@entrorove/skill 0.1.23 → 0.1.25

package/local-execution.mjs

@@ -1,29 +1,42 @@
+import { mergeVerified as executeVerifiedMerge, rollbackMerge } from './local-merge-controller.mjs';
+import { peerCoordinate, spawnBind, completePeer, verifyCoordinationLease } from './local-swarm.mjs';
+export { peerCoordinate, spawnBind, completePeer, verifyCoordinationLease };
+import { snapshotPlan14, snapshotVerify14, snapshotAuthority14, loadSnapshotReceipt14, readSnapshotCopy14 } from './local-mutation-snapshot.mjs';
+import { mutateGate14, issueMutationPass14, verifyMutationPass14, guardedWrite14 } from './local-mutation-authority.mjs';
+import { writeMutationProjectFile14 } from './local-mutation-files.mjs';
+import { auditMutation14, withMutationAudit14 } from './local-mutation-audit.mjs';
 import { createHash, createPublicKey, generateKeyPairSync, sign, verify, randomUUID } from 'node:crypto';
-import { constants } from 'node:fs';
 import { promises as fs } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { formulaFinalGateFile, formulaFinalGate, evaluateFormula, evaluateFormulaGraph, Decimal } from './local-formula.mjs';
-import { LOCAL_LEDGER_OPERATIONS, LOCAL_LEDGER_SCHEMAS, branchCreate, branchList, branchSwitch, diffReport, preflight, ledgerQuery, chainInit, chainResume, chainStatus, chainAnswer, appendLedgerRecord } from './local-ledger.mjs';
-import { verifyArchguardPreflight, verifyReceipt, verifySnapshotManifest, verifyTrustedEvidence } from './local-integrity.mjs';
+import { LOCAL_LEDGER_OPERATIONS, branchCreate, branchList, branchSwitch, diffReport, preflight, ledgerQuery, chainInit, chainResume, chainStatus, chainAnswer, appendLedgerRecord } from './local-ledger.mjs';
+import { runHandoffTrustedWrite } from './local-task-handoff-write-receipts.mjs';
+import { snapshotHandoffBinding, verifyArchguardPreflight, verifyReceipt, verifySnapshotManifest, verifyTrustedEvidence } from './local-integrity.mjs';
+import { verifyTestEvidence } from './local-evidence-verification.mjs';
 import { RUNNER_CAPABILITIES, runApprovedPlan } from './local-approved-plan.mjs';
-import { LOCAL_RENEWAL_OPERATIONS, LOCAL_RENEWAL_SCHEMAS, budgetAutoRenewRequest, budgetAutoRenew, budgetAutoRenewStop, consumeBudgetRenewal } from './local-budget-renewal.mjs';
-import { LOCAL_PROBE_OPERATIONS, LOCAL_PROBE_SCHEMAS, probe, reassess } from './local-probe.mjs';
-import { LOCAL_TASK_ROUTING_OPERATIONS, LOCAL_TASK_ROUTING_SCHEMAS, taskDescribe, messageRoute, messageAccept, taskResume } from './local-task-routing.mjs';
+import { WORKFLOW_LOCAL_CAPABILITIES, runWorkflowLocalStep } from './workflow-local-runner.mjs';
+import { LOCAL_RENEWAL_OPERATIONS, budgetAutoRenewRequest, budgetAutoRenew, budgetAutoRenewStop } from './local-budget-renewal.mjs';
+import { LOCAL_PROBE_OPERATIONS, probe, reassess } from './local-probe.mjs';
+import { LOCAL_TASK_ROUTING_OPERATIONS, taskDescribe, messageRoute, messageAccept, taskResume } from './local-task-routing.mjs';
 import { withStateLock } from './local-state-lock.mjs';
+import { readBudgetedProjectFile } from './local-budget-reads.mjs';
+import { receiverClaim } from './local-task-handoff-overlay-wire.mjs';
+import { assertTaskHandoffActive, assertTaskHandoffSnapshotBinding, readTaskHandoffSnapshotBinding,
+  withTaskHandoffIssueFence, withTaskHandoffWriteFence } from './local-task-handoff-fence.mjs';
+import { LOCAL_OPERATION_SCHEMAS } from './local-contracts.mjs';
+export { LOCAL_OPERATION_SCHEMAS };
 export const LOCAL_SCHEMA = 'entrorove.local-execution/1.0';
 export const SNAPSHOT_SCHEMA = 'entrorove.snapshot/1.0';
 export const RECEIPT_SCHEMA = 'entrorove.snapshot-receipt/1.0';
 export const PASS_SCHEMA = 'entrorove.mutation-pass/1.0';
 export const EVIDENCE_SCHEMA = 'entrorove.test-evidence/2.0';
 export const EVIDENCE_RECEIPT_SCHEMA = 'entrorove.runner-receipt/1.0';
-export const BUDGET_SCHEMA = 'entrorove.read-budget/1.0';
 export const COORDINATION_SCHEMA = 'entrorove.coordination/1.0';
-export const READ_BUDGETS = Object.freeze({
-  lock: Object.freeze({ maxFiles: 3, maxTokenEstimate: 12_000, maxDurationMs: 120_000 }),
-  probe: Object.freeze({ maxFiles: 10, maxTokenEstimate: 30_000, maxDurationMs: 480_000 }),
-  swarm: Object.freeze({ maxFiles: 30, maxTokenEstimate: 100_000, maxDurationMs: 3_600_000 }),
-});
+import { BUDGET_SCHEMA, READ_BUDGETS, budgetInit, budgetContext, budgetStatus, budgetRead, budgetExtend } from './local-budget.mjs';
+export { BUDGET_SCHEMA, READ_BUDGETS, budgetInit, budgetContext, budgetStatus, budgetRead, budgetExtend };
+export { budgetTransition, LOCAL_BUDGET_TRANSITION_OPERATIONS } from './local-budget-transition.mjs';
+export { budgetHandoff, LOCAL_BUDGET_HANDOFF_OPERATIONS } from './local-budget-handoff.mjs';
 const ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 const SHA256 = /^[0-9a-f]{64}$/;
 const MISSING_SHA256 = sha256('entrorove.missing-file/1.0');
@@ -150,248 +163,89 @@ async function keyPair(home, root) {
     return { privateKey: pair.privateKey, publicKey: pair.publicKey, publicDer, keyId: sha256(publicDer) };
   }
 }
-async function fileDigest(file) { return file.exists ? sha256(await fs.readFile(file.target)) : MISSING_SHA256; }
+async function fileDigest(file, input) { return file.exists ? sha256(await readBudgetedProjectFile(input, file.target, { sourcePath: file.path })) : MISSING_SHA256; }
 export async function snapshotPlan(input) {
-  const root = await repositoryRoot(input.repositoryRoot);
-  const flowId = id(input.flowId, 'flowId'); const stepId = id(input.stepId, 'stepId');
-  const paths = normalizePaths(input.paths);
-  const snapshotId = id(input.snapshotId ?? `snap-${randomUUID()}`, 'snapshotId');
-  const directory = path.dirname(statePath(input.home, 'snapshots', root, flowId, 'manifest.json'));
-  const snapshotRoot = path.join(directory, snapshotId);
-  await privateDir(snapshotRoot);
-  const files = [];
-  for (const relative of paths) {
-    const source = await projectFile(root, relative, true);
-    const digest = await fileDigest(source);
-    const target = path.join(snapshotRoot, relative);
-    if (source.exists) { await privateDir(path.dirname(target)); await fs.copyFile(source.target, target, constants.COPYFILE_EXCL); }
-    files.push({ path: relative, exists: source.exists, sha256: digest, mode: source.exists ? source.stat.mode & 0o777 : null });
-  }
-  const contractDigest = input.contractDigest ?? null;
-  if (contractDigest !== null && !SHA256.test(contractDigest)) fail('ENTROROVE_CONTRACT_DIGEST', 'contractDigest must be a lowercase SHA-256 digest');
-  const manifest = { schemaVersion: SNAPSHOT_SCHEMA, snapshotId, flowId, stepId, repositoryDigest: repoKey(root), paths, files, contractDigest,
-    createdAt: new Date().toISOString(), snapshotDigest: sha256(canonical({ snapshotId, flowId, stepId, paths, files, contractDigest })) };
-  const manifestPath = path.join(snapshotRoot, 'manifest.json');
-  await atomicJson(manifestPath, manifest);
-  await audit(input.home, root, 'snapshot-plan', { flowId, stepId, snapshotId });
-  return { schemaVersion: LOCAL_SCHEMA, snapshotId, snapshotRoot, manifestPath, paths, contractDigest, snapshotDigest: manifest.snapshotDigest, forbidGitBranch: true, forbidWorktree: true };
+  const result = await snapshotPlan14(input, { handoffBinding: await readTaskHandoffSnapshotBinding(input) });
+  await auditMutation14(input, 'snapshot-plan', { snapshotId: result.snapshotId });
+  return result;
 }
 export async function snapshotVerify(input) {
-  const root = await repositoryRoot(input.repositoryRoot); const flowId = id(input.flowId, 'flowId'); const stepId = id(input.stepId, 'stepId');
-  const snapshotId = id(input.snapshotId, 'snapshotId');
-  const manifestPath = path.join(path.dirname(statePath(input.home, 'snapshots', root, flowId, 'manifest.json')), snapshotId, 'manifest.json');
-  const manifest = await readJson(manifestPath);
-  const integrity = verifySnapshotManifest(manifest, { snapshotId, flowId, stepId, repositoryDigest: repoKey(root) });
-  if (!integrity.verified) fail('ENTROROVE_SNAPSHOT_CORRUPT', integrity.reason ?? 'snapshot manifest is invalid');
-  const files = [];
-  for (const expected of manifest.files) {
-    const source = await projectFile(root, expected.path, true);
-    const actual = await fileDigest(source);
-    if (actual !== expected.sha256) fail('ENTROROVE_SNAPSHOT_CHANGED', `${expected.path} changed after snapshot`);
-    const snapshotTarget = path.join(path.dirname(manifestPath), expected.path);
-    const snapshotDigest = expected.exists ? sha256(await fs.readFile(snapshotTarget)) : MISSING_SHA256;
-    if (snapshotDigest !== expected.sha256) fail('ENTROROVE_SNAPSHOT_CORRUPT', `${expected.path} snapshot copy is invalid`);
-    files.push({ path: expected.path, sourceHash: actual, snapshotHash: expected.sha256 });
-  }
-  const core = { schemaVersion: RECEIPT_SCHEMA, snapshotId, flowId, stepId, repositoryDigest: repoKey(root), snapshotDigest: manifest.snapshotDigest, contractDigest: manifest.contractDigest ?? null, paths: manifest.paths, fileManifestDigest: sha256(canonical(files)) };
-  const receipt = { ...core, receiptDigest: sha256(canonical(core)) };
-  await audit(input.home, root, 'snapshot-verify', { flowId, stepId, snapshotId, receiptDigest: receipt.receiptDigest });
-  return { schemaVersion: LOCAL_SCHEMA, verified: true, receipt };
-}
-async function loadReceipt(input) {
-  const receipt = input.receipt;
-  if (!receipt || receipt.schemaVersion !== RECEIPT_SCHEMA || !SHA256.test(receipt.snapshotDigest) || !SHA256.test(receipt.receiptDigest)
-    || !Array.isArray(receipt.paths) || receipt.receiptDigest !== sha256(canonical({ schemaVersion: receipt.schemaVersion, snapshotId: receipt.snapshotId,
-    flowId: receipt.flowId, stepId: receipt.stepId, repositoryDigest: receipt.repositoryDigest, snapshotDigest: receipt.snapshotDigest,
-      contractDigest: receipt.contractDigest ?? null, paths: receipt.paths, fileManifestDigest: receipt.fileManifestDigest }))) fail('ENTROROVE_RECEIPT_INVALID', 'snapshot receipt is invalid');
-  return receipt;
-}
-async function snapshotAuthority(input, root, receipt) {
-  const manifestPath = path.join(path.dirname(statePath(input.home, 'snapshots', root, receipt.flowId, 'manifest.json')), receipt.snapshotId, 'manifest.json'); const manifest = await readJson(manifestPath);
-  const check = verifySnapshotManifest(manifest, { snapshotId: receipt.snapshotId, flowId: receipt.flowId, stepId: receipt.stepId, repositoryDigest: repoKey(root) });
-  if (!check.verified || manifest.snapshotDigest !== receipt.snapshotDigest || canonical(manifest.paths) !== canonical(receipt.paths) || (manifest.contractDigest ?? null) !== (receipt.contractDigest ?? null)) fail('ENTROROVE_SNAPSHOT_BINDING', check.reason ?? 'snapshot receipt does not match its manifest');
-  return { manifest, manifestPath };
-}
-export async function mutateGate(input) {
-  if (input.accepted !== true) return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', allowed: false, code: 'ENTROROVE_MUTATE_NOT_ACCEPTED' };
-  id(input.flowId, 'flowId'); id(input.stepId, 'stepId');
-  const receipt = await loadReceipt(input); const root = await repositoryRoot(input.repositoryRoot);
-  if (receipt.flowId !== input.flowId || receipt.stepId !== input.stepId || receipt.repositoryDigest !== repoKey(root)) return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', allowed: false, code: 'ENTROROVE_RECEIPT_SCOPE' };
-  await snapshotAuthority(input, root, receipt);
-  if (input.paths && canonical(normalizePaths(input.paths)) !== canonical(normalizePaths(receipt.paths))) return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', allowed: false, code: 'ENTROROVE_RECEIPT_PATHS' };
-  if (input.coordinationRequired === true) {
-    try { await verifyCoordinationLease({ ...input, paths: receipt.paths }); } catch (error) { return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', allowed: false, code: error.code ?? 'ENTROROVE_LEASE_INVALID' }; }
+  const result = await snapshotVerify14(input);
+  await auditMutation14(input, 'snapshot-verify', { snapshotId: input.snapshotId, receiptDigest: result.receipt.receiptDigest });
+  return result;
+}
+async function loadReceipt(input) { return loadSnapshotReceipt14(input.receipt); }
+async function snapshotAuthority(input, root, receipt) { return snapshotAuthority14(input, root, receipt); }
+export async function mutateGate(input) { return mutateGate14(input); }
+export async function issueMutationPass(input) { return issueMutationPass14(input); }
+export async function verifyMutationPass(input, options) { return verifyMutationPass14(input, options); }
+async function writeSnapshotFile(input, root, targetPath, baseline) {
+  if (!baseline || input.expectedSha256 && input.expectedSha256 !== baseline.sha256) fail('ENTROROVE_WRITE_BASELINE', 'target does not match its exact expected snapshot baseline');
+  const content = typeof input.content === 'string' ? input.content : JSON.stringify(input.content);
+  if (typeof content !== 'string') fail('ENTROROVE_CONTENT_INVALID', 'content must be text or JSON');
+  const written = await writeMutationProjectFile14(input, root, targetPath, content, baseline);
+  const record = { flowId: input.flowId, stepId: input.stepId, targetPath, sha256: written.sha256, ...(input.handoffId ? { handoffId: input.handoffId } : {}) };
+  await auditMutation14(input, 'guarded-write', record);
+  await appendLedgerRecord({ home: input.home, repositoryRoot: root }, 'guarded-write', record);
+  return { schemaVersion: LOCAL_SCHEMA, status: 'verified', written: true, targetPath, sha256: written.sha256 };
+}
+async function guardedHandoffWrite(input) {
+  const required = ['repositoryRoot', 'flowId', 'stepId', 'targetPath', 'content', 'handoffId', 'epoch', 'handoffPass', 'provisionalLease'];
+  if (required.some(key => !Object.hasOwn(input, key)) || Object.keys(input).some(key => ![...required, 'home', 'expectedSha256'].includes(key))) {
+    fail('ENTROROVE_HANDOFF_WRITE_INPUT', 'takeover write requires only its exact original cloud pass, lease and target fields');
   }
-  return { schemaVersion: LOCAL_SCHEMA, status: 'verified', allowed: true, snapshotId: receipt.snapshotId, receiptDigest: receipt.receiptDigest, paths: receipt.paths, coordinationRequired: input.coordinationRequired === true };
-}
-export async function issueMutationPass(input) {
-  const gate = await mutateGate(input); if (!gate.allowed) return gate;
-  const root = await repositoryRoot(input.repositoryRoot); const authority = await keyPair(input.home, root); const now = Date.now();
-  const ttlSeconds = input.ttlSeconds ?? 300;
-  if (!Number.isInteger(ttlSeconds) || ttlSeconds < 1 || ttlSeconds > 300) fail('ENTROROVE_PASS_TTL_INVALID', 'ttlSeconds must be 1..300');
-  const pass = { schemaVersion: PASS_SCHEMA, passId: `pass-${randomUUID()}`, flowId: input.flowId, stepId: input.stepId,
-    repositoryDigest: repoKey(root), snapshotId: gate.snapshotId, snapshotReceiptDigest: gate.receiptDigest, snapshotReceipt: input.receipt, paths: gate.paths, coordinationRequired: gate.coordinationRequired,
-    issuedAt: new Date(now).toISOString(), expiresAt: new Date(now + ttlSeconds * 1000).toISOString(), keyId: authority.keyId, nonce: randomUUID() };
-  const signature = sign(null, Buffer.from(canonical(pass)), authority.privateKey).toString('base64url');
-  const signedPass = { ...pass, signature }; const file = statePath(input.home, 'gates', root, input.flowId, `${pass.passId}.json`);
-  await atomicJson(file, signedPass); await audit(input.home, root, 'mutation-pass-issued', { flowId: input.flowId, stepId: input.stepId, passId: pass.passId });
-  return { schemaVersion: LOCAL_SCHEMA, gatePassPath: file, pass: signedPass };
-}
-async function verifyPass(input) {
+  const root = await repositoryRoot(input.repositoryRoot), target = safePath(input.targetPath, 'targetPath');
   id(input.flowId, 'flowId'); id(input.stepId, 'stepId');
-  const root = await repositoryRoot(input.repositoryRoot); const gateDirectory = path.dirname(statePath(input.home, 'gates', root, input.flowId, 'pass.json'));
-  const gatePath = path.resolve(input.gatePassPath ?? ''); inside(gateDirectory, gatePath, 'gatePassPath');
-  const pass = await readJson(gatePath); const authority = await keyPair(input.home, root);
-  const target = safePath(input.targetPath, 'targetPath'); const paths = Array.isArray(pass.paths) ? pass.paths : [];
-  const valid = pass.schemaVersion === PASS_SCHEMA && pass.repositoryDigest === repoKey(root) && pass.flowId === input.flowId && pass.stepId === input.stepId
-    && paths.includes(target) && pass.keyId === authority.keyId && typeof pass.signature === 'string'
-    && verify(null, Buffer.from(canonical(Object.fromEntries(Object.entries(pass).filter(([key]) => key !== 'signature')))), authority.publicKey, Buffer.from(pass.signature, 'base64url'))
-    && Date.parse(pass.issuedAt) <= Date.now() && Date.parse(pass.expiresAt) > Date.now();
-  if (!valid) fail('ENTROROVE_PASS_INVALID', 'mutation pass is forged, expired, or outside its scope');
-  if (!pass.snapshotReceipt || pass.snapshotReceipt.receiptDigest !== pass.snapshotReceiptDigest) fail('ENTROROVE_PASS_INVALID', 'mutation pass has no bound snapshot receipt');
-  const receipt = await loadReceipt({ receipt: pass.snapshotReceipt });
-  await snapshotAuthority(input, root, receipt);
-  if (receipt.flowId !== pass.flowId || receipt.stepId !== pass.stepId || receipt.repositoryDigest !== pass.repositoryDigest || receipt.snapshotId !== pass.snapshotId) fail('ENTROROVE_PASS_INVALID', 'mutation pass snapshot scope is invalid');
-  if (pass.coordinationRequired === true) await verifyCoordinationLease({ ...input, paths: [target] });
-  return { root, pass, target };
+  const lock = path.join(homeRoot(input.home), 'write-locks', repoKey(root), `${sha256(target)}.lock`);
+  return withStateLock(lock, () => withTaskHandoffWriteFence({ ...input, repositoryRoot: root,
+    passId: input.handoffPass?.passId, leaseId: input.provisionalLease?.leaseId }, async (state, capability) => {
+    if (!state.receiverClaim || state.receiverRestoration) fail('ENTROROVE_HANDOFF_WRITE_REVOKED', 'takeover scope is absent or already restored');
+    const supplied = { pass: input.handoffPass, lease: input.provisionalLease, challenge: state.receiverClaim.challenge };
+    const { pass, lease, challenge } = receiverClaim(supplied, { flowId: input.flowId, repo: repoKey(root) });
+    if (canonical(supplied) !== canonical(state.receiverClaim) || input.handoffId !== pass.handoffId
+      || input.epoch !== pass.receiverEpoch || input.stepId !== lease.stepId || !pass.paths.includes(target)) {
+      fail('ENTROROVE_HANDOFF_WRITE_BINDING', 'takeover write changed its actual receiver, signed grant or exact path scope');
+    }
+    const manifestPath = path.join(path.dirname(statePath(input.home, 'snapshots', root, input.flowId, 'manifest.json')), pass.snapshotId, 'manifest.json');
+    const manifest = await readJson(manifestPath);
+    const integrity = verifySnapshotManifest(manifest, { snapshotId: pass.snapshotId, flowId: input.flowId, stepId: lease.stepId, repositoryDigest: repoKey(root) });
+    if (!integrity.verified || manifest.snapshotDigest !== pass.scopeSnapshotDigest || canonical(manifest.paths) !== canonical(pass.paths)
+      || manifest.handoffEpoch !== pass.receiverEpoch || manifest.handoffBaselineReceiptDigest !== challenge.baselineReceiptDigest) {
+      fail('ENTROROVE_HANDOFF_WRITE_SNAPSHOT', 'takeover write requires its original fresh snapshot and actual release baseline');
+    }
+    const baseline = manifest.files.find(file => file.path === target);
+    if (!baseline || (baseline.exists && sha256((await readSnapshotCopy14(input, path.dirname(manifestPath), manifest, target)).content) !== baseline.sha256)) {
+      fail('ENTROROVE_HANDOFF_WRITE_SNAPSHOT', 'takeover snapshot copy changed before the actual physical write');
+    }
+    return runHandoffTrustedWrite({ input: { ...input, targetPath: target }, ...capability, manifest,
+      snapshotDirectory: path.dirname(manifestPath),
+      performActualWrite: ({ input: actualInput, baseline: current }) => writeSnapshotFile(actualInput, root, target, current) });
+  }));
 }
-export async function verifyMutationPass(input) { const verified = await verifyPass(input); return { schemaVersion: LOCAL_SCHEMA, verified: true, pass: verified.pass, targetPath: verified.target }; }
 export async function guardedWrite(input) {
-  const verified = await verifyPass(input);
-  const lockFile = path.join(homeRoot(input.home), 'write-locks', repoKey(verified.root), `${sha256(verified.target)}.lock`);
-  return withStateLock(lockFile, async () => {
-    const target = await projectFile(verified.root, verified.target, true);
-    const { manifest } = await snapshotAuthority(input, verified.root, verified.pass.snapshotReceipt); const baseline = manifest.files.find(item => item.path === verified.target);
-    if (!baseline) fail('ENTROROVE_WRITE_SCOPE', 'target is absent from the snapshot manifest');
-    if (await fileDigest(target) !== baseline.sha256) fail('ENTROROVE_WRITE_BASELINE', 'target changed after the snapshot');
-    const expected = input.expectedSha256 ?? null;
-    if (expected && (!SHA256.test(expected) || await fileDigest(target) !== expected)) fail('ENTROROVE_WRITE_BASELINE', 'target does not match the expected snapshot hash');
-    const content = typeof input.content === 'string' ? input.content : JSON.stringify(input.content);
-    if (typeof content !== 'string') fail('ENTROROVE_CONTENT_INVALID', 'content must be text or JSON');
-    await privateDir(path.dirname(target.target)); const temporary = path.join(path.dirname(target.target), `.${path.basename(target.target)}.${randomUUID()}.tmp`);
-    await fs.writeFile(temporary, content, { flag: 'wx', mode: target.exists ? target.stat.mode & 0o777 : 0o600 }); await fs.rename(temporary, target.target);
-    await audit(input.home, verified.root, 'guarded-write', { flowId: input.flowId, stepId: input.stepId, targetPath: verified.target });
-    await appendLedgerRecord({ home: input.home, repositoryRoot: verified.root }, 'guarded-write', { flowId: input.flowId, stepId: input.stepId, targetPath: verified.target, sha256: sha256(content) });
-    return { schemaVersion: LOCAL_SCHEMA, status: 'verified', written: true, targetPath: verified.target, sha256: sha256(content) };
-  });
-}
-function enforced(context) {
-  if (!context || typeof context !== 'object' || Array.isArray(context)) fail('ENTROROVE_CONTEXT_REQUIRED', 'executionContext is required');
-  if (Object.keys(context).length === 1 && context.executionIsolation === 'local') return false;
-  if (Object.keys(context).length !== 2 || !['direct', 'sandbox'].includes(context.executionIsolation) || typeof context.cloudSandboxEnabled !== 'boolean') fail('ENTROROVE_CONTEXT_INVALID', 'executionContext is invalid');
-  if (context.executionIsolation === 'sandbox' && context.cloudSandboxEnabled !== true) fail('ENTROROVE_CONTEXT_INVALID', 'sandbox requires cloudSandboxEnabled=true');
-  return context.executionIsolation === 'sandbox';
-}
-async function budgetFile(input) { const root = await repositoryRoot(input.repositoryRoot); const flowId = id(input.flowId, 'flowId'); return { root, file: statePath(input.home, 'budgets', root, flowId, 'budget.json') }; }
-function budgetView(state, now = Date.now()) {
-  const elapsedMs = state.enforced ? state.elapsedMs + now - Date.parse(state.startedAt) : state.elapsedMs;
-  return { ...state, elapsedMs, remainingFiles: state.enforced ? Math.max(0, state.maxFiles - state.files.length) : null,
-    remainingTokenEstimate: state.enforced && state.maxTokenEstimate !== null ? Math.max(0, state.maxTokenEstimate - state.tokenEstimate) : null,
-    remainingDurationMs: state.enforced ? Math.max(0, state.maxDurationMs - elapsedMs) : null,
-    enforcement: state.enforced ? 'cloud-sandbox' : 'continuous' };
-}
-export async function budgetInit(input) {
-  const mode = input.mode; if (!READ_BUDGETS[mode]) fail('ENTROROVE_MODE_INVALID', 'mode must be lock, probe, or swarm');
-  const { root, file } = await budgetFile(input); const limits = READ_BUDGETS[mode]; const isEnforced = enforced(input.executionContext);
-  return withStateLock(file, async () => {
-    try { const existing = await readJson(file); if (existing.schemaVersion !== BUDGET_SCHEMA || existing.flowId !== input.flowId || existing.repositoryDigest !== repoKey(root) || existing.mode !== mode || canonical(existing.executionContext) !== canonical(input.executionContext)) fail('ENTROROVE_BUDGET_REINITIALIZE', 'budget is already initialized with a different scope'); return budgetView(existing); } catch (error) { if (error.code !== 'ENOENT') throw error; }
-    const state = { schemaVersion: BUDGET_SCHEMA, flowId: input.flowId, repositoryDigest: repoKey(root), mode, executionContext: input.executionContext,
-      enforced: isEnforced, startedAt: new Date().toISOString(), elapsedMs: 0, ...limits, files: [], readCalls: 0, tokenEstimate: 0, extensions: [] };
-    await atomicJson(file, state); await audit(input.home, root, 'budget-init', { flowId: input.flowId, mode }); return budgetView(state);
-  });
-}
-export async function budgetContext(input) {
-  const { root, file } = await budgetFile(input);
-  return withStateLock(file, async () => {
-    const state = await readJson(file); const isEnforced = enforced(input.executionContext); if (state.enforced && !isEnforced) fail('ENTROROVE_BUDGET_DOWNGRADE', 'an enforced sandbox budget cannot be downgraded');
-    const updated = { ...state, executionContext: input.executionContext, enforced: isEnforced }; await atomicJson(file, updated); return budgetView(updated);
-  });
-}
-export async function budgetStatus(input) { const { file } = await budgetFile(input); return budgetView(await readJson(file)); }
-export async function budgetRead(input) {
-  const { root, file } = await budgetFile(input);
-  return withStateLock(file, async () => {
-    const relative = safePath(input.path); const originalState = await readJson(file); const state = await consumeBudgetRenewal({ file, state: originalState }); const before = budgetView(state);
-    const source = await projectFile(root, relative); const bytes = source.stat.size; const tokens = Math.ceil(bytes / 4); const fresh = !state.files.includes(relative);
-    if (state.enforced && fresh && before.remainingFiles <= 0) fail('ENTROROVE_BUDGET_EXHAUSTED', 'read file budget exhausted');
-    if (state.enforced && before.remainingTokenEstimate !== null && tokens > before.remainingTokenEstimate) fail('ENTROROVE_BUDGET_EXHAUSTED', 'read token budget exhausted');
-    if (state.enforced && before.remainingDurationMs <= 0) fail('ENTROROVE_BUDGET_EXHAUSTED', 'read duration budget exhausted');
-    const updated = { ...state, files: fresh ? [...state.files, relative] : state.files, readCalls: state.readCalls + 1, tokenEstimate: state.tokenEstimate + tokens };
-    await atomicJson(file, updated); await audit(input.home, root, 'budget-read', { flowId: input.flowId, path: relative, tokens });
-    return { schemaVersion: LOCAL_SCHEMA, path: relative, content: await fs.readFile(source.target, 'utf8'), budget: budgetView(updated) };
-  });
-}
-export async function budgetExtend(input) {
-  const { root, file } = await budgetFile(input);
-  return withStateLock(file, async () => {
-    const state = await readJson(file); if (!state.enforced) fail('ENTROROVE_BUDGET_NOT_APPLICABLE', 'budget extension applies only to a cloud sandbox');
-    const confirmation = input.confirmation; const additions = input.additions;
-    if (confirmation?.answer !== 'approve' || typeof confirmation.requestId !== 'string') fail('ENTROROVE_CONFIRMATION_REQUIRED', 'explicit budget confirmation is required');
-    if (!additions || !Number.isSafeInteger(additions.files) || !Number.isSafeInteger(additions.tokenEstimate) || !Number.isSafeInteger(additions.durationMs)
-      || additions.files < 0 || additions.tokenEstimate < 0 || additions.durationMs < 0 || additions.files + additions.tokenEstimate + additions.durationMs === 0) fail('ENTROROVE_EXTENSION_INVALID', 'budget additions must be positive integers');
-    if (state.extensions.some(item => item.requestId === confirmation.requestId)) fail('ENTROROVE_CONFIRMATION_REPLAYED', 'budget confirmation was already applied');
-    const updated = { ...state, maxFiles: state.maxFiles + additions.files, maxTokenEstimate: state.maxTokenEstimate === null ? additions.tokenEstimate : state.maxTokenEstimate + additions.tokenEstimate,
-      maxDurationMs: state.maxDurationMs + additions.durationMs, extensions: [...state.extensions, { requestId: confirmation.requestId, additions, at: new Date().toISOString() }] };
-    await atomicJson(file, updated); await audit(input.home, root, 'budget-extend', { flowId: input.flowId, requestId: confirmation.requestId }); return budgetView(updated);
-  });
-}
-async function coordinationState(input, create = false) {
-  const root = await repositoryRoot(input.repositoryRoot); const flowId = id(input.flowId, 'flowId'); const file = statePath(input.home, 'coordination', root, flowId, 'state.json');
-  if (create) { try { return { root, file, state: await readJson(file) }; } catch (error) { if (error.code !== 'ENOENT') throw error; const state = { schemaVersion: COORDINATION_SCHEMA, flowId, repositoryDigest: repoKey(root), workers: [], leases: [], events: [] }; await atomicJson(file, state); return { root, file, state }; } }
-  return { root, file, state: await readJson(file) };
-}
-async function coordinateUnlocked(input) {
-  const workerCount = input.workerCount ?? 0; if (!Number.isSafeInteger(workerCount) || workerCount < 0 || workerCount > 50) fail('ENTROROVE_WORKER_LIMIT', 'workerCount must be between 0 and 50');
-  if (input.priority !== undefined && !['urgent', 'normal', 'dependency', 'background'].includes(input.priority)) fail('ENTROROVE_PRIORITY_INVALID', 'priority is invalid');
-  const authority = await coordinationState(input, true); const updated = { ...authority.state, maxWorkers: workerCount, priority: input.priority ?? 'normal', events: [...authority.state.events, { event: 'coordinate', at: new Date().toISOString() }] };
-  await atomicJson(authority.file, updated); await audit(input.home, authority.root, 'peer-coordinate', { flowId: input.flowId, workerCount }); return { schemaVersion: LOCAL_SCHEMA, status: 'verified', maxWorkers: workerCount, priority: updated.priority };
-}
-export async function peerCoordinate(input) {
-  const root = await repositoryRoot(input.repositoryRoot); const flowId = id(input.flowId, 'flowId');
-  return withStateLock(statePath(input.home, 'coordination', root, flowId, 'state.json'), () => coordinateUnlocked(input));
-}
-async function spawnUnlocked(input) {
-  const paths = normalizePaths(input.paths); const priority = input.priority ?? 'normal'; if (!['urgent', 'normal', 'dependency', 'background'].includes(priority)) fail('ENTROROVE_PRIORITY_INVALID', 'priority is invalid');
-  const authority = await coordinationState(input, true); const active = authority.state.workers.filter(worker => worker.status === 'active'); if (active.length >= (authority.state.maxWorkers ?? 0)) fail('ENTROROVE_WORKER_LIMIT', 'coordination worker budget is exhausted');
-  if (input.parentWorkerId) fail('ENTROROVE_RECURSION_FORBIDDEN', 'derived workers cannot recursively spawn workers');
-  const workerId = id(input.workerId ?? `worker-${randomUUID()}`, 'workerId'); const leaseId = `lease-${randomUUID()}`; const expiresAt = new Date(Date.now() + 300_000).toISOString();
-  const worker = { workerId, leaseId, flowId: input.flowId, paths, priority, status: 'active', expiresAt, createdAt: new Date().toISOString() };
-  await atomicJson(authority.file, { ...authority.state, workers: [...authority.state.workers, worker], leases: [...authority.state.leases, worker], events: [...authority.state.events, { event: 'spawn-bind', workerId, at: new Date().toISOString() }] });
-  return { schemaVersion: LOCAL_SCHEMA, status: 'verified', workerId, leaseId, paths, expiresAt };
-}
-export async function spawnBind(input) {
-  const root = await repositoryRoot(input.repositoryRoot); const flowId = id(input.flowId, 'flowId');
-  return withStateLock(statePath(input.home, 'coordination', root, flowId, 'state.json'), () => spawnUnlocked(input));
-}
-async function completeUnlocked(input) {
-  const authority = await coordinationState(input); const worker = authority.state.workers.find(item => item.workerId === input.workerId && item.leaseId === input.leaseId && item.status === 'active'); if (!worker) fail('ENTROROVE_LEASE_INVALID', 'coordination lease is invalid');
-  if (Date.parse(worker.expiresAt) <= Date.now()) fail('ENTROROVE_LEASE_EXPIRED', 'coordination lease has expired');
-  const status = input.status ?? 'completed'; if (!['completed', 'failed', 'blocked'].includes(status)) fail('ENTROROVE_STATUS_INVALID', 'peer status is invalid');
-  const updatedWorker = { ...worker, status, completedAt: new Date().toISOString() }; const state = { ...authority.state, workers: authority.state.workers.map(item => item.workerId === worker.workerId ? updatedWorker : item), leases: authority.state.leases.map(item => item.workerId === worker.workerId ? updatedWorker : item) };
-  await atomicJson(authority.file, state); return { schemaVersion: LOCAL_SCHEMA, status: 'verified', workerId: worker.workerId, state: status };
-}
-export async function completePeer(input) {
-  const root = await repositoryRoot(input.repositoryRoot); const flowId = id(input.flowId, 'flowId');
-  return withStateLock(statePath(input.home, 'coordination', root, flowId, 'state.json'), () => completeUnlocked(input));
-}
+  if (Object.hasOwn(input, 'handoffPass') || Object.hasOwn(input, 'provisionalLease')) {
+    return withMutationAudit14(input, 'guarded-write', () => guardedHandoffWrite(input));
+  }
+  return guardedWrite14(input);
+}
+
+
+
+
+
+
+
 async function verifyEvidenceValue(evidence, input, requireBinding = false) {
-  const fields = ['schemaVersion', 'evidenceId', 'kind', 'runner', 'command', 'exitCode', 'durationMs', 'summary', 'artifactSha256', 'subject', 'subjectDigest', 'receipt', 'flowId', 'stepId'];
-  if (!evidence || Object.keys(evidence).some(field => !fields.includes(field)) || evidence.schemaVersion !== EVIDENCE_SCHEMA || typeof evidence.evidenceId !== 'string' || !evidence.evidenceId.trim() || evidence.evidenceId.length > 200 || !['test', 'build', 'lint', 'security', 'benchmark'].includes(evidence.kind)
-    || !['local', 'trusted-runner', 'sandbox'].includes(evidence.runner) || typeof evidence.command !== 'string' || evidence.command.trim().length === 0 || evidence.command.length > 2_000 || !Number.isInteger(evidence.exitCode) || evidence.exitCode < -128 || evidence.exitCode > 255
-    || !Number.isInteger(evidence.durationMs) || evidence.durationMs < 0 || evidence.durationMs > 86_400_000 || typeof evidence.summary !== 'string' || evidence.summary.trim().length === 0 || evidence.summary.length > 4_000 || !SHA256.test(evidence.artifactSha256)) return { verified: false, reason: 'evidence schema invalid' };
-  if (evidence.runner === 'local') return { verified: false, reason: 'local evidence is incomplete without a trusted receipt' };
-  const receipt = evidence.receipt; if (!receipt || ![EVIDENCE_RECEIPT_SCHEMA, 'validator.execution-receipt/1.0'].includes(receipt.schemaVersion)) return { verified: false, reason: 'signed evidence receipt is required' };
-  const binding = { flowId: input.flowId, stepId: input.stepId, snapshotDigest: input.snapshotDigest, contractDigest: input.contractDigest };
-  if (requireBinding) return verifyTrustedEvidence(evidence, binding);
-  const subject = Object.fromEntries(Object.entries(evidence).filter(([key]) => key !== 'receipt'));
-  try { if (receipt.schemaVersion === 'validator.execution-receipt/1.0') { if (typeof input.receiptPublicKey !== 'string' || receipt.subjectDigest !== evidence.subjectDigest || receipt.result?.runner !== 'trusted-runner' || receipt.result.exitCode !== evidence.exitCode || receipt.result.durationMs !== evidence.durationMs || receipt.result.summary !== evidence.summary) throw new Error('Trusted execution receipt is not bound'); const unsigned = Object.fromEntries(Object.entries(receipt).filter(([key]) => key !== 'signature')); verifyReceipt(receipt, unsigned, { schemaVersion: 'validator.execution-receipt/1.0', publicKey: input.receiptPublicKey }); } else verifyReceipt(receipt, subject); return { verified: true, evidence }; } catch (error) { return { verified: false, reason: error instanceof Error ? error.message : String(error) }; }
-}
-export async function verifyCoordinationLease(input) {
-  const authority = await coordinationState(input); const worker = authority.state.workers.find(item => item.workerId === input.workerId && item.leaseId === input.leaseId && item.status === 'active');
-  if (!worker || Date.parse(worker.expiresAt) <= Date.now()) fail('ENTROROVE_LEASE_INVALID', 'coordination lease is invalid or expired');
-  const paths = normalizePaths(input.paths ?? []); if (paths.some(target => !worker.paths.some(scope => target === scope || target.startsWith(`${scope}/`)))) fail('ENTROROVE_LEASE_SCOPE', 'coordination lease does not cover target paths');
-  return { schemaVersion: LOCAL_SCHEMA, verified: true, workerId: worker.workerId, leaseId: worker.leaseId, paths: worker.paths, expiresAt: worker.expiresAt };
+  const publicKey = process.env.ENTROROVE_VALIDATOR_RECEIPT_PUBLIC_KEY?.trim();
+  if (publicKey && input.receiptPublicKey !== undefined && input.receiptPublicKey !== publicKey) {
+    return { verified: false, authentic: false, successful: false, status: 'blocked', evidenceState: 'blocked',
+      code: 'ENTROROVE_EVIDENCE_KEY', reason: 'Supplied receipt key does not match independent verifier configuration' };
+  }
+  const binding = { flowId: input.flowId, stepId: input.stepId, snapshotDigest: input.snapshotDigest,
+    contractDigest: input.contractDigest, receiptPublicKey: input.receiptPublicKey };
+  return requireBinding ? verifyTrustedEvidence(evidence, binding) : verifyTestEvidence(evidence, { publicKey, binding });
 }
+
 export async function signEvidence(input) {
   const root = await repositoryRoot(input.repositoryRoot); const authority = await keyPair(input.home, root); const evidence = { ...input.evidence, schemaVersion: EVIDENCE_SCHEMA, runner: input.evidence?.runner ?? 'local' };
   if (typeof evidence.evidenceId !== 'string' || !evidence.evidenceId.trim() || evidence.evidenceId.length > 200) fail('ENTROROVE_EVIDENCE_ID', 'evidenceId must be a non-empty string up to 200 characters');
@@ -402,69 +256,26 @@ export async function signEvidence(input) {
   return { ...evidence, receipt };
 }
 export async function verifyEvidence(input) { return verifyEvidenceValue(input.evidence, input); }
-export async function mergeVerified(input) {
-  const root = await repositoryRoot(input.repositoryRoot); id(input.flowId, 'flowId'); id(input.stepId, 'stepId'); if (!input.sourceRef || !input.targetRef) fail('ENTROROVE_MERGE_REFS_REQUIRED', 'sourceRef and targetRef are required');
-  if (!input.snapshotReceipt) return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', code: 'ENTROROVE_SNAPSHOT_REQUIRED' };
-  const snapshotReceipt = await loadReceipt({ receipt: input.snapshotReceipt });
-  if (snapshotReceipt.flowId !== input.flowId || snapshotReceipt.stepId !== input.stepId || snapshotReceipt.repositoryDigest !== repoKey(root)) return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', code: 'ENTROROVE_SNAPSHOT_SCOPE' };
-  let manifest;
-  try { ({ manifest } = await snapshotAuthority(input, root, snapshotReceipt)); } catch (error) { return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', code: error.code ?? 'ENTROROVE_SNAPSHOT_BINDING' }; }
-  const binding = { flowId: input.flowId, stepId: input.stepId, snapshotDigest: snapshotReceipt.snapshotDigest, contractDigest: snapshotReceipt.contractDigest, receiptPublicKey: input.receiptPublicKey };
-  const preflight = verifyArchguardPreflight(input.preflight, binding);
-  if (!preflight.verified) return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', code: 'ENTROROVE_PREFLIGHT_BLOCKED', reason: preflight.reason };
-  if (!SHA256.test(binding.contractDigest ?? '')) return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', code: 'ENTROROVE_CONTRACT_DIGEST' };
-  if (!Array.isArray(input.evidence) || input.evidence.length === 0) return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', code: 'ENTROROVE_EVIDENCE_REQUIRED' };
-  const checks = await Promise.all(input.evidence.map(evidence => verifyEvidenceValue(evidence, binding, true))); if (checks.some(check => !check.verified) || input.evidence.some(evidence => evidence.exitCode !== 0)) return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', code: 'ENTROROVE_EVIDENCE_UNVERIFIED', checks };
-  let written = 0; for (const change of input.changes ?? []) { await guardedWrite({ ...change, repositoryRoot: root, home: input.home, flowId: input.flowId, stepId: input.stepId }); written += 1; }
-  await audit(input.home, root, 'merge-verified', { flowId: input.flowId, stepId: input.stepId, sourceRef: input.sourceRef, targetRef: input.targetRef });
-  await appendLedgerRecord({ home: input.home, repositoryRoot: root }, 'merge-verified', { flowId: input.flowId, stepId: input.stepId, sourceRef: input.sourceRef, targetRef: input.targetRef, snapshotDigest: binding.snapshotDigest, contractDigest: binding.contractDigest });
-  return { schemaVersion: LOCAL_SCHEMA, status: 'verified', merged: true, changes: written, sourceRef: input.sourceRef, targetRef: input.targetRef, preflightKeyId: preflight.keyId };
-}
-export async function rollback(input) {
-  const root = await repositoryRoot(input.repositoryRoot); const flowId = id(input.flowId, 'flowId'); const snapshotId = id(input.snapshotId, 'snapshotId'); const manifestPath = path.join(path.dirname(statePath(input.home, 'snapshots', root, flowId, 'manifest.json')), snapshotId, 'manifest.json'); const manifest = await readJson(manifestPath);
-  const integrity = verifySnapshotManifest(manifest, { snapshotId, flowId, stepId: input.stepId ?? manifest.stepId, repositoryDigest: repoKey(root) });
-  if (!integrity.verified) fail('ENTROROVE_SNAPSHOT_CORRUPT', integrity.reason ?? 'snapshot manifest is invalid');
-  for (const entry of manifest.files) { const target = await projectFile(root, entry.path, true); const copy = path.join(path.dirname(manifestPath), entry.path); if (entry.exists) { if (sha256(await fs.readFile(copy)) !== entry.sha256) fail('ENTROROVE_SNAPSHOT_CORRUPT', `${entry.path} snapshot copy is invalid`); await privateDir(path.dirname(target.target)); await fs.copyFile(copy, target.target); } else if (target.exists) await fs.unlink(target.target); }
-  await audit(input.home, root, 'rollback', { flowId, stepId: input.stepId ?? null, snapshotId }); return { schemaVersion: LOCAL_SCHEMA, status: 'verified', rolledBack: true, snapshotId };
-}
+export async function mergeVerified(input) { return executeVerifiedMerge(input); }
+export async function rollback(input) { return rollbackMerge(input); }
 export async function finalGate(input) {
-  const checks = [input.audit, input.test, input.operations]; const passed = checks.every(check => check === true || ['passed', 'green', 'complete'].includes(check?.status));
-  const evidence = Array.isArray(input.evidence) ? input.evidence : [];
-  const bound = input.preflight !== undefined || input.snapshotDigest !== undefined || input.contractDigest !== undefined;
-  const binding = { flowId: input.flowId, stepId: input.stepId, snapshotDigest: input.snapshotDigest, contractDigest: input.contractDigest, receiptPublicKey: input.receiptPublicKey };
-  const preflight = bound ? verifyArchguardPreflight(input.preflight, binding) : { verified: true };
-  const validation = evidence.length ? await Promise.all(evidence.map(item => verifyEvidenceValue(item, bound ? binding : input, bound))) : [];
-  const trusted = evidence.length > 0 && preflight.verified && validation.every(item => item.verified) && evidence.every(evidenceItem => evidenceItem.exitCode === 0);
-  const complete = passed && trusted;
+  if (input.gateId) {
+    const { runFinalGate16 } = await import('./local-final-gate16.mjs');
+    return runFinalGate16(input);
+  }
   if (input.repositoryRoot) {
     const root = await repositoryRoot(input.repositoryRoot);
-    await appendLedgerRecord({ home: input.home, repositoryRoot: root }, 'final-gate', { flowId: input.flowId ?? null, stepId: input.stepId ?? null, status: complete ? 'complete' : 'blocked', evidenceCount: evidence.length });
+    await appendLedgerRecord({ home: input.home, repositoryRoot: root }, 'final-gate',
+      { flowId: input.flowId ?? null, stepId: input.stepId ?? null, status: 'blocked',
+        code: 'ENTROROVE_FINAL_GATE_ACTUAL_CHECKS_REQUIRED' });
   }
-  return { schemaVersion: LOCAL_SCHEMA, status: complete ? 'complete' : 'blocked', authority: 'trusted-local-runner', checks: { audit: Boolean(passed && checks[0]), test: Boolean(passed && checks[1]), operations: Boolean(passed && checks[2]) }, evidenceCount: evidence.length, guarantee: complete ? 'local-completion-gate-green' : 'local-completion-gate-blocked', preflight: preflight.verified ? 'verified' : 'blocked' };
+  return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', authority: 'local-evidence',
+    code: 'ENTROROVE_FINAL_GATE_ACTUAL_CHECKS_REQUIRED',
+    checks: { audit: false, test: false, operations: false },
+    guarantee: 'Original engine, frozen role plans and actual three-party checks are required' };
 }
-export const LOCAL_OPERATION_SCHEMAS = Object.fromEntries([
-  ['capabilities', []], ['snapshot-plan', ['repositoryRoot', 'flowId', 'stepId', 'paths']], ['snapshot-verify', ['repositoryRoot', 'flowId', 'stepId', 'snapshotId']],
-  ['mutate-gate', ['repositoryRoot', 'flowId', 'stepId', 'accepted', 'receipt']], ['gate-issue', ['repositoryRoot', 'flowId', 'stepId', 'accepted', 'receipt']],
-  ['gate-verify', ['repositoryRoot', 'flowId', 'stepId', 'gatePassPath', 'targetPath']], ['guarded-write', ['repositoryRoot', 'flowId', 'stepId', 'gatePassPath', 'targetPath', 'content']],
-  ['budget-init', ['repositoryRoot', 'flowId', 'mode', 'executionContext']], ['budget-context', ['repositoryRoot', 'flowId', 'executionContext']], ['budget-read', ['repositoryRoot', 'flowId', 'path']], ['budget-status', ['repositoryRoot', 'flowId']], ['budget-extend', ['repositoryRoot', 'flowId', 'confirmation', 'additions']],
-  ['peer-coordinate', ['repositoryRoot', 'flowId']], ['coordinate', ['repositoryRoot', 'flowId']], ['spawn-bind', ['repositoryRoot', 'flowId', 'paths']], ['peer-complete', ['repositoryRoot', 'flowId', 'workerId', 'leaseId']], ['complete', ['repositoryRoot', 'flowId', 'workerId', 'leaseId']], ['lease-verify', ['repositoryRoot', 'flowId', 'workerId', 'leaseId', 'paths']],
-  ['evidence-sign', ['repositoryRoot', 'evidence']], ['evidence-verify', ['repositoryRoot', 'evidence']], ['merge-verified', ['repositoryRoot', 'flowId', 'stepId', 'sourceRef', 'targetRef', 'snapshotReceipt', 'evidence', 'preflight']], ['rollback', ['repositoryRoot', 'flowId', 'snapshotId']], ['final-gate', ['repositoryRoot', 'audit', 'test', 'operations', 'evidence']],
-  ['formula-evaluate', ['formula']], ['formula-graph', ['formulas']], ['formula-final-gate', ['engine']], ['calculation-final-gate', ['engine']],
-  ['run-approved-plan', ['repositoryRoot', 'planPath', 'approvalPath', 'signerConfigPath']],
-].map(([operation, required]) => [operation, { type: 'object', additionalProperties: false, required }]));
-Object.assign(LOCAL_OPERATION_SCHEMAS, LOCAL_LEDGER_SCHEMAS);
-Object.assign(LOCAL_OPERATION_SCHEMAS, LOCAL_RENEWAL_SCHEMAS, LOCAL_PROBE_SCHEMAS);
-Object.assign(LOCAL_OPERATION_SCHEMAS, LOCAL_TASK_ROUTING_SCHEMAS);
-Object.freeze(LOCAL_OPERATION_SCHEMAS);
-export const LOCAL_CAPABILITIES = Object.freeze({ schemaVersion: LOCAL_SCHEMA, operations: Object.freeze([
-  'capabilities', 'snapshot-plan', 'snapshot-verify', 'mutate-gate', 'gate-issue', 'gate-verify', 'guarded-write',
-  'budget-init', 'budget-context', 'budget-read', 'budget-status', 'budget-extend', 'peer-coordinate', 'spawn-bind',
-  'peer-complete', 'complete', 'lease-verify', 'evidence-sign', 'evidence-verify', 'merge-verified', 'rollback', 'final-gate',
-  'formula-evaluate', 'formula-graph', 'formula-final-gate', 'calculation-final-gate', 'run-approved-plan',
-  ...Object.keys(LOCAL_LEDGER_OPERATIONS),
-  ...Object.keys(LOCAL_RENEWAL_OPERATIONS), ...Object.keys(LOCAL_PROBE_OPERATIONS),
-  ...Object.keys(LOCAL_TASK_ROUTING_OPERATIONS),
-]), operationSchemas: LOCAL_OPERATION_SCHEMAS, stateDirectory: '~/.entrorove', forbidGitBranch: true, forbidWorktree: true, evidenceSchema: EVIDENCE_SCHEMA, budgets: READ_BUDGETS, validatorRunner: RUNNER_CAPABILITIES });
+
+export const LOCAL_CAPABILITIES = Object.freeze({ schemaVersion: LOCAL_SCHEMA, operations: Object.freeze(Object.keys(LOCAL_OPERATION_SCHEMAS)), operationSchemas: LOCAL_OPERATION_SCHEMAS, stateDirectory: '~/.entrorove', forbidGitBranch: true, forbidWorktree: true, evidenceSchema: EVIDENCE_SCHEMA, budgets: READ_BUDGETS, validatorRunner: RUNNER_CAPABILITIES, workflowRunner: WORKFLOW_LOCAL_CAPABILITIES });
 export function capabilities() { return LOCAL_CAPABILITIES; }
 export const guardedWriteFile = guardedWrite;
 export const verifyMutationPassFile = verifyMutationPass;
@@ -474,7 +285,7 @@ export const readFileWithinBudget = budgetRead;
 export const readBudgetStatus = budgetStatus;
 export const extendReadBudget = budgetExtend;
 export const runLocalFinalGate = finalGate;
-export { Decimal, evaluateFormula, evaluateFormulaGraph, formulaFinalGate, formulaFinalGateFile, runApprovedPlan };
+export { Decimal, evaluateFormula, evaluateFormulaGraph, formulaFinalGate, formulaFinalGateFile, runApprovedPlan, runWorkflowLocalStep };
 export { LOCAL_LEDGER_OPERATIONS };
 export { LOCAL_RENEWAL_OPERATIONS, LOCAL_PROBE_OPERATIONS };
 export { branchCreate, branchList, branchSwitch, diffReport, preflight, ledgerQuery, appendLedgerRecord, chainInit, chainResume, chainStatus, chainAnswer };

package/local-final-gate16-bundle.mjs

@@ -0,0 +1,21 @@
+import { readFile } from 'node:fs/promises';
+import { FINAL_GATE16_BUNDLE_PREFIX } from './local-final-gate16-contract.mjs';
+import { fail16, sha16 } from './local-final-gate16-checks.mjs';
+
+export const FINAL_GATE16_CHECKER_PINS = Object.freeze({
+  'local-final-gate16-worker.mjs': '344d64b6c1c5552b96960e0d8514a876a3dbfa9762ab9eb749038e8351727121',
+  'local-final-gate16-checks.mjs': '1dd30e9666d458d8b12ca6e4975f6f0ac8450c3ea9cbecc7401ae037f66b589a',
+  'local-decimal.mjs': '93580b0cbdac2e881942658c1cd10394b432219f8657afaaaf4cb1c35c91d644',
+  'local-formula-ast.mjs': '768ec4aa88a127588035d5b94aa2721df00e3e0576dc7e341baaead44795f314',
+  'local-formula-engine.mjs': 'cfc44f03bb8dc4797f9f9e859a64a2dd5e4dd316db45624c03f7f8fad3202ede',
+  'local-formula-tests.mjs': 'd6d2809572c46955e6b556023ed6a12362c8acd0ad0d5be3b1b2dd64439215c0',
+});
+export async function finalGate16Bundle() {
+  const files = [];
+  for (const [name, sha256] of Object.entries(FINAL_GATE16_CHECKER_PINS)) {
+    const bytes = await readFile(new URL(name, import.meta.url));
+    if (sha16(bytes) !== sha256) fail16('FINAL_GATE16_CHECKER_PIN', 'The installed checker closure differs from its reviewed source');
+    files.push({ path: FINAL_GATE16_BUNDLE_PREFIX + name, sha256, bytes });
+  }
+  return files.sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0);
+}