject.chainId ?? '')) || !Number.isFinite(Date.parse(subject.executedAt))
+    || !SHA.test(String(evidence.subjectDigest ?? '')) || evidence.subjectDigest !== digest(canonical(subject))
+    || policy.command !== evidence.command || policy.requiredExitCode !== 0 || subject.artifactSha256 !== evidence.artifactSha256) {
+    fail('ENTROROVE_EVIDENCE_SUBJECT', 'Evidence command, artifact or validation subject is not bound');
+  }
+  manifest(subject);
+  const kind = policy.evidenceKind ?? 'test'; const runner = policy.evidenceRunner ?? 'trusted-runner';
+  if (!KINDS.has(kind) || !RUNNERS.has(runner) || evidence.kind !== kind || evidence.runner !== runner) {
+    fail('ENTROROVE_EVIDENCE_SEMANTICS', 'Evidence kind and runner must match signed policy');
+  }
+  if (!Array.isArray(subject.tests) || !subject.tests.length || subject.tests.some(item => !object(item)
+    || !ID.test(String(item.testId ?? '')) || !subject.files.some(file => file.path === item.path))) {
+    fail('ENTROROVE_EVIDENCE_TESTS', 'Subject tests must be bound to manifest files');
+  }
+  validateBaseline(subject);
+  validateBinding(evidence, subject, options);
+  if (options.expectedSubject !== undefined && canonical(options.expectedSubject) !== canonical(subject)) {
+    fail('ENTROROVE_EVIDENCE_SUBJECT', 'Evidence belongs to a different expected subject');
+  }
+  return subject;
+}
+
+function validateBaseline(subject) {
+  const baseline = subject.goldenBaseline; const source = baseline?.source;
+  if (!object(baseline) || baseline.schemaVersion !== 'validator.golden-baseline/1.0' || baseline.frozen !== true
+    || !ID.test(String(baseline.baselineId ?? '')) || !ID.test(String(baseline.version ?? ''))
+    || !ID.test(String(baseline.frozenBy ?? '')) || !Number.isFinite(Date.parse(baseline.frozenAt))
+    || !object(source) || !['repository-commit', 'artifact', 'approved-record'].includes(source.kind)
+    || !text(source.locator, 4096) || !SHA.test(String(source.digestSha256 ?? ''))
+    || baseline.testsSha256 !== digest(canonical(subject.tests))) fail('ENTROROVE_EVIDENCE_BASELINE', 'A frozen traceable baseline must bind the actual subject tests');
+}
+
+function validateBinding(evidence, subject, options) {
+  const workflow = subject.policy.workflowBinding;
+  if (workflow !== undefined && !object(workflow)) fail('ENTROROVE_EVIDENCE_BINDING', 'Signed workflow binding is invalid');
+  const values = { flowId: workflow?.flowId ?? subject.chainId, stepId: workflow?.stepId ?? subject.validationRunId,
+    snapshotDigest: subject.contracts?.aimlock?.snapshotSha256 ?? subject.snapshotDigest,
+    contractDigest: subject.contracts?.archguard?.contractSha256 ?? subject.contractDigest };
+  if (!ID.test(String(values.flowId ?? '')) || !ID.test(String(values.stepId ?? ''))) fail('ENTROROVE_EVIDENCE_BINDING', 'Signed flow and step are required');
+  for (const field of ['flowId', 'stepId']) {
+    if (evidence[field] !== undefined && evidence[field] !== values[field]) fail('ENTROROVE_EVIDENCE_BINDING', 'Outer evidence flow or step differs from signed subject');
+  }
+  for (const field of ['snapshotDigest', 'contractDigest']) {
+    if (subject[field] !== undefined && subject[field] !== values[field]) fail('ENTROROVE_EVIDENCE_BINDING', 'Subject has conflicting contract digest bindings');
+  }
+  const binding = options.binding ?? {};
+  for (const field of ['flowId', 'stepId', 'snapshotDigest', 'contractDigest']) {
+    if ((options.requireBinding || binding[field] !== undefined) && (binding[field] === undefined || values[field] !== binding[field]
+      || (field.endsWith('Digest') && !SHA.test(String(values[field] ?? ''))))) {
+      fail('ENTROROVE_EVIDENCE_BINDING', `Evidence is not bound to requested ${field}`);
+    }
+  }
+  for (const field of ['artifactSha256', 'subjectDigest']) {
+    if (binding[field] !== undefined && evidence[field] !== binding[field]) fail('ENTROROVE_EVIDENCE_BINDING', `Evidence ${field} does not match requested subject`);
+  }
+}
+
+function executionResult(evidence, subject, now) {
+  const receipt = evidence.receipt; const result = receipt.result;
+  const issued = Date.parse(receipt.issuedAt); const expires = Date.parse(receipt.expiresAt);
+  if (!ID.test(String(receipt.nonce ?? '')) || !Number.isFinite(issued) || !Number.isFinite(expires)
+    || issued > now + 60_000 || expires <= now || expires <= issued || expires - issued > 600_000) {
+    fail('ENTROROVE_EVIDENCE_LIFETIME', 'Execution receipt lifetime or nonce is invalid');
+  }
+  if (!object(result) || result.runner !== 'trusted-runner' || typeof result.passed !== 'boolean'
+    || result.exitCode !== evidence.exitCode || result.durationMs !== evidence.durationMs || result.summary !== evidence.summary) {
+    fail('ENTROROVE_EVIDENCE_RESULT', 'Execution receipt result is not bound to evidence');
+  }
+  if (subject.execution !== undefined) {
+    const execution = subject.execution;
+    if (!object(execution) || (execution.exitCode === null ? 1 : execution.exitCode) !== evidence.exitCode || typeof execution.timedOut !== 'boolean'
+      || typeof execution.outputLimitExceeded !== 'boolean' || (execution.signal !== null && !text(execution.signal, 64))) {
+      fail('ENTROROVE_EVIDENCE_RESULT', 'Signed process result is invalid');
+    }
+    const passed = execution.exitCode === 0 && execution.signal === null && !execution.timedOut && !execution.outputLimitExceeded;
+    if (passed !== result.passed) fail('ENTROROVE_EVIDENCE_RESULT', 'Receipt passed flag differs from signed process result');
+  }
+  if (result.passed && evidence.exitCode !== 0) fail('ENTROROVE_EVIDENCE_RESULT', 'Successful receipt must exit zero');
+  return result.passed && evidence.exitCode === 0;
+}
+
+export function verifyEvidenceIntegrity(evidence, options = {}) {
+  try {
+    validateEvidence(evidence); const receipt = evidence.receipt; const payload = receiptPayload(evidence);
+    const keyId = verifySignature(receipt, payload, options.publicKey ?? receipt?.publicKey);
+    if (receipt.schemaVersion === EXECUTION_SCHEMA) {
+      const subject = validateSubject(evidence, options);
+      executionResult(evidence, subject, options.now ?? Date.now());
+    }
+    return state('incomplete', { authentic: true, integrity: 'verified', keyId, evidence,
+      reason: 'Signature integrity alone does not establish independent successful execution' });
+  } catch (error) { return state('blocked', { integrity: 'invalid', code: error.code ?? 'ENTROROVE_EVIDENCE_INVALID', reason: error.message }); }
+}
+
+export function verifyTestEvidence(evidence, options = {}) {
+  try {
+    validateEvidence(evidence);
+    if (evidence.runner === 'local' || !options.publicKey) return state('incomplete', { evidence,
+      reason: 'Local evidence or an unconfigured independent verifier cannot establish trusted execution' });
+    const now = options.now ?? Date.now();
+    if (!Number.isSafeInteger(now) || now < 0) fail('ENTROROVE_EVIDENCE_TIME', 'Trusted verification time is invalid');
+    const payload = receiptPayload(evidence); const keyId = verifySignature(evidence.receipt, payload, options.publicKey);
+    if (evidence.receipt.schemaVersion === GENERIC_SCHEMA) return state('incomplete', { authentic: true, integrity: 'verified', keyId, evidence,
+      reason: 'Generic signatures have no signed execution lifetime or result authority' });
+    const subject = validateSubject(evidence, options); const successful = executionResult(evidence, subject, now);
+    return state(successful ? 'verified' : 'blocked', { verified: true, authentic: true, successful, keyId, evidence,
+      integrity: 'verified', reason: successful ? 'Independent signed execution passed' : 'Independent signed execution failed' });
+  } catch (error) { return state('blocked', { code: error.code ?? 'ENTROROVE_EVIDENCE_INVALID', reason: error.message }); }
+}