@entrorove/skill 0.1.24 → 0.1.25

package/CAPABILITY-MAP.md

@@ -2,6 +2,10 @@
 
 This is the operation-level inventory for the eight legacy domains. `equivalent` means the v2 operation preserves the contract; `narrower` means the operation is available behind a stricter v2 gate or with a smaller side-effect boundary; `uncovered` means the old operation remains intentionally unavailable and callers must receive an explicit unsupported result.
 
+## Enforcement boundary (§2.5)
+
+The mapped controls apply only to actions executed through Entrorove. They do not control direct shell or operating-system effects performed by an agent or host IDE, including `docker rm`, `DROP DATABASE`, `cp -r`, or arbitrary file writes. Bypass effects may be recorded and can be rejected at delivery or sent back for rework, but they never receive `verified` status and never count as verified delivery. entrorove 管得住“走它的动作”，管不住“不走它的动作”。
+
 | Legacy domain | Legacy operations | v2 mapping and semantics |
 | --- | --- | --- |
 | aimlock | capabilities, help, intake, classify, scope-contract, skill-route, propose-nodes, accept-nodes, snapshot-plan, mutate-gate, continuity-check, interrupt, keep-alive, delivery-doc, validate-json, snapshot-verify, run-status, chain-plan, chain-status, feedback | `capabilities/help/intake` → equivalent shared discovery; `classify/skill-route/scope-contract/propose-nodes/accept-nodes/continuity-check/validate-json` → equivalent through `task-describe/message-route`; `snapshot-plan/snapshot-verify/mutate-gate/interrupt/keep-alive/run-status/chain-plan/chain-status/feedback/delivery-doc` → narrower through persisted flow state, local guarded writes, cancellation, status, and evidence gates. |
@@ -15,4 +19,6 @@ This is the operation-level inventory for the eight legacy domains. `equivalent`
 
 The local execution surface also covers `snapshot-plan`, `snapshot-verify`, `mutate-gate`, `gate-issue`, `gate-verify`, `guarded-write`, `budget-init`, `budget-context`, `budget-read`, `budget-status`, `budget-extend`, `budget-auto-renew-request`, `budget-auto-renew`, `budget-auto-renew-stop`, `peer-coordinate`, `spawn-bind`, `peer-complete`, `complete`, `lease-verify`, `evidence-sign`, `evidence-verify`, `merge-verified`, `rollback`, `final-gate`, `formula-evaluate`, `formula-graph`, `formula-final-gate`, `calculation-final-gate`, `run-approved-plan`, `branch-create`, `branch-list`, `branch-switch`, `diff-report`, `preflight`, `ledger-query`, `chain-init`, `chain-resume`, `chain-status`, `chain-answer`, `branch-create-virtual`, `chain-ledger-init`, `chain-ledger-status`, `chain-ledger-query`, `probe`, `reassess`, `task-describe`, `message-route`, `message-accept`, and `task-resume`. Local branch operations are virtual ledger records and never create Git branches or worktrees.
 
+The local CLI reports thrown failures as `entrorove.local-error/1.0` with `schemaVersion`, `status`, `code`, and `message`. Formula contracts require non-empty `add`/`mul` argument lists, reject zero denominators consistently, and carry an explicit `roundingPolicy` (half-away-from-zero, two decimal places by default).
+
 The only intentionally uncovered legacy surface is an old notifier or an operation that would execute remote filesystem changes. These are represented as planned or narrowed behavior in capabilities; no adapter may silently substitute a different operation.

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.25 — 2026-10-07
+
+- 原链本地执行与固定Git计费收口，补齐macOS路径和发布夹具
+- Close original-chain local execution and fixed Git accounting, with macOS path and release fixture coverage
+
 ## 0.1.24 — 2026-10-07
 
 - 更新已验收能力并完成发布前校验。

package/SKILL.md

@@ -5,10 +5,14 @@ description: An engineering skill that understands a task, chooses a fitting wor
 
 # entrorove · 熵巡
 
-Version: 0.1.24.
+Version: 0.1.25.
 
 Read the user's goal and repository instructions first. Preserve the original task through planning, execution and verification. Use the workflow only where it helps; a small, low-risk edit can proceed directly. Never claim a reported step is a verified result.
 
+## Enforcement boundary (§2.5)
+
+Entrorove governs only actions that pass through its skill entry points. It can bind paths, passes, snapshots, and evidence for those actions, but it does not control direct shell or operating-system side effects run by an agent or its host IDE, such as `docker rm`, `DROP DATABASE`, `cp -r`, or arbitrary file writes. Bypassing the skill may be recorded, rejected at delivery, or require the work to be redone; a bypass side effect never receives `verified` status and never counts as verified delivery. In the contract's terms: entrorove 管得住“走它的动作”，管不住“不走它的动作”。
+
 Install or update the managed copy with `npx @entrorove/skill install`. The installer keeps one global managed entrorove skill, replaces its older pristine version, removes only pristine duplicate installations, and preserves hand-edited files. An older package cannot overwrite a newer managed version.
 
 Register or sign in by email at https://entrorove.com. Enter the account key once with `npx @entrorove/skill configure` and `{"token":"..."}` on standard input. The credential persists in the current OS user's restricted local store across skill upgrades. Before asking again, use the stored credential; a missing or invalid credential must be reported explicitly. Never place the key in arguments, URLs, project files or logs. entrorove accounts and keys are independent of other services.
@@ -39,6 +43,8 @@ Use `npx @entrorove/skill status <requestId>` after a connection loss. It perfor
 
 The local execution layer is available through `npx @entrorove/skill local <operation> [repositoryRoot]` with a JSON object on standard input. `local capabilities` lists the complete contract. Operations include `snapshot-plan`, `snapshot-verify`, `mutate-gate`, `gate-issue`, `gate-verify`, `guarded-write`, `budget-init`, `budget-context`, `budget-read`, `budget-status`, `budget-extend`, budget renewal confirmation, `peer-coordinate`, `spawn-bind`, `peer-complete`, `lease-verify`, `probe`, `reassess`, execution ledger and virtual branch records, `chain-init`, `chain-resume`, `chain-status`, `chain-answer`, `evidence-sign`, `evidence-verify`, `merge-verified`, `rollback`, `formula-evaluate`, `formula-graph`, `formula-final-gate`, `run-approved-plan` and `final-gate`. State is kept only under `~/.entrorove/`; snapshots never create Git branches or worktrees. Guarded writes require a short-lived Ed25519 pass bound to the flow, step, snapshot digest and path set. Local evidence uses `entrorove.test-evidence/2.0`; unsigned local evidence remains incomplete and verified delivery requires a trusted receipt. Approved plan execution requires a frozen plan, matching approval and unchanged files; without a configured runner signer it reports local evidence as incomplete.
 
+Local CLI failures use the machine-readable `entrorove.local-error/1.0` envelope `{schemaVersion,status,code,message}` on stderr. `status` is `failed` for invalid input or computation errors and `blocked` for missing mutation, lease, snapshot or handoff authority. Formula `add` and `mul` require at least one argument; `div`, `safeDivide` and `percentOf` reject a zero denominator with `DIV_ZERO`. The formula engine declares `round` as half-away-from-zero with two decimal places by default; an engine may declare another `decimalPlaces` value from 0 through 28 in its `roundingPolicy`.
+
 When the user gives an actual evaluation after using the skill, offer to publish that feedback. Only after they explicitly agree to public display under the current notice, send their unchanged words, IDE name and 1–5 rating as JSON on standard input to `npx @entrorove/skill review`, including `invocationRequestId` from their actual successful call, `publicConsent: true` and `noticeVersion: "2026-10-07.1"`. The same account must own that successful call within the last 30 days; a recorded usage event, failed call or unknown result does not qualify. Three public reviews per account per day share one server quota across API replicas. Public output exposes only IDE, rating, original text and time, never account or invocation identity. Never invent, rewrite or infer a review from task completion. The website reads accepted reviews directly from entrorove's independent database.
 
 Feedback command example (replace the request ID with the original successful invocation ID, and use only the user’s actual words after explicit public consent):

package/calctool-runtime-entry.mjs

@@ -1,6 +1,6 @@
 import { buildFormulaEngine, compileFormulaEngine, validateFormulaEngine, formulaDigest } from './local-formula-engine.mjs';
 import { formulaError } from './local-decimal.mjs';
-import { FORMULA_OPERATORS } from './local-formula-ast.mjs';
+import { FORMULA_OPERATORS, FORMULA_ROUNDING_POLICY } from './local-formula-ast.mjs';
 
 const CLOUD_OPERATIONS = ['capabilities', 'help', 'intake', 'validate', 'compile-inline'];
 const LOCAL_OPERATIONS = ['run', 'compile', 'generate', 'verify', 'estimate', 'impact', 'status', 'inventory', 'purge',
@@ -30,7 +30,7 @@ export function createCalctoolEntrypoint(core) {
         const output = await core.run(request, options);
         return { ...output, capabilities: { ...output.capabilities, operations: CLOUD_OPERATIONS, localRunnerOperations: LOCAL_OPERATIONS,
           formulaOperators: FORMULA_OPERATORS, engineSchema: 'engine.spec/1', formulaRuntime: 'decimal28-ast/1.0',
-          decimalPolicy: { precision: 28, rounding: 'half-away-from-zero', representation: 'decimal-string' } },
+          decimalPolicy: { precision: 28, rounding: 'half-away-from-zero', representation: 'decimal-string' }, roundingPolicy: FORMULA_ROUNDING_POLICY },
           localRunner: { command: 'entrorove local calctool-<operation>', requiredFor: LOCAL_OPERATIONS } };
       }
       if (request.operation === 'validate') {

package/cli.mjs

@@ -288,12 +288,13 @@ async function cleanProjectDuplicates(target, cwd) {
 export async function install({ home = os.homedir(), cwd = process.cwd() } = {}) {
   const bundle = await sourceBundle();
   const target = globalInstallPath(home);
+  const stale = await agreementStale(home);
   const parent = path.dirname(target);
   await fs.mkdir(parent, { recursive: true, mode: 0o700 });
   return withInstallLock(parent, async () => {
     const updated = await updateGlobalInstall(target, bundle);
     const removed = await cleanProjectDuplicates(target, cwd);
-    return { version: bundle.manifest.version, updated, removed };
+    return { version: bundle.manifest.version, updated, removed, agreementStale: stale };
   });
 }
 
@@ -330,6 +331,22 @@ async function agreementAccepted(home) {
     && Number.isFinite(Date.parse(data.acceptedAt));
 }
 
+async function agreementStale(home) {
+  const file = agreementPath(home);
+  const stat = await statOrNull(file);
+  if (!stat) return false;
+  if (!stat.isFile() || stat.isSymbolicLink()) return true;
+  if (process.platform !== 'win32' && (stat.mode & 0o077) !== 0) return true;
+  try {
+    const data = await readJson(file);
+    return data.schemaVersion !== agreementSchema || data.version !== agreementVersion
+      || data.answer !== 'accept' || typeof data.acceptedAt !== 'string'
+      || !Number.isFinite(Date.parse(data.acceptedAt));
+  } catch {
+    return true;
+  }
+}
+
 async function writeAgreementAcceptance(data, home) {
   if (Object.keys(data).sort().join(',') !== 'answer,version'
     || data.version !== agreementVersion || !['accept', 'decline'].includes(data.answer)) {

package/local-archguard-checkpoint.mjs

@@ -11,7 +11,7 @@ import { signRunnerReceipt } from './local-archguard-signing.mjs';
 
 async function verifyWriteAuthorization(ctx, input, snapshot) {
   const savedPass = await readJson(input.gatePassPath);
-  const verified = await verifyMutationPass({ ...input, repositoryRoot: ctx.root, targetPath: input.path });
+  const verified = await verifyMutationPass({ ...input, repositoryRoot: ctx.root, targetPath: input.path }, { allowTargetDrift: true });
   const pass = verified.pass;
   if (canonical(pass) !== canonical(savedPass) || canonical(await readJson(input.gatePassPath)) !== canonical(savedPass)) fail('ARCH_PASS_RACE', 'gate pass changed during verification');
   if (pass.snapshotId !== snapshot.snapshotId || pass.snapshotReceipt.snapshotDigest !== snapshot.snapshotDigest

package/local-archguard-snapshot.mjs

@@ -6,7 +6,7 @@ import { snapshotPlan, snapshotVerify } from './local-execution.mjs';
 import { context, safeId, safePath, noLinks, canonical, sha256, readBytes, readJson,
   atomicJson, seal, unseal, withExclusiveLock, appendLedger, readLedger, fail } from './local-archguard-state.mjs';
 import { freezeContract, loadContractLock } from './local-archguard-contract.mjs';
-import { readBudgetedProjectFile } from './local-budget-reads.mjs';
+import { readSnapshotCopy14 } from './local-mutation-snapshot.mjs';
 
 export const MISSING_SHA256 = sha256('entrorove.missing-file/1.0');
 export function sourcePaths(paths) {
@@ -27,16 +27,15 @@ export function drift(ledger) {
     interrupted: shared.length > 0, ruleIds: shared, consecutiveBlocks: shared.length ? 3 : 0 };
 }
 function snapshotFile(ctx, snapshotId) { return path.join(ctx.directory, 'snapshots', `${safeId(snapshotId, 'snapshotId')}.json`); }
-async function cachedSource(ctx, snapshotId, file) {
-  const target = path.join(ctx.home, '.entrorove', 'snapshots', ctx.repositoryDigest, ctx.flowId, safeId(snapshotId, 'snapshotId'), safePath(file.path));
+async function cachedSource(ctx, snapshotId, file, copyLayout) {
+  const snapshotRoot = path.join(ctx.home, '.entrorove', 'snapshots', ctx.repositoryDigest, ctx.flowId, safeId(snapshotId, 'snapshotId'));
+  const copyRoot = copyLayout === 'files/1.0' ? path.join(snapshotRoot, 'files') : snapshotRoot;
+  const target = path.join(copyRoot, safePath(file.path));
   await noLinks(target, !file.exists);
-  if (!file.exists) {
-    try { await fs.lstat(target); fail('ARCH_SNAPSHOT_TAMPERED', 'a missing-file snapshot acquired source bytes'); }
-    catch (error) { if (error.code !== 'ENOENT') throw error; }
-    return null;
-  }
-  const bytes = await readBudgetedProjectFile({ home: ctx.home, repositoryRoot: ctx.root, flowId: ctx.flowId }, target, { sourcePath: file.path });
-  await noLinks(target);
+  const manifest = { paths: [safePath(file.path)], files: [file], ...(copyLayout === undefined ? {} : { copyLayout }) };
+  const read = await readSnapshotCopy14({ home: ctx.home, repositoryRoot: ctx.root, flowId: ctx.flowId }, snapshotRoot, manifest, file.path);
+  if (!read.exists) return null;
+  const bytes = read.content;
   if (sha256(bytes) !== file.sha256) fail('ARCH_SNAPSHOT_TAMPERED', 'native snapshot source digest changed');
   return bytes;
 }
@@ -46,7 +45,8 @@ export async function loadSnapshot(ctx, snapshotId) {
   if (snapshot.repositoryDigest !== ctx.repositoryDigest || snapshot.flowId !== ctx.flowId || snapshot.snapshotId !== snapshotId
     || snapshot.contentDigest !== sha256(canonical(snapshot.files))) fail('ARCH_SNAPSHOT_TAMPERED', 'snapshot is not bound to the repository or content');
   const files = [];
-  for (const file of snapshot.files) { const bytes = await cachedSource(ctx, snapshotId, file); files.push({ ...file, content: bytes?.toString('base64') ?? null }); }
+  const copyLayout = snapshot.receipt?.copyLayout;
+  for (const file of snapshot.files) { const bytes = await cachedSource(ctx, snapshotId, file, copyLayout); files.push({ ...file, content: bytes?.toString('base64') ?? null }); }
   return { ...snapshot, files };
 }
 export async function archguardSnapshot(input) {
@@ -99,7 +99,7 @@ export async function restoreSnapshot(ctx, snapshot) {
       }
       const temporary = `${target}.${randomUUID()}.rollback`;
       if (file.exists) {
-        const bytes = await cachedSource(ctx, snapshot.snapshotId, file);
+        const bytes = await cachedSource(ctx, snapshot.snapshotId, file, snapshot.receipt?.copyLayout);
         if (file.content !== bytes.toString('base64')) fail('ARCH_SNAPSHOT_TAMPERED', 'snapshot content does not match its budgeted native copy');
         await fs.writeFile(temporary, bytes, { flag: 'wx', mode: file.mode });
       }

package/local-calctool-cli.mjs

@@ -2,6 +2,7 @@ import { resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { runCalctoolLocal } from './local-calctool.mjs';
 import { CALCTOOL_LOCAL_OPERATION_SCHEMAS } from './local-calctool-contracts.mjs';
+import { localErrorEnvelope } from './local-error.mjs';
 
 export async function runCalctoolCli(args = process.argv.slice(2)) {
   let source = ''; for await (const chunk of process.stdin) source += chunk;
@@ -17,6 +18,7 @@ if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.ur
     const result = await runCalctoolCli(); process.stdout.write(JSON.stringify(result) + '\n');
     if (['blocked', 'failed', 'incomplete'].includes(result.status)) process.exitCode = 2;
   } catch (cause) {
-    process.stderr.write(JSON.stringify({ status: 'blocked', code: cause.code ?? 'CALCTOOL_INPUT_INVALID', message: cause.message }) + '\n'); process.exitCode = 2;
+    const error = localErrorEnvelope(cause, 'CALCTOOL_INPUT_INVALID');
+    process.stderr.write(`${JSON.stringify(error)}\n`); process.exitCode = error.status === 'blocked' ? 2 : 1;
   }
 }

package/local-calctool-runtime.mjs

@@ -1,7 +1,7 @@
 import { createHash } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 const runtimeUrl = new URL('./runtime/calctool-runtime-v7.0.43.mjs', import.meta.url);
-const expectedSha256 = '5d3506320d6baba4a8ca42cf55d062ae2b10f186741896c8cc93e536734f961f';
+const expectedSha256 = '5473427c350411f62c16ac5239fa0db7b96e7b2c19458f9046768dcb4ada87d1';
 export async function calctoolRuntimeBytes() {
   const bytes = await readFile(runtimeUrl);
   if (createHash('sha256').update(bytes).digest('hex') !== expectedSha256) throw Object.assign(new Error('Calctool packaged runtime digest mismatch'), { code: 'FORMULA_RUNTIME_INTEGRITY' });

package/local-calctool.mjs

@@ -45,7 +45,7 @@ const TOOL_SOURCE = `import { readFile } from 'node:fs/promises';
 import { evaluateCompiledProgram, verifyCompiledProgram } from './runtime.mjs';
 let input = ''; for await (const chunk of process.stdin) input += chunk;
 try { const program = JSON.parse(await readFile(new URL('./program.json', import.meta.url), 'utf8')); if(process.argv.includes('--verify')) { const result=verifyCompiledProgram(program); process.stdout.write(JSON.stringify(result)+'\\n'); process.exitCode=result.computationsPassed?0:2; } else { const values = evaluateCompiledProgram(program, JSON.parse(input)); process.stdout.write(JSON.stringify({status:'reported',programDigest:program.programDigest,values})+'\\n'); } }
-catch (error) { process.stderr.write(JSON.stringify({status:'blocked',code:error.code??'FORMULA_INPUT_INVALID',message:error instanceof SyntaxError?'Formula input or artifact must be valid JSON':error.message})+'\\n'); process.exitCode=2; }
+catch (error) { const code=error.code??'FORMULA_INPUT_INVALID'; const status=/(?:AUTHORITY_REQUIRED|LEASE_EXPIRED|NOT_ACCEPTED|REVOKED)$/.test(code)?'blocked':'failed'; process.stderr.write(JSON.stringify({schemaVersion:'entrorove.local-error/1.0',status,code,message:error instanceof SyntaxError?'Formula input or artifact must be valid JSON':error.message})+'\\n'); process.exitCode=status==='blocked'?2:1; }
 `;
 async function store(input, generate) {
   const program = await programFrom(input);

package/local-chain-bindings.mjs

@@ -0,0 +1,93 @@
+import { createHash } from 'node:crypto';
+import { constants, promises as fs } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { validateLocalInput } from './local-contracts.mjs';
+import { observeWorkflowLocalStep } from './workflow-local-runner.mjs';
+import { validateLocalChainPlan } from './local-chain-plan.mjs';
+
+export const CHAIN_PACKAGE_ROOT = path.dirname(fileURLToPath(import.meta.url));
+const ROOT = await fs.realpath(CHAIN_PACKAGE_ROOT);
+const SKILLS = ['aimlock', 'archguard', 'blueprint', 'calctool', 'confirm-protocol', 'mergeguard', 'swarm', 'validator'];
+export function chainFail(code, message) { throw Object.assign(new Error(message), { code }); }
+export function chainCanonical(value) {
+  if (Array.isArray(value)) return `[${value.map(chainCanonical).join(',')}]`;
+  if (value && typeof value === 'object') return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${chainCanonical(value[key])}`).join(',')}}`;
+  return JSON.stringify(value);
+}
+export const chainSha = value => createHash('sha256').update(value).digest('hex');
+export function chainExact(value, required, optional = []) {
+  if (!value || typeof value !== 'object' || Array.isArray(value) || required.some(key => !Object.hasOwn(value, key))
+    || Object.keys(value).some(key => !required.includes(key) && !optional.includes(key))) {
+    chainFail('ENTROROVE_CHAIN_FIELDS', 'chain input has missing or unknown fields');
+  }
+}
+export async function chainControlFile(file, maximum = 8 * 1024 * 1024) {
+  const descriptor = await fs.open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+  try {
+    const before = await descriptor.stat();
+    if (!before.isFile() || before.nlink !== 1 || before.size > maximum
+      || (typeof process.getuid === 'function' && before.uid !== process.getuid())) {
+      chainFail('ENTROROVE_CHAIN_CONTROL_INVALID', 'chain control must be a bounded owned regular file');
+    }
+    const bytes = await descriptor.readFile(), after = await descriptor.stat(), current = await fs.lstat(file);
+    if (bytes.length !== before.size || before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size
+      || before.mtimeMs !== after.mtimeMs || current.isSymbolicLink() || current.dev !== before.dev || current.ino !== before.ino) {
+      chainFail('ENTROROVE_CHAIN_CONTROL_CHANGED', 'chain control changed during its actual read');
+    }
+    return { bytes, stat: after };
+  } finally { await descriptor.close(); }
+}
+async function sourceNames() {
+  const rootNames = (await fs.readdir(ROOT)).filter(name => name.endsWith('.mjs'));
+  const runtimeNames = (await fs.readdir(path.join(ROOT, 'runtime'))).filter(name => name.endsWith('.mjs')).map(name => `runtime/${name}`);
+  return [...rootNames, ...runtimeNames, 'package.json', 'manifest.json'].sort();
+}
+export async function captureChainPackage(plan) {
+  for (const skill of plan.skills) {
+    if (!SKILLS.includes(skill.skillId) || await fs.realpath(skill.packageRoot) !== ROOT) {
+      chainFail('ENTROROVE_CHAIN_SKILL_PACKAGE', 'native chain skills must use the current fixed Entrorove package');
+    }
+  }
+  const files = [];
+  for (const name of await sourceNames()) files.push({ path: name, sha256: chainSha((await chainControlFile(path.join(ROOT, name))).bytes) });
+  const metadata = JSON.parse((await chainControlFile(path.join(ROOT, 'package.json'))).bytes.toString('utf8'));
+  if (metadata.name !== '@entrorove/skill') chainFail('ENTROROVE_CHAIN_SKILL_PACKAGE', 'installed native package identity is invalid');
+  return { packageRoot: ROOT, name: metadata.name, version: metadata.version, files,
+    authorityKeyDigest: chainSha(process.env.ENTROROVE_WORKFLOW_PLAN_PUBLIC_KEY ?? '') };
+}
+export async function checkChainPackage(snapshot) {
+  const current = await captureChainPackage(snapshot.plan);
+  if (chainCanonical(current) !== chainCanonical(snapshot.package)) chainFail('ENTROROVE_CHAIN_PACKAGE_CHANGED', 'installed source, metadata or authority changed after chain initialization');
+}
+export async function validateChainBindings(planValue, values, identity) {
+  const plan = validateLocalChainPlan(planValue);
+  if (!Array.isArray(values)) chainFail('ENTROROVE_CHAIN_BINDING', 'command bindings must be an explicit array');
+  const commands = plan.steps.filter(step => step.kind === 'command'), bindings = [];
+  if (values.length !== commands.length) chainFail('ENTROROVE_CHAIN_BINDING', 'every command requires exactly one original signed workflow mapping');
+  for (const step of commands) {
+    const selected = values.filter(value => value.stepId === step.stepId);
+    if (selected.length !== 1) chainFail('ENTROROVE_CHAIN_BINDING', 'command mapping must have a unique original step ID');
+    chainExact(selected[0], ['stepId', 'workflowInput']);
+    const input = validateLocalInput('workflow-run-step', structuredClone(selected[0].workflowInput));
+    const native = input.acceptedPlan.steps.find(value => value.stepId === input.stepId);
+    if (input.repositoryRoot !== identity.repositoryRoot || input.home !== identity.home || input.stepId !== step.stepId
+      || input.acceptedPlan.flowId !== identity.flowId || input.acceptedPlan.ownerId !== identity.ownerId
+      || input.lease.stepId !== step.stepId || !native || chainCanonical(native.dependsOn) !== chainCanonical(step.dependsOn)) {
+      chainFail('ENTROROVE_CHAIN_BINDING', 'command mapping changed its original home, repository, flow, owner or step dependencies');
+    }
+    const policy = native.executionPlan.policy;
+    if (chainCanonical([step.input.executable, step.input.args, step.input.environment, step.input.timeoutMs, step.input.evidenceKind])
+      !== chainCanonical([policy.executable, policy.args, policy.environment, policy.timeoutMs, native.executionPlan.evidencePolicy?.kind ?? 'test'])) {
+      chainFail('ENTROROVE_CHAIN_BINDING', 'command policy differs from its actual frozen workflow plan');
+    }
+    if (path.resolve(identity.repositoryRoot, step.input.workingDirectory) !== identity.repositoryRoot) {
+      chainFail('ENTROROVE_CHAIN_COMMAND_CWD_UNSUPPORTED', 'the fixed native workflow runner currently executes only at its original repository root');
+    }
+    // This real observer verifies the configured Ed25519 plan and lease without
+    // starting a process or inventing an execution authority.
+    await observeWorkflowLocalStep(input);
+    bindings.push({ stepId: step.stepId, workflowInput: input });
+  }
+  return bindings;
+}

package/local-chain-broker.mjs

@@ -0,0 +1,61 @@
+import Ajv from 'ajv';
+import { chainCanonical as canonical, chainFail as fail } from './local-chain-bindings.mjs';
+import { inspectLocalChainResult } from './local-chain-plan.mjs';
+
+const STAGES = Object.freeze({ 'workflow-gate': 'aimlock', 'workflow-contract': 'aimlock',
+  'workflow-plan': 'blueprint', 'workflow-dispatch': 'swarm', 'workflow-verdict': 'validator' });
+function nativeSchema(runtime, operation) {
+  const schemas = runtime.operationSchemas;
+  const selected = Array.isArray(schemas) ? schemas.find(value => value.operation === operation) : schemas?.[operation];
+  return selected?.inputSchema ?? selected?.input ?? selected;
+}
+export async function captureChainCloud(plan, client) {
+  if (!plan.skills.length) return null;
+  const output = await client.invoke('capabilities', {}), capabilities = output.capabilities;
+  if (output.status !== 'succeeded' || !capabilities?.operationSchemas?.continue
+    || !Array.isArray(capabilities.runtimes)) fail('ENTROROVE_CHAIN_DISCOVERY', 'original cloud discovery is incomplete');
+  const runtimes = plan.skills.map(skill => {
+    const matches = capabilities.runtimes.filter(runtime => runtime.slug === skill.skillId);
+    if (matches.length !== 1 || typeof matches[0].version !== 'string' || typeof matches[0].endpoint !== 'string') {
+      fail('ENTROROVE_CHAIN_DISCOVERY', 'declared native skill has no unique original runtime metadata');
+    }
+    return structuredClone(matches[0]);
+  });
+  return { runtimes, operationSchemas: structuredClone(capabilities.operationSchemas),
+    workflowOperations: structuredClone(capabilities.workflowOperations ?? null) };
+}
+export async function checkChainCloud(state, client) {
+  if (canonical(await captureChainCloud(state.plan, client)) !== canonical(state.cloud)) {
+    fail('ENTROROVE_CHAIN_DISCOVERY_CHANGED', 'original cloud runtime or operation metadata changed after initialization');
+  }
+}
+export function checkChainSkillDispatch(original, state, resumed, input) {
+  const next = resumed.nextStep;
+  if (resumed.canContinue !== true || next?.operation !== 'continue'
+    || next.input?.flowId !== state.identity.flowId || next.input.operation !== original.operation) {
+    fail('ENTROROVE_CHAIN_STAGE_BINDING', 'declared skill must be the exact next operation of its original workflow');
+  }
+  const slug = STAGES[original.operation] ?? resumed.route?.slug;
+  if (slug !== original.skillId) fail('ENTROROVE_CHAIN_SKILL_BINDING', 'declared skill differs from the original native workflow stage');
+  const runtime = state.cloud.runtimes.find(value => value.slug === original.skillId);
+  const schema = state.cloud.workflowOperations?.operationSchemas?.[original.operation] ?? nativeSchema(runtime, original.operation);
+  if (schema) {
+    const validate = new Ajv({ strict: true, strictRequired: false, allErrors: true }).compile(schema);
+    if (!validate(input)) fail('ENTROROVE_CHAIN_SKILL_INPUT', 'bound input violates its fixed original operation schema');
+  }
+  // Native operations without public nested schemas remain server-validated on
+  // the exact original active route; no arbitrary endpoint is opened here.
+}
+export function inspectChainSkillResponse(original, state, response) {
+  if (response.flowId !== state.identity.flowId || (response.taskId !== undefined && response.taskId !== state.identity.taskId)) {
+    fail('ENTROROVE_CHAIN_RESULT_BINDING', 'skill result lost its original flow or task identity');
+  }
+  if (!response.result || typeof response.result !== 'object' || Array.isArray(response.result)) {
+    fail('ENTROROVE_CHAIN_RESULT_BINDING', 'skill result must retain its actual native structured output');
+  }
+  const native = response.result;
+  if (native.source === 'needs-clarification' || native.intake?.complete === false) {
+    return { state: 'waiting', code: 'ENTROROVE_CHAIN_CLARIFICATION_REQUIRED', eligible: false };
+  }
+  return inspectLocalChainResult(original, response);
+}

package/local-chain-contracts.mjs

@@ -0,0 +1,21 @@
+import { WORKFLOW_LOCAL_OPERATION_SCHEMA } from './workflow-local-contracts.mjs';
+
+const id = { type: 'string', pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$' };
+const text = { type: 'string', minLength: 1 };
+const object = (properties, required = Object.keys(properties)) => ({ type: 'object', additionalProperties: false, properties, required });
+const array = items => ({ type: 'array', items });
+const pointer = { type: 'string', pattern: '^(?:/(?:[^~]|~[01])*)*$' };
+const step = object({ stepId: id, kind: { enum: ['skill', 'coordinator', 'command'] },
+  skillId: { anyOf: [id, { type: 'null' }] }, operation: id, input: { type: 'object' }, dependsOn: array(id),
+  bindings: array(object({ stepId: id, source: pointer, target: { ...pointer, minLength: 1 } })),
+  continueWhen: object({ answer: { anyOf: [text, { ...array(text), minItems: 1, uniqueItems: true }] } }),
+}, ['stepId', 'kind', 'skillId', 'operation', 'input', 'dependsOn', 'bindings']);
+export const LOCAL_CHAIN_PLAN_INPUT_SCHEMA = object({ schemaVersion: { const: 'entrorove.execution-plan/1.0' }, chainId: id,
+  skills: array(object({ skillId: id, packageRoot: text })), steps: { ...array(step), minItems: 1 } });
+const identity = { repositoryRoot: text, home: text, chainId: id };
+export const LOCAL_CHAIN_OPERATION_SCHEMAS = Object.freeze({
+  'chain-init': object({ repositoryRoot: text, home: text, flowId: id, ownerId: id, taskId: id,
+    plan: LOCAL_CHAIN_PLAN_INPUT_SCHEMA, commandBindings: array(object({ stepId: id, workflowInput: WORKFLOW_LOCAL_OPERATION_SCHEMA })) }),
+  'chain-resume': object(identity), 'chain-status': object(identity),
+  'chain-answer': object({ ...identity, actorId: id }),
+});