@entrorove/skill 0.1.23 → 0.1.25

package/local-task-handoff-overlay-wire.mjs

@@ -0,0 +1,94 @@
+import { createPublicKey, verify } from 'node:crypto';
+import { canonical, sha256 } from './local-integrity.mjs';
+import Ajv from 'ajv';
+import { HANDOFF_PASS_FIELDS, HANDOFF_LEASE_FIELDS, HANDOFF_CANDIDATE_FIELDS, HANDOFF_SCOPE_CONTRACT_SCHEMA,
+  HANDOFF_ARCHITECTURE_AUTHORITY_SCHEMA } from './local-task-handoff-contracts.mjs';
+export { HANDOFF_PASS_FIELDS, HANDOFF_LEASE_FIELDS, HANDOFF_CANDIDATE_FIELDS } from './local-task-handoff-contracts.mjs';
+
+
+
+export const HANDOFF_RESTORATION_FIELDS = ['schemaVersion', 'handoffId', 'messageRequestId', 'ownerId', 'taskId', 'flowId', 'taskDigest',
+  'chainDigest', 'localRepositoryDigest', 'epoch', 'previousEpoch', 'receiverOriginalScopeDigest', 'paths', 'claimedPassDigest',
+  'claimedLeaseDigest', 'revokedPassIds', 'revokedLeaseIds', 'completionReceiptId', 'completionIdleReceiptDigest', 'baselineReceiptDigest', 'issuedAt', 'expiresAt'];
+
+function fail(message) { const error = new Error(message); error.code = 'ENTROROVE_HANDOFF_OVERLAY'; throw error; }
+export function canonicalHandoffSignature(value) {
+  if (typeof value !== 'string' || !/^[A-Za-z0-9_-]{86}$/.test(value)) fail('handoff signature encoding must be canonical Ed25519 base64url');
+  const bytes = Buffer.from(value, 'base64url');
+  if (bytes.length !== 64 || bytes.toString('base64url') !== value) fail('handoff signature encoding must round-trip exactly');
+  return bytes;
+}
+export function overlayAuthority(value, fields, schema, live = true) {
+  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).sort().join('\0') !== [...fields, 'authorityReceipt'].sort().join('\0')) fail('handoff overlay authority fields are invalid');
+  const { authorityReceipt: receipt, ...payload } = value;
+  if (Object.hasOwn(payload, 'messageRequestId') && (typeof payload.messageRequestId !== 'string'
+    || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(payload.messageRequestId))) fail('handoff original message request identifier is invalid');
+  const encoded = process.env.ENTROROVE_WORKFLOW_PLAN_PUBLIC_KEY; let key, der;
+  try { der = Buffer.from(encoded ?? '', 'base64'); key = createPublicKey({ key: der, format: 'der', type: 'spki' }); }
+  catch { fail('handoff overlay cloud public identity is unavailable'); }
+  const bytes = Buffer.from(canonical(payload));
+  if (key.asymmetricKeyType !== 'ed25519' || key.export({ format: 'der', type: 'spki' }).toString('base64') !== encoded
+    || payload.schemaVersion !== schema || !receipt || Object.keys(receipt).sort().join('\0') !== ['schemaVersion', 'keyId', 'payloadDigest', 'signature'].sort().join('\0')
+    || receipt.schemaVersion !== 'entrorove.workflow-authority-receipt/1.0' || receipt.keyId !== sha256(der)
+    || receipt.payloadDigest !== sha256(bytes) || !verify(null, bytes, key, canonicalHandoffSignature(receipt.signature))) fail('handoff overlay cloud signature or original binding is invalid');
+  const issued = Date.parse(payload.issuedAt), expires = Date.parse(payload.expiresAt);
+  if (!Number.isFinite(issued) || !Number.isFinite(expires) || issued > Date.now() || expires <= issued || expires - issued > 90_000
+    || (live && expires <= Date.now())) fail('handoff overlay authority is expired');
+  return payload;
+}
+const permissionAjv = new Ajv({ strict: true });
+const scopeValidator = permissionAjv.compile(HANDOFF_SCOPE_CONTRACT_SCHEMA);
+const architectureValidator = permissionAjv.compile(HANDOFF_ARCHITECTURE_AUTHORITY_SCHEMA);
+const permissionFields = ['previousOwnerScopeContract', 'scopeContract', 'architectureAuthority'];
+function receiverPermissions(pass, challenge, live) {
+  const original = pass.previousOwnerScopeContract, scope = pass.scopeContract, architecture = pass.architectureAuthority;
+  const matches = (target, paths) => paths.some(prefix => target === prefix || target.startsWith(`${prefix}/`));
+  if (!scopeValidator(original) || !scopeValidator(scope) || sha256(canonical(original)) !== pass.previousOwnerScopeDigest
+    || sha256(canonical(scope)) !== pass.scopeContractDigest || canonical(scope) !== canonical({ ...original, allowedPaths: pass.paths })
+    || pass.paths.some(target => !matches(target, original.allowedPaths) || matches(target, original.forbiddenPaths))) fail('handoff full scope permission changed its original digest, whitelist or frozen mutation limits');
+  if (architecture === null) {
+    if (pass.architectureContractDigest !== null) fail('handoff permission omitted its original architecture authority');
+    return;
+  }
+  if (!architectureValidator(architecture) || architecture.flowId !== pass.previousOwnerFlowId || architecture.ownerId !== pass.ownerId
+    || architecture.taskDigest !== challenge.previousOwnerTaskDigest || architecture.chainDigest !== challenge.previousOwnerChainDigest
+    || architecture.contractDigest !== pass.architectureContractDigest || sha256(canonical(architecture.contract)) !== architecture.contractDigest
+    || architecture.revision !== architecture.contract.revision || sha256(canonical(architecture.ledger)) !== architecture.ledgerDigest
+    || architecture.driftEpochStart > architecture.ledger.length
+    || (live && (architecture.interrupted || architecture.driftStatus === 'red' || architecture.decisions.some(row => row.status === 'pending')))) fail('handoff architecture permission changed its original source identity, contract, ledger or active drift boundary');
+  for (const row of architecture.decisions) {
+    if (row.interactionDigest !== sha256(canonical(row.interaction)) || canonical(row.intent) !== canonical(row.interaction.callback.payload)
+      || row.actorId !== architecture.ownerId || !row.answer || !row.answerRequestId || !row.answeredAt
+      || row.interaction.callback.operation !== (row.intent.action === 'update' ? 'contract-update' : 'resume')) fail('handoff architecture permission lost its actual complete decision history binding');
+  }
+}
+export function receiverClaim(value, ctx, live = true) {
+  const present = permissionFields.filter(field => Object.hasOwn(value?.pass ?? {}, field));
+  if (present.length !== 3 && (present.length || live)) fail('live handoff requires full original scope and architecture permissions; incomplete grants are history only');
+  const fields = present.length ? HANDOFF_PASS_FIELDS : HANDOFF_PASS_FIELDS.filter(field => !permissionFields.includes(field));
+  const pass = overlayAuthority(value?.pass, fields, 'entrorove.task-handoff-write-pass/1.0', live);
+  const lease = overlayAuthority(value?.lease, HANDOFF_LEASE_FIELDS, 'entrorove.task-handoff-provisional-lease/1.0', live);
+  const challenge = overlayAuthority(value?.challenge, HANDOFF_CANDIDATE_FIELDS, 'entrorove.task-handoff-scope-challenge/1.0', false);
+  const common = ['handoffId', 'messageRequestId', 'ownerId', 'flowId', 'taskDigest', 'chainDigest', 'runnerKeyId', 'localRepositoryDigest', 'epoch', 'receiverEpoch', 'paths'];
+  if (pass.flowId !== ctx.flowId || pass.localRepositoryDigest !== ctx.repo || common.some(key => canonical(pass[key]) !== canonical(lease[key]) || canonical(pass[key]) !== canonical(challenge[key]))
+    || pass.receiverTaskId !== lease.taskId || pass.receiverTaskId !== challenge.receiverTaskId || lease.purpose !== 'takeover-write'
+    || lease.mutationAllowed !== true || lease.generation !== 1 || pass.passId !== lease.passId || lease.passDigest !== sha256(canonical(value.pass))
+    || pass.receiptId !== lease.claimReceiptId || lease.challengeId !== challenge.challengeId || pass.previousOwnerTaskId !== challenge.previousOwnerTaskId
+    || pass.previousOwnerFlowId !== challenge.previousOwnerFlowId || pass.previousOwnerScopeDigest !== challenge.originalScopeDigest
+    || pass.receiverOriginalScopeDigest !== challenge.receiverOriginalScopeDigest || !Array.isArray(pass.paths) || !pass.paths.length
+    || new Set(pass.paths).size !== pass.paths.length || !Number.isSafeInteger(pass.receiverEpoch) || pass.receiverEpoch < 1) fail('handoff pass, lease and fresh scope challenge do not bind one receiver takeover');
+  if (present.length) receiverPermissions(pass, challenge, live);
+  return { pass, lease, challenge };
+}
+export function receiverRestoration(value, claim, ctx, live = true) {
+  const payload = overlayAuthority(value, HANDOFF_RESTORATION_FIELDS, 'entrorove.task-handoff-receiver-restoration/1.0', live);
+  const { pass, lease } = receiverClaim(claim, ctx, false);
+  if (payload.flowId !== ctx.flowId || payload.localRepositoryDigest !== ctx.repo || payload.previousEpoch !== pass.receiverEpoch
+    || payload.epoch !== pass.receiverEpoch + 1 || payload.taskId !== pass.receiverTaskId
+    || ['handoffId', 'messageRequestId', 'ownerId', 'taskDigest', 'chainDigest', 'receiverOriginalScopeDigest'].some(key => payload[key] !== pass[key])
+    || payload.claimedPassDigest !== sha256(canonical(claim.pass)) || payload.claimedLeaseDigest !== sha256(canonical(claim.lease))
+    || !Array.isArray(payload.revokedPassIds) || !payload.revokedPassIds.includes(pass.passId)
+    || !Array.isArray(payload.revokedLeaseIds) || !payload.revokedLeaseIds.includes(lease.leaseId)
+    || !Array.isArray(payload.paths) || !payload.paths.length || new Set(payload.paths).size !== payload.paths.length) fail('handoff restoration does not revoke the actual claimed pass and lease or restore its original receiver scope');
+  return payload;
+}

package/local-task-handoff-read-authority.mjs

@@ -0,0 +1,236 @@
+import { createPublicKey, randomUUID, sign, verify } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { canonical, sha256 } from './local-integrity.mjs';
+import { withStateLock } from './local-state-lock.mjs';
+import { atomic, context, readRegistry, regular } from './local-task-handoff-storage.mjs';
+import { readTaskHandoffFence } from './local-task-handoff-fence.mjs';
+import { loadTaskHandoffSigner } from './local-task-handoff-observation.mjs';
+import { canonicalHandoffSignature, HANDOFF_CANDIDATE_FIELDS, overlayAuthority } from './local-task-handoff-overlay-wire.mjs';
+
+const SCHEMA = 'entrorove.task-handoff-read-registrations/1.0';
+const RECEIPT = 'entrorove.task-handoff-read-registration/1.0';
+const LEASE_FIELDS = ['schemaVersion', 'purpose', 'leaseId', 'handoffId', 'messageRequestId', 'ownerId', 'taskId',
+  'flowId', 'stepId', 'taskDigest', 'chainDigest', 'challengeId', 'runnerKeyId', 'localRepositoryDigest', 'epoch',
+  'receiverEpoch', 'baselineReceiptDigest', 'paths', 'mutationAllowed', 'issuedAt', 'expiresAt'];
+const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/, SHA = /^[0-9a-f]{64}$/;
+const BINDING_FIELDS = ['taskId', 'flowId', 'ownerId', 'taskDigest', 'chainDigest', 'runnerKeyId', 'localRepositoryDigest'];
+const RECEIPT_FIELDS = ['schemaVersion', 'registrationId', ...BINDING_FIELDS, 'repositoryRoot', 'readHome', 'epoch',
+  'challengeId', 'handoffId', 'messageRequestId', 'candidateDigest', 'leaseDigest', 'sourceCheckpointDigest',
+  'receiverCheckpointDigest', 'originalScopeDigest', 'receiverOriginalScopeDigest', 'previousOwnerAcceptanceReceiptId',
+  'receiverAcceptanceReceiptId', 'paths', 'sequence', 'previousReceiptDigest', 'initialRegistration',
+  'previousRegistryDigest', 'committedRegistryDigest', 'initialFenceDigest', 'registeredAt', 'keyId', 'signature'];
+function fail(message) { throw Object.assign(new Error(message), { code: 'ENTROROVE_HANDOFF_READ_AUTHORITY' }); }
+function exact(value, fields, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || canonical(Object.keys(value).sort()) !== canonical([...fields].sort())) fail(`${label} fields are invalid`);
+}
+function pinnedRunner() {
+  try {
+    const encoded = process.env.ENTROROVE_TASK_HANDOFF_RUNNER_PUBLIC_KEY, der = Buffer.from(encoded ?? '', 'base64');
+    const key = createPublicKey({ key: der, type: 'spki', format: 'der' });
+    if (key.asymmetricKeyType !== 'ed25519' || key.export({ type: 'spki', format: 'der' }).toString('base64') !== encoded) fail('configured read runner key is not canonical');
+    return { key, keyId: sha256(der) };
+  } catch { fail('configured trusted read runner is unavailable'); }
+}
+function safePaths(values) {
+  if (!Array.isArray(values) || !values.length || values.length > 512 || new Set(values).size !== values.length
+    || canonical([...values].sort()) !== canonical(values)) fail('inspection paths must be exact, sorted and unique');
+  for (const value of values) {
+    if (typeof value !== 'string' || !value || value !== value.normalize('NFC') || path.isAbsolute(value)
+      || /^[A-Za-z]:/.test(value) || /[\\\u0000-\u001f\u007f]/.test(value)
+      || value.split('/').some(part => !part || part === '.' || part === '..')) fail('inspection path is unsafe');
+  }
+}
+function proof(input, live = true) {
+  const candidate = overlayAuthority(input.handoffCandidate, HANDOFF_CANDIDATE_FIELDS, 'entrorove.task-handoff-scope-challenge/1.0', live);
+  const lease = overlayAuthority(input.provisionalLease, LEASE_FIELDS, 'entrorove.task-handoff-provisional-lease/1.0', live);
+  for (const [field, value] of Object.entries(candidate)) {
+    if (field.endsWith('Digest') || field === 'runnerKeyId') {
+      if (!(field === 'localRepositoryDigest' ? /^[0-9a-f]{32}$/ : SHA).test(value ?? '')) fail('inspection original digest binding is invalid');
+    } else if (HANDOFF_CANDIDATE_FIELDS.includes(field) && !['schemaVersion', 'paths', 'epoch', 'receiverEpoch', 'issuedAt', 'expiresAt'].includes(field)
+      && (typeof value !== 'string' || !ID.test(value))) fail('inspection original identifier is invalid');
+  }
+  safePaths(candidate.paths);
+  const common = ['handoffId', 'messageRequestId', 'ownerId', 'flowId', 'stepId', 'taskDigest', 'chainDigest', 'challengeId',
+    'runnerKeyId', 'localRepositoryDigest', 'epoch', 'receiverEpoch', 'baselineReceiptDigest', 'paths', 'issuedAt', 'expiresAt'];
+  if (common.some(field => canonical(candidate[field]) !== canonical(lease[field])) || lease.taskId !== candidate.receiverTaskId
+    || lease.purpose !== 'scope-inspection' || lease.mutationAllowed !== false || lease.leaseId !== `handoff-read-${candidate.challengeId}`
+    || candidate.stepId !== `handoff-${candidate.handoffId}` || candidate.runnerKeyId !== pinnedRunner().keyId
+    || !Number.isSafeInteger(candidate.epoch) || candidate.epoch < 1 || !Number.isSafeInteger(candidate.receiverEpoch)
+    || candidate.receiverEpoch < 1) fail('read lease does not bind one immutable scope-inspection candidate');
+  return { candidate, lease, candidateDigest: sha256(canonical(input.handoffCandidate)), leaseDigest: sha256(canonical(input.provisionalLease)) };
+}
+function binding(candidate) {
+  return Object.fromEntries(BINDING_FIELDS.map(field => [field, field === 'taskId' ? candidate.receiverTaskId : candidate[field]]));
+}
+const fileFor = ctx => path.join(path.dirname(ctx.file), 'read-authorities.json');
+const markerPrefix = ctx => `inspection:${sha256(ctx.registryKey)}:`;
+const markerFor = (ctx, record) => `${markerPrefix(ctx)}${sha256(canonical([record.receipt.candidateDigest, record.receipt.leaseDigest]))}`;
+function verifyRecord(record, ctx, sequence, previous, home) {
+  exact(record, ['handoffCandidate', 'provisionalLease', 'receipt'], 'persisted read registration');
+  const parsed = proof(record, false), receipt = record.receipt; exact(receipt, RECEIPT_FIELDS, 'read registration receipt');
+  const { signature, ...core } = receipt, runner = pinnedRunner(), original = binding(parsed.candidate);
+  const signed = Buffer.from(canonical(core)), at = Date.parse(receipt.registeredAt);
+  if (receipt.schemaVersion !== RECEIPT || receipt.keyId !== runner.keyId || receipt.runnerKeyId !== runner.keyId
+    || !verify(null, signed, runner.key, canonicalHandoffSignature(signature)) || !ID.test(receipt.registrationId ?? '')
+    || receipt.sequence !== sequence || receipt.previousReceiptDigest !== previous || !Number.isFinite(at)
+    || at < Date.parse(parsed.candidate.issuedAt) || at >= Date.parse(parsed.candidate.expiresAt) || at > Date.now()
+    || receipt.repositoryRoot !== ctx.root || receipt.localRepositoryDigest !== ctx.repo || receipt.flowId !== ctx.flowId
+    || typeof receipt.readHome !== 'string' || !path.isAbsolute(receipt.readHome) || path.resolve(receipt.readHome) !== receipt.readHome
+    || receipt.readHome !== home || receipt.epoch !== parsed.candidate.receiverEpoch - 1
+    || BINDING_FIELDS.some(field => receipt[field] !== original[field])
+    || receipt.candidateDigest !== parsed.candidateDigest || receipt.leaseDigest !== parsed.leaseDigest
+    || typeof receipt.initialRegistration !== 'boolean' || !SHA.test(receipt.previousRegistryDigest ?? '')
+    || !SHA.test(receipt.committedRegistryDigest ?? '') || (receipt.initialRegistration ? !SHA.test(receipt.initialFenceDigest ?? '') : receipt.initialFenceDigest !== null)) fail('persisted read registration changed its original signed home or proof chain');
+  for (const field of ['challengeId', 'handoffId', 'messageRequestId', 'sourceCheckpointDigest', 'receiverCheckpointDigest',
+    'originalScopeDigest', 'receiverOriginalScopeDigest', 'previousOwnerAcceptanceReceiptId', 'receiverAcceptanceReceiptId', 'paths']) {
+    if (canonical(receipt[field]) !== canonical(parsed.candidate[field])) fail('read registration lost its full original scope and acceptance binding');
+  }
+  return original;
+}
+async function history(ctx, registry) {
+  const markers = registry.consumed.filter(value => typeof value === 'string' && value.startsWith(markerPrefix(ctx)));
+  let value;
+  try {
+    const control = await regular(fileFor(ctx), 8 * 1024 * 1024);
+    if ((process.platform !== 'win32' && (control.stat.mode & 0o077))
+      || (typeof process.getuid === 'function' && control.stat.uid !== process.getuid())) fail('read authority history must be owned and private');
+    value = JSON.parse(control.bytes.toString('utf8'));
+  } catch (error) { if (error.code !== 'ENOENT') throw error; if (markers.length) fail('registered read authority history is missing; recovery is required'); return null; }
+  exact(value, ['schemaVersion', 'records', 'pending'], 'read authority history');
+  if (value.schemaVersion !== SCHEMA || !Array.isArray(value.records) || value.records.length > 1024
+    || (!value.records.length && !value.pending)) fail('read authority history is invalid');
+  const all = [...value.records, ...(value.pending ? [value.pending] : [])], home = await fs.realpath(ctx.home);
+  let previous = null, original = null; const seen = new Set();
+  for (let index = 0; index < all.length; index++) {
+    const record = all[index], current = verifyRecord(record, ctx, index + 1, previous, home);
+    if (original && canonical(original) !== canonical(current)) fail('read history replaced its original receiver registration');
+    original = current; previous = sha256(canonical(record.receipt)); const marker = markerFor(ctx, record);
+    if (seen.has(marker) || (index < value.records.length && !markers.includes(marker))) fail('read authority history was duplicated or lost its external anchor');
+    seen.add(marker);
+  }
+  if (markers.some(marker => !seen.has(marker)) || new Set(markers).size !== markers.length) fail('read authority history dropped a retained external record');
+  const registered = registry.bindings[ctx.registryKey];
+  if (registered ? BINDING_FIELDS.some(field => registered[field] !== original[field]) : value.records.length || !value.pending.receipt.initialRegistration) fail('read authority lost its original actual runner registration');
+  return value;
+}
+// Called by the shared native context before any scope snapshot, claim or execution operation.
+// It validates controls only; expired inspection history can bind home but never authorize a read.
+export async function verifyTaskHandoffReadHomeAtContext(ctx) {
+  const value = await history(ctx, await readRegistry(ctx.registry));
+  return value ? { readHome: value.records[0]?.receipt.readHome ?? value.pending.receipt.readHome } : null;
+}
+function freshState(ctx) {
+  return { schemaVersion: 'entrorove.task-handoff-local-state/1.0', flowId: ctx.flowId, localRepositoryDigest: ctx.repo,
+    status: 'active', epoch: 0, activities: [], revokedPassIds: [], revokedLeaseIds: [], releaseReceipt: null,
+    baselineReceipt: null, resumeAuthorization: null, receiverClaim: null, receiverRestoration: null, receiverCompletion: null,
+    executionAttempts: [], writeArchive: null, writeArchiveHistory: [] };
+}
+function current(state, parsed, original, home) {
+  if (state.status !== 'active' || state.epoch !== parsed.candidate.receiverEpoch - 1
+    || (state.receiverClaim && !state.receiverRestoration)
+    || BINDING_FIELDS.some(field => original[field] !== binding(parsed.candidate)[field])
+    || state.executionAttempts.some(item => item.executionHome !== home)) fail('inspection cannot replace the current original receiver epoch or execution home');
+}
+function view(record) {
+  return { schemaVersion: RECEIPT, registered: true, mutationAllowed: false, readHome: record.receipt.readHome,
+    epoch: record.receipt.epoch, candidateDigest: record.receipt.candidateDigest, leaseDigest: record.receipt.leaseDigest, receipt: record.receipt };
+}
+async function finishPending(ctx, value, registry, input, home) {
+  const record = value.pending, receipt = record.receipt, parsed = proof(input);
+  if (canonical(record.handoffCandidate) !== canonical(input.handoffCandidate) || canonical(record.provisionalLease) !== canonical(input.provisionalLease)
+    || receipt.readHome !== home) fail('pending control registration requires its exact original signed proof and home');
+  const before = sha256(canonical(registry)), original = binding(parsed.candidate), initial = freshState(ctx);
+  if (![receipt.previousRegistryDigest, receipt.committedRegistryDigest].includes(before)) fail('pending registration cannot replace changed native registry history');
+  if (receipt.initialRegistration) {
+    let retained;
+    try { retained = JSON.parse((await regular(ctx.file, 9 * 1024 * 1024)).bytes.toString('utf8')); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; }
+    if (sha256(canonical(initial)) !== receipt.initialFenceDigest
+      || (retained && canonical(retained) !== canonical(initial))) fail('pending inspection cannot rebuild an existing execution or handoff history');
+    if (!retained) await atomic(ctx.file, initial);
+  } else current(await readTaskHandoffFence(input), parsed, original, home);
+  const marker = markerFor(ctx, record), next = { ...registry, bindings: { ...registry.bindings, [ctx.registryKey]: registry.bindings[ctx.registryKey] ?? original },
+    consumed: registry.consumed.includes(marker) ? registry.consumed : [...registry.consumed, marker] };
+  if (sha256(canonical(next)) !== receipt.committedRegistryDigest) fail('pending control registration changed its original commit');
+  if (before !== receipt.committedRegistryDigest) await atomic(ctx.registry, next);
+  await atomic(fileFor(ctx), { ...value, records: [...value.records, record], pending: null });
+  return view(record);
+}
+export async function registerTaskHandoffReadAuthority(input) {
+  const parsed = proof(input), ctx = await context(input, true), home = await fs.realpath(ctx.home);
+  if (parsed.candidate.flowId !== ctx.flowId || parsed.candidate.localRepositoryDigest !== ctx.repo) fail('inspection proof belongs to another actual flow or repository');
+  return withStateLock(ctx.registry, () => withStateLock(ctx.file, async () => {
+    const registry = await readRegistry(ctx.registry), retained = await history(ctx, registry);
+    if (retained?.pending) return finishPending(ctx, retained, registry, input, home);
+    const original = binding(parsed.candidate), registered = registry.bindings[ctx.registryKey];
+    let state;
+    if (registered) state = await readTaskHandoffFence(input);
+    else {
+      if (parsed.candidate.receiverEpoch !== 1) fail('an inspection lease cannot reconstruct a lost later receiver epoch');
+      try { await fs.lstat(ctx.file); fail('unregistered native history cannot be replaced by a scope inspection'); }
+      catch (error) { if (error.code !== 'ENOENT') throw error; }
+      state = freshState(ctx);
+    }
+    current(state, parsed, registered ?? original, home);
+    const existing = retained?.records.find(record => record.receipt.candidateDigest === parsed.candidateDigest && record.receipt.leaseDigest === parsed.leaseDigest);
+    if (existing) return view(existing);
+    const records = retained?.records ?? [];
+    if (records.length >= 1024 || registry.consumed.length >= 50000) fail('read authority registry is full; retain and reconcile its history');
+    const marker = `${markerPrefix(ctx)}${sha256(canonical([parsed.candidateDigest, parsed.leaseDigest]))}`;
+    const next = { ...registry, bindings: { ...registry.bindings, [ctx.registryKey]: registered ?? original }, consumed: [...registry.consumed, marker] };
+    const core = { schemaVersion: RECEIPT, registrationId: randomUUID(), ...original, repositoryRoot: ctx.root, readHome: home,
+      epoch: state.epoch, ...Object.fromEntries(['challengeId', 'handoffId', 'messageRequestId', 'sourceCheckpointDigest', 'receiverCheckpointDigest',
+        'originalScopeDigest', 'receiverOriginalScopeDigest', 'previousOwnerAcceptanceReceiptId', 'receiverAcceptanceReceiptId', 'paths'].map(field => [field, parsed.candidate[field]])),
+      candidateDigest: parsed.candidateDigest, leaseDigest: parsed.leaseDigest, sequence: records.length + 1,
+      previousReceiptDigest: records.length ? sha256(canonical(records.at(-1).receipt)) : null,
+      initialRegistration: !registered, previousRegistryDigest: sha256(canonical(registry)), committedRegistryDigest: sha256(canonical(next)),
+      initialFenceDigest: registered ? null : sha256(canonical(state)), registeredAt: new Date().toISOString(), keyId: parsed.candidate.runnerKeyId };
+    const signer = await loadTaskHandoffSigner(ctx, process.env.ENTROROVE_TASK_HANDOFF_WRITE_SIGNER_CONFIG, core.keyId);
+    const record = { handoffCandidate: input.handoffCandidate, provisionalLease: input.provisionalLease,
+      receipt: { ...core, signature: sign(null, Buffer.from(canonical(core)), signer.privateKey).toString('base64url') } };
+    proof(input); verifyRecord(record, ctx, core.sequence, core.previousReceiptDigest, home);
+    const pending = { schemaVersion: SCHEMA, records, pending: record };
+    if (Buffer.byteLength(canonical(pending)) > 8 * 1024 * 1024) fail('read authority history exceeds its explicit limit');
+    await atomic(fileFor(ctx), pending); return finishPending(ctx, pending, registry, input, home);
+  }));
+}
+export async function readTaskHandoffReadAuthority(input) {
+  const parsed = proof(input), ctx = await context(input), registry = await readRegistry(ctx.registry), retained = await history(ctx, registry);
+  if (!retained || retained.pending) fail('scope inspection has no completed native read registration');
+  const home = await fs.realpath(ctx.home), original = registry.bindings[ctx.registryKey];
+  if (parsed.candidate.flowId !== ctx.flowId || parsed.candidate.localRepositoryDigest !== ctx.repo) fail('read inspection belongs to another actual flow or repository');
+  current(await readTaskHandoffFence(input), parsed, original, home);
+  const record = retained.records.find(item => item.receipt.candidateDigest === parsed.candidateDigest && item.receipt.leaseDigest === parsed.leaseDigest);
+  if (!record) fail('inspection proof was never registered at this actual home');
+  return view(record);
+}
+export async function assertTaskHandoffReadHome(input) {
+  const ctx = await context(input), registry = await readRegistry(ctx.registry), retained = await history(ctx, registry);
+  if (!retained || retained.pending || !retained.records.length) fail('original receiver read home has no completed trusted registration');
+  const original = registry.bindings[ctx.registryKey], state = await readTaskHandoffFence(input), home = await fs.realpath(ctx.home);
+  if (input.taskId !== original.taskId || input.ownerId !== original.ownerId
+    || state.executionAttempts.some(item => item.executionHome !== home)) fail('read-home lookup changed its original receiver identity or execution home');
+  return { schemaVersion: RECEIPT, taskId: original.taskId, ownerId: original.ownerId, readHome: home,
+    epoch: state.epoch, mutationAllowed: false, registrationId: retained.records[0].receipt.registrationId };
+}
+export async function assertTaskHandoffReadMutationAuthority(ctx, state) {
+  const retained = await history(ctx, await readRegistry(ctx.registry));
+  if (!retained) return;
+  if (retained.pending) fail('pending scope inspection registration cannot grant a mutation');
+  if (state.receiverClaim && !state.receiverRestoration) return; // The native caller has already checked its live H pass and lease.
+  const home = await fs.realpath(ctx.home);
+  for (const item of state.executionAttempts) {
+    const grant = item.authority;
+    if (grant.epoch !== state.epoch || item.executionHome !== home || item.status === 'revoked'
+      || state.revokedLeaseIds.includes(grant.leaseId) || Object.hasOwn(grant, 'handoffId')) continue;
+    if (item.status === 'ready' && Date.parse(grant.expiresAt) > Date.now()) return;
+    if (item.status !== 'used') continue;
+    const activity = state.activities.find(value => value.executionId === item.executionId
+      && value.leaseId === grant.leaseId && value.epoch === state.epoch);
+    if (!activity || !Number.isSafeInteger(activity.pid) || activity.pid < 1) continue;
+    try { process.kill(activity.pid, 0); return; } catch (error) { if (error.code === 'EPERM') return; }
+  }
+  fail('scope inspection registration is read-only; a current unrevoked business authority is required for ordinary mutation');
+}

package/local-task-handoff-storage.mjs

@@ -0,0 +1,73 @@
+import { randomUUID } from 'node:crypto';
+import { constants, promises as fs } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { canonical, sha256 } from './local-integrity.mjs';
+import { readBudgetedProjectFile } from './local-budget-reads.mjs';
+function fail(message) { const error = new Error(message); error.code = 'ENTROROVE_HANDOFF_FENCE'; throw error; }
+function id(value, label) { if (typeof value !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value)) fail(`${label} identifier is invalid`); return value; }
+function exact(value, fields, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || Object.keys(value).sort().join('\0') !== [...fields].sort().join('\0')) fail(`${label} fields are invalid`);
+  return value;
+}
+export async function regular(file, limit = 1024 * 1024, sourceBinding = null) {
+  const before = await fs.lstat(file);
+  if (!before.isFile() || before.isSymbolicLink() || before.size > limit) fail('handoff state/signer must be a bounded regular file');
+  const handle = await fs.open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const opened = await handle.stat(); if (opened.dev !== before.dev || opened.ino !== before.ino) fail('handoff file changed during open');
+    const bytes = sourceBinding
+      ? await readBudgetedProjectFile(sourceBinding.input, file, { sourcePath: sourceBinding.sourcePath })
+      : await handle.readFile(); const after = await handle.stat();
+    if (after.size !== opened.size || after.mtimeMs !== opened.mtimeMs || bytes.length > limit) fail('handoff file changed during read');
+    return { bytes, stat: after };
+  } finally { await handle.close(); }
+}
+export async function json(file, limit) { return JSON.parse((await regular(file, limit)).bytes.toString('utf8')); }
+export async function atomic(file, value) {
+  const temporary = `${file}.${randomUUID()}.tmp`;
+  const handle = await fs.open(temporary, 'wx', 0o600);
+  try { await handle.writeFile(`${canonical(value)}\n`); await handle.sync(); } finally { await handle.close(); }
+  try { await fs.rename(temporary, file); } finally { await fs.rm(temporary, { force: true }); }
+  const directory = await fs.open(path.dirname(file), 'r'); try { await directory.sync(); } finally { await directory.close(); }
+}
+export async function context(input, create = false) {
+  if (typeof input.repositoryRoot !== 'string' || !path.isAbsolute(input.repositoryRoot)) fail('handoff repository root must be absolute');
+  const stat = await fs.lstat(input.repositoryRoot); if (!stat.isDirectory() || stat.isSymbolicLink()) fail('handoff repository root must be real');
+  const root = await fs.realpath(input.repositoryRoot); const home = input.home ?? os.homedir();
+  if (!path.isAbsolute(home)) fail('handoff home must be absolute');
+  const repo = sha256(root).slice(0, 32); const flowId = id(input.flowId, 'flowId');
+  const anchor = process.env.ENTROROVE_TASK_HANDOFF_STATE_DIRECTORY;
+  if (!anchor || !path.isAbsolute(anchor)) fail('trusted handoff state directory is unavailable; configure the registered runner anchor');
+  const anchorStat = await fs.lstat(anchor);
+  const realAnchor = await fs.realpath(anchor); const relativeRoot = path.relative(root, realAnchor);
+  if (!anchorStat.isDirectory() || anchorStat.isSymbolicLink() || realAnchor !== path.resolve(anchor)
+    || relativeRoot === '' || (!relativeRoot.startsWith(`..${path.sep}`) && relativeRoot !== '..' && !path.isAbsolute(relativeRoot))
+    || (process.platform !== 'win32' && (anchorStat.mode & 0o077))
+    || (typeof process.getuid === 'function' && anchorStat.uid !== process.getuid())) fail('trusted runner anchor must be external, real, owned and private');
+  const registry = path.join(realAnchor, 'registry.json'); await readRegistry(registry);
+  const directory = path.join(realAnchor, 'flows', repo, flowId);
+  const relative = path.relative(realAnchor, directory); let current = realAnchor;
+  for (const part of relative.split(path.sep)) {
+    current = path.join(current, part);
+    try { if (create) await fs.mkdir(current, { mode: 0o700 }); } catch (error) { if (error.code !== 'EEXIST') throw error; }
+    try { const value = await fs.lstat(current); if (!value.isDirectory() || value.isSymbolicLink()) fail('handoff state directory must be real'); }
+    catch (error) { if (error.code !== 'ENOENT' || create) throw error; }
+  }
+  const ctx = { root, home, repo, flowId, registry, registryKey: `${repo}:${flowId}`, file: path.join(directory, 'fence.json') };
+  const { verifyTaskHandoffReadHomeAtContext } = await import('./local-task-handoff-read-authority.mjs');
+  await verifyTaskHandoffReadHomeAtContext(ctx);
+  return ctx;
+}
+export async function readRegistry(file) {
+  let value;
+  try { const control = await regular(file, 8 * 1024 * 1024);
+    if ((process.platform !== 'win32' && (control.stat.mode & 0o077)) || (typeof process.getuid === 'function' && control.stat.uid !== process.getuid())) fail('trusted registry must be owned and private');
+    value = JSON.parse(control.bytes.toString('utf8')); }
+  catch (error) { if (error.code === 'ENOENT') fail('trusted runner registry is missing; cloud recovery is required'); throw error; }
+  exact(value, ['schemaVersion', 'bindings', 'consumed'], 'trusted runner registry');
+  if (value.schemaVersion !== 'entrorove.task-handoff-runner-registry/1.0' || !value.bindings || typeof value.bindings !== 'object'
+    || Array.isArray(value.bindings) || !Array.isArray(value.consumed) || value.consumed.length > 50000 || Object.keys(value.bindings).length > 2048) fail('trusted runner registry is invalid');
+  return value;
+}

package/local-task-handoff-write-archive.mjs

@@ -0,0 +1,80 @@
+import { canonical, sha256, verifySnapshotManifest } from './local-integrity.mjs';
+import { receiverClaim } from './local-task-handoff-overlay-wire.mjs';
+import { evaluateArchguardDrift } from './local-archguard-evaluate.mjs';
+import { handoffWriteFail as fail, verifyWriteReceipt, verifyWriteNativeResult } from './local-task-handoff-write-wire.mjs';
+
+const ARCHIVE = 'entrorove.task-handoff-write-archive/1.0';
+const same = (left, right) => canonical(left) === canonical(right);
+const emptyHash = sha256('');
+function exact(value, fields, name) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || Object.keys(value).sort().join('\0') !== [...fields].sort().join('\0')) fail(`${name} fields are invalid`);
+}
+export function newHandoffWriteArchive(claim, manifest, ctx) {
+  const { pass, lease, challenge } = receiverClaim(claim, ctx, false);
+  const binding = { snapshotId: pass.snapshotId, flowId: pass.flowId, stepId: lease.stepId, repositoryDigest: pass.localRepositoryDigest };
+  if (!verifySnapshotManifest(manifest, binding).verified || manifest.snapshotDigest !== pass.scopeSnapshotDigest
+    || !same(manifest.paths, pass.paths) || manifest.handoffEpoch !== pass.receiverEpoch
+    || manifest.handoffBaselineReceiptDigest !== challenge.baselineReceiptDigest) fail('write archive lost its accepted original snapshot');
+  return { schemaVersion: ARCHIVE, claim: structuredClone(claim), manifest: structuredClone(manifest),
+    receipts: [], pending: null, interrupted: false };
+}
+export async function verifyHandoffWriteArchive(archive, ctx) {
+  exact(archive, ['schemaVersion', 'claim', 'manifest', 'receipts', 'pending', 'interrupted'], 'write archive');
+  if (archive.schemaVersion !== ARCHIVE || !Array.isArray(archive.receipts) || archive.receipts.length > 4096
+    || Buffer.byteLength(canonical(archive.receipts)) > 768_000) fail('complete ordered receipt batch exceeds its explicit limit');
+  const initialized = newHandoffWriteArchive(archive.claim, archive.manifest, ctx);
+  const { pass } = receiverClaim(archive.claim, ctx, false), authority = pass.architectureAuthority;
+  const files = new Map(initialized.manifest.files.map(file => [file.path, { exists: file.exists, sha256: file.exists ? file.sha256 : emptyHash }]));
+  const entries = [], nonces = new Set(), blocks = new Set(), ids = new Set();
+  let last = null, drift = authority ? await evaluateArchguardDrift(authority.ledger.slice(authority.driftEpochStart)) : null;
+  for (const receipt of archive.receipts) {
+    if (drift?.trend === 'red') fail('interrupted native ledger cannot append another result');
+    verifyWriteReceipt(receipt, archive.claim, ctx);
+    if (receipt.sequence !== ids.size + 1 || receipt.previousReceiptDigest !== (last ? sha256(canonical(last)) : null)
+      || nonces.has(receipt.nonce) || blocks.has(receipt.blockId) || ids.has(receipt.receiptId)
+      || (last && Date.parse(receipt.observedAt) < Date.parse(last.observedAt))) fail('ordered sequence, previous receipt, nonce or observation changed');
+    const before = files.get(receipt.path);
+    if (!before || before.sha256 !== receipt.beforeSha256 || before.exists !== receipt.beforeExists
+      || (!receipt.beforeExists && receipt.beforeSha256 !== emptyHash) || (!receipt.actualAfterExists && receipt.actualAfterSha256 !== emptyHash)) fail('actual byte history lost its original or previous baseline');
+    if (receipt.writeOutcome === 'blocked' ? receipt.actualAfterSha256 !== receipt.beforeSha256 || receipt.actualAfterExists !== receipt.beforeExists
+      : receipt.actualAfterSha256 !== receipt.proposedAfterSha256 || !receipt.actualAfterExists) fail('physical write outcome contradicts actual observed bytes');
+    const nativeDrift = await verifyWriteNativeResult(receipt, authority, entries);
+    if (receipt.ledgerEntry) { entries.push(receipt.ledgerEntry); drift = nativeDrift; }
+    files.set(receipt.path, { exists: receipt.actualAfterExists, sha256: receipt.actualAfterSha256 });
+    nonces.add(receipt.nonce); blocks.add(receipt.blockId); ids.add(receipt.receiptId); last = receipt;
+  }
+  if (archive.interrupted !== (drift?.trend === 'red')) fail('actual local interruption state changed');
+  if (archive.pending !== null) {
+    exact(archive.pending, ['blockId', 'path', 'beforeSha256', 'beforeExists', 'proposedAfterSha256', 'observedAt', 'nonce', 'sequence', 'previousReceiptDigest'], 'pending actual write');
+    const before = files.get(archive.pending.path);
+    if (!before || before.sha256 !== archive.pending.beforeSha256 || before.exists !== archive.pending.beforeExists
+      || archive.pending.sequence !== archive.receipts.length + 1
+      || archive.pending.previousReceiptDigest !== (last ? sha256(canonical(last)) : null)) fail('unknown pending write lost its original current byte baseline');
+  }
+  return { files, entries, drift, receiptsDigest: sha256(canonical(archive.receipts)), interrupted: archive.interrupted };
+}
+export async function verifyTaskHandoffWriteArchives(state, ctx) {
+  if (!Array.isArray(state.writeArchiveHistory) || Buffer.byteLength(canonical([state.writeArchive, state.writeArchiveHistory])) > 8 * 1024 * 1024) fail('retained write archive history exceeds its explicit limit');
+  const claims = new Set(), nonces = new Set(), receiptIds = new Set();
+  for (const archive of [...state.writeArchiveHistory, ...(state.writeArchive ? [state.writeArchive] : [])]) {
+    const original = archive.claim?.pass?.handoffId;
+    if (!original || claims.has(original)) fail('retained original handoff archive is duplicated');
+    claims.add(original); await verifyHandoffWriteArchive(archive, ctx);
+    for (const receipt of archive.receipts) {
+      if (nonces.has(receipt.nonce) || receiptIds.has(receipt.receiptId)) fail('retained cross-handoff signed nonce or receipt is duplicated');
+      nonces.add(receipt.nonce); receiptIds.add(receipt.receiptId);
+    }
+  }
+  if (state.writeArchive && !same(state.writeArchive.claim, state.receiverClaim)) fail('current write archive lost its exact signed receiver claim');
+  if (state.receiverClaim && !state.writeArchive) fail('receiver write archive is missing; explicit recovery is required');
+}
+export async function handoffWriteCompletionBatch(state, ctx, finalFiles) {
+  const archive = state.writeArchive;
+  if (!archive || archive.pending) fail('unknown or pending physical write prevents completion');
+  const verified = await verifyHandoffWriteArchive(archive, ctx);
+  if (!Array.isArray(finalFiles) || finalFiles.length !== verified.files.size || new Set(finalFiles.map(file => file.path)).size !== finalFiles.length
+    || finalFiles.some(file => !same(verified.files.get(file.path), { exists: file.exists !== false, sha256: file.sha256 }))) fail('final actual files differ from the complete trusted byte chain');
+  return { architectureAuthorityDigest: archive.claim.pass.architectureAuthority ? sha256(canonical(archive.claim.pass.architectureAuthority)) : null,
+    writeCheckpointReceipts: structuredClone(archive.receipts), writeCheckpointReceiptsDigest: verified.receiptsDigest };
+}

package/local-task-handoff-write-constraints.mjs

@@ -0,0 +1,66 @@
+import { readSnapshotCopy14 } from './local-mutation-snapshot.mjs';
+import { canonical, sha256 } from './local-integrity.mjs';
+import { scopeRead, scopeTarget } from './local-scope-files.mjs';
+
+function fail(message) { throw Object.assign(new Error(message), { code: 'ENTROROVE_HANDOFF_WRITE_CONSTRAINT' }); }
+function lines(text) { return text.match(/[^\n]*\n|[^\n]+$/g) ?? []; }
+function changedLines(before, after, budget) {
+  const a = lines(before), b = lines(after);
+  if (Math.abs(a.length - b.length) > budget) return budget + 1;
+  let frontier = new Map([[1, 0]]);
+  for (let distance = 0; distance <= Math.min(a.length + b.length, budget); distance++) {
+    const next = new Map();
+    for (let diagonal = -distance; diagonal <= distance; diagonal += 2) {
+      let x = diagonal === -distance || (diagonal !== distance
+        && (frontier.get(diagonal - 1) ?? -1) < (frontier.get(diagonal + 1) ?? -1))
+        ? frontier.get(diagonal + 1) ?? 0 : (frontier.get(diagonal - 1) ?? 0) + 1;
+      let y = x - diagonal;
+      while (x < a.length && y < b.length && a[x] === b[y]) { x++; y++; }
+      if (x >= a.length && y >= b.length) return distance;
+      next.set(diagonal, x);
+    }
+    frontier = next;
+  }
+  return budget + 1;
+}
+function text(bytes) {
+  const value = bytes.toString('utf8');
+  if (bytes.includes(0) || !Buffer.from(value, 'utf8').equals(bytes)) fail('Inherited scope budget requires actual valid UTF-8 source; binary changes need independent authorization');
+  return value;
+}
+function allowed(file, paths) { return paths.some(item => file === item || file.startsWith(`${item}/`)); }
+export async function checkHandoffWriteConstraints({ pass, manifest, root, snapshotDirectory, targetPath, content,
+  history, blockId, beforeSha256, readContext }) {
+  const scope = pass.scopeContract, original = pass.previousOwnerScopeContract;
+  if (!scope || !original || sha256(canonical(scope)) !== pass.scopeContractDigest
+    || sha256(canonical(original)) !== pass.previousOwnerScopeDigest
+    || !Number.isSafeInteger(scope.maxChangedLines) || scope.maxChangedLines < 0) fail('Original full inherited scope budget is missing or changed');
+  if (!allowed(targetPath, scope.allowedPaths) || allowed(targetPath, scope.forbiddenPaths)) fail('Original inherited scope forbids this physical write');
+  const proposed = typeof content === 'string' ? content : JSON.stringify(content);
+  if (typeof proposed !== 'string' || Buffer.byteLength(proposed) > 2_097_152) fail('Actual takeover content exceeds its bounded source limit');
+  let changed = 0;
+  for (const file of manifest.files) {
+    if (!pass.paths.includes(file.path) || !allowed(file.path, scope.allowedPaths) || allowed(file.path, scope.forbiddenPaths)) fail('Inherited scope cannot add or read another target path');
+    const preserved = await readSnapshotCopy14(readContext, snapshotDirectory, manifest, file.path);
+    const copy = file.exists ? preserved.content : Buffer.alloc(0);
+    if (file.exists && sha256(copy) !== file.sha256) fail('Original inherited scope snapshot copy changed');
+    const actual = await scopeTarget(root, file.path, true);
+    if (!file.exists && actual.exists && !scope.allowNewFiles) fail('Original inherited scope forbids new files');
+    if (file.exists && !actual.exists && !scope.allowDeleteFiles) fail('Original inherited scope forbids deleting files');
+    if (file.path === targetPath && !file.exists && !scope.allowNewFiles) fail('Original inherited scope forbids creating this file');
+    const candidate = file.path === targetPath ? proposed : actual.exists ? text((await scopeRead(root, file.path, readContext)).content) : '';
+    changed += changedLines(text(copy), candidate, scope.maxChangedLines - changed);
+    if (changed > scope.maxChangedLines) throw Object.assign(
+      new Error('Actual cumulative changed lines exceed the original owner inherited scope budget'),
+      { code: 'ENTROROVE_HANDOFF_SCOPE_BUDGET' });
+  }
+  const architecture = pass.architectureAuthority;
+  if (!architecture) return { changedLines: changed, architectureCheckpoint: null };
+  const { evaluateArchguardCheckpoint } = await import('./local-archguard-evaluate.mjs');
+  const baseline = manifest.files.find(file => file.path === targetPath);
+  const result = await evaluateArchguardCheckpoint(architecture.contract,
+    { blockId: blockId ?? `${pass.passId}:${sha256(proposed)}`, path: targetPath, content: proposed,
+      beforeSha256: beforeSha256 ?? baseline.sha256 },
+    history ?? architecture.ledger.slice(architecture.driftEpochStart));
+  return { changedLines: changed, architectureCheckpoint: result };
+}