@entrorove/skill 0.1.24 → 0.1.25

package/local-invocations.mjs

@@ -9,6 +9,7 @@ const UUID = /^[a-f0-9-]{36}$/;
 const ID = /^[a-z][a-z0-9-]{0,63}$/;
 const COUNTS = ['inputTokens', 'outputTokens', 'durationMs'];
 const events = new Set(['started', 'completed', 'rejected', 'outcome-unknown', 'not-sent', 'status']);
+const readOnlyOperations = new Set(['ledger-query', 'chain-ledger-query']);
 
 function receipt(value, requestId) {
   if (!value || !UUID.test(value.usageId) || value.requestId !== requestId
@@ -44,6 +45,22 @@ async function ledgerFile(home) {
   return path.join(directory, 'invocations.jsonl');
 }
 
+async function finalGateStateExists(input) {
+  if (!input || typeof input.home !== 'string' || typeof input.repositoryRoot !== 'string' || typeof input.gateId !== 'string') return false;
+  try {
+    const root = await fs.realpath(input.repositoryRoot);
+    const repositoryDigest = createHash('sha256').update(root).digest('hex');
+    const base = path.join(await fs.realpath(input.home), '.entrorove', 'calctool', 'final-gates', repositoryDigest);
+    for (const flow of await fs.readdir(base, { withFileTypes: true })) {
+      if (!flow.isDirectory() || flow.isSymbolicLink()) continue;
+      const target = path.join(base, flow.name, `${input.gateId}.json`);
+      try { const stat = await fs.lstat(target); if (stat.isFile() && !stat.isSymbolicLink()) return true; }
+      catch (error) { if (error?.code !== 'ENOENT') throw error; }
+    }
+  } catch (error) { if (!['ENOENT', 'ENOTDIR'].includes(error?.code)) throw error; }
+  return false;
+}
+
 export async function appendInvocation(value, home = os.homedir()) {
   if (!value || !SHA.test(value.requestId) || !ID.test(value.operation) || !events.has(value.event)
     || !['remote', 'local'].includes(value.kind)) throw new Error('Invalid invocation ledger metadata');
@@ -77,6 +94,24 @@ function canonical(value) {
 }
 
 export async function withLocalInvocation(operation, input, work) {
+  // A final-gate recovery carries only the immutable identity fields and must
+  // remain a read-only GET-style lookup. A fresh gate includes plans and keeps
+  // the normal invocation audit record.
+  if (readOnlyOperations.has(operation)) return work();
+  if (operation === 'final-gate' && input) {
+    if (!Object.hasOwn(input, 'plans')) return work();
+    try {
+      const { statePath16 } = await import('./local-final-gate16-state.mjs');
+      const target = await statePath16(input);
+      if (target) {
+        try { await fs.access(target); return work(); }
+        catch (error) { if (error?.code !== 'ENOENT') throw error; }
+      }
+      if (await finalGateStateExists(input)) return work();
+    } catch (error) {
+      if (error?.code !== 'ENOENT') throw error;
+    }
+  }
   const requestId = createHash('sha256').update(operation + canonical(input)).digest('hex');
   const metadata = { kind: 'local', operation, requestId };
   await appendInvocation({ ...metadata, event: 'started' }, input.home);

package/local-ledger.mjs

@@ -19,9 +19,20 @@ async function repository(value) { if (typeof value !== 'string' || !path.isAbso
 function repoDigest(root) { return sha(root).slice(0, 32); }
 async function privateDir(directory) { await fs.mkdir(directory, { recursive: true, mode: 0o700 }); const stat = await fs.lstat(directory); if (!stat.isDirectory() || stat.isSymbolicLink()) fail('ENTROROVE_STATE_INVALID', 'state directory must be a real directory'); if (process.platform !== 'win32') await fs.chmod(directory, 0o700); }
 async function atomic(file, value) { await privateDir(path.dirname(file)); const tmp = `${file}.${randomUUID()}.tmp`; await fs.writeFile(tmp, `${canonical(value)}\n`, { flag: 'wx', mode: 0o600 }); await fs.rename(tmp, file); if (process.platform !== 'win32') await fs.chmod(file, 0o600); }
-async function read(file) { await privateDir(path.dirname(file)); const stat = await fs.lstat(file); if (!stat.isFile() || stat.isSymbolicLink()) fail('ENTROROVE_STATE_INVALID', 'ledger state must be a regular file'); return JSON.parse(await fs.readFile(file, 'utf8')); }
+async function read(file, ensureDirectory = true) { if (ensureDirectory) await privateDir(path.dirname(file)); const stat = await fs.lstat(file); if (!stat.isFile() || stat.isSymbolicLink()) fail('ENTROROVE_STATE_INVALID', 'ledger state must be a regular file'); return JSON.parse(await fs.readFile(file, 'utf8')); }
 function ledgerPath(home, root) { return path.join(rootFor(home), 'ledgers', repoDigest(root), 'state.json'); }
 async function loadLedger(input, create = false) { const root = await repository(input.repositoryRoot); const file = ledgerPath(input.home, root); try { const state = await read(file); if (state.schemaVersion !== LEDGER_SCHEMA || state.repositoryDigest !== repoDigest(root)) fail('ENTROROVE_LEDGER_INVALID', 'ledger identity mismatch'); return { root, file, state }; } catch (error) { if (!create || error.code !== 'ENOENT') throw error; const state = { schemaVersion: LEDGER_SCHEMA, repositoryDigest: repoDigest(root), sequence: 0, head: null, activeBranch: null, branches: [], records: [] }; await atomic(file, state); return { root, file, state }; } }
+async function readLedgerForQuery(input) {
+  const root = await repository(input.repositoryRoot); const file = ledgerPath(input.home, root);
+  try {
+    const state = await read(file, false);
+    if (state.schemaVersion !== LEDGER_SCHEMA || state.repositoryDigest !== repoDigest(root)) fail('ENTROROVE_LEDGER_INVALID', 'ledger identity mismatch');
+    return { root, file, state };
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+    return { root, file, state: { schemaVersion: LEDGER_SCHEMA, repositoryDigest: repoDigest(root), sequence: 0, head: null, activeBranch: null, branches: [], records: [] } };
+  }
+}
 async function append(input, event, data = {}) { const root = await repository(input.repositoryRoot); const file = ledgerPath(input.home, root); const previous = ledgerLocks.get(file) ?? Promise.resolve(); let release; const current = new Promise(resolve => { release = resolve; }); const queued = previous.then(() => current); ledgerLocks.set(file, queued); await previous; try { return await withStateLock(file, async () => { const authority = await loadLedger(input, true); const at = new Date().toISOString(); const unsigned = { sequence: authority.state.sequence + 1, event, at, ...data }; const record = { ...unsigned, previousDigest: authority.state.head, digest: sha(canonical(unsigned) + (authority.state.head ?? '')) }; const state = { ...authority.state, sequence: record.sequence, head: record.digest, records: [...authority.state.records, record] }; await atomic(authority.file, state); return { authority, state, record }; }); } finally { release(); if (ledgerLocks.get(file) === queued) ledgerLocks.delete(file); } }
 export async function appendLedgerRecord(input, event, data = {}) { if (typeof event !== 'string' || !event.trim()) fail('ENTROROVE_LEDGER_EVENT', 'ledger event is required'); return (await append(input, event, data)).record; }
 export async function branchCreate(input) { const name = id(input.name ?? input.branchName, 'branchName'); const fromRef = typeof input.fromRef === 'string' && input.fromRef ? input.fromRef : 'working-tree'; const authority = await loadLedger(input, true); if (authority.state.branches.some(item => item.name === name)) fail('ENTROROVE_BRANCH_EXISTS', `virtual branch already exists: ${name}`); const branch = { branchId: `branch-${randomUUID()}`, name, fromRef, description: input.description ?? '', virtual: true, createdAt: new Date().toISOString(), snapshotId: input.snapshotId ?? null }; const state = { ...authority.state, branches: [...authority.state.branches, branch], activeBranch: authority.state.activeBranch ?? name }; await atomic(authority.file, state); await append(input, 'branch-create', { name, fromRef, virtual: true }); return { schemaVersion: LEDGER_SCHEMA, status: 'verified', branch, forbidGitBranch: true, forbidWorktree: true }; }
@@ -36,7 +47,7 @@ export async function preflight(input) {
   const reasons = []; if (!archguard.verified) reasons.push(archguard.reason); if (!evidence) reasons.push('trusted signed evidence bound to this flow, snapshot, and contract with exitCode 0 is required');
   return { schemaVersion: LEDGER_SCHEMA, status: archguard.verified && evidence ? 'verified' : 'blocked', source: 'entrorove-ledger', checks: { archguard: archguard.verified, evidence }, reasons, virtualOnly: true, keyId: archguard.keyId ?? null };
 }
-export async function ledgerQuery(input) { const authority = await loadLedger(input, true); const limit = Number.isSafeInteger(input.limit) ? Math.min(500, Math.max(1, input.limit)) : 100; return { schemaVersion: LEDGER_SCHEMA, status: 'verified', repositoryDigest: repoDigest(authority.root), records: authority.state.records.slice(-limit), head: authority.state.head, sequence: authority.state.sequence }; }
+export async function ledgerQuery(input) { const authority = await readLedgerForQuery(input); const limit = Number.isSafeInteger(input.limit) ? Math.min(500, Math.max(1, input.limit)) : 100; return { schemaVersion: LEDGER_SCHEMA, status: 'verified', repositoryDigest: repoDigest(authority.root), records: authority.state.records.slice(-limit), head: authority.state.head, sequence: authority.state.sequence }; }
 
 function validatePlan(plan) { if (!plan || typeof plan !== 'object' || Array.isArray(plan) || plan.schemaVersion !== 'entrorove.execution-plan/1.0' || !ID.test(plan.chainId) || !Array.isArray(plan.steps) || !plan.steps.length) fail('ENTROROVE_CHAIN_PLAN_INVALID', 'chain plan must declare a schema, chainId, and steps'); const seen = new Set(); for (const [index, step] of plan.steps.entries()) { if (!step || typeof step !== 'object' || !ID.test(step.stepId) || seen.has(step.stepId) || !['command', 'skill', 'coordinator', 'decision'].includes(step.kind)) fail('ENTROROVE_CHAIN_STEP_INVALID', `step ${index} is invalid`); seen.add(step.stepId); } return plan; }
 async function chainAuthority(input, create = false) { const root = await repository(input.repositoryRoot); const chainId = id(input.chainId ?? input.plan?.chainId, 'chainId'); const file = path.join(rootFor(input.home), 'chains', repoDigest(root), chainId, 'state.json'); try { const state = await read(file); if (state.schemaVersion !== CHAIN_SCHEMA || state.chainId !== chainId || state.repositoryDigest !== repoDigest(root)) fail('ENTROROVE_CHAIN_INVALID', 'chain state identity mismatch'); return { root, chainId, file, state }; } catch (error) { if (!create || error.code !== 'ENOENT') throw error; return { root, chainId, file, state: null }; } }

package/local-mutation-authority.mjs

@@ -4,7 +4,7 @@ import { appendLedgerRecord } from './local-ledger.mjs';
 import { withStateLock } from './local-state-lock.mjs';
 import { withTaskHandoffIssueFence, withTaskHandoffWriteFence, assertTaskHandoffSnapshotBinding } from './local-task-handoff-fence.mjs';
 import { mutationFail14, mutationPath14, mutationStateRoot14,
-  privateMutationDirectory14, writeMutationProjectFile14 } from './local-mutation-files.mjs';
+  mutationRead14, privateMutationDirectory14, writeMutationProjectFile14 } from './local-mutation-files.mjs';
 import { mutationPass14, mutationLifetime14 } from './local-mutation-wire.mjs';
 import { mutationOriginalBinding14, mutationSnapshotBinding14 } from './local-mutation-binding.mjs';
 import { installMutationPass14, mutationPassLocations14, readMutationConsumption14,
@@ -42,20 +42,27 @@ export async function issueMutationPass14(input) {
     });
   });
 }
-async function checkedPass(input, state) {
+async function checkedPass(input, state, { allowTargetDrift = false } = {}) {
   const pass = await readStoredMutationPass14(input), target = mutationPath14(input.targetPath, 'targetPath');
   if (!pass.paths.includes(target)) mutationFail14('ENTROROVE_MUTATION_WRITE_SCOPE', 'Guarded writing is outside the cloud pass path set');
   const binding = await mutationOriginalBinding14(input, pass, state);
-  const snapshot = await mutationSnapshotBinding14(input, pass, { targetPath: target });
+  const snapshot = await mutationSnapshotBinding14(input, pass, { targetPath: target, allowTargetDrift });
   assertTaskHandoffSnapshotBinding(binding.state, pass.snapshotReceipt);
   const locations = await mutationPassLocations14(input, binding, pass);
   const ledger = await readMutationConsumption14(pass, locations);
-  if (Object.hasOwn(ledger.writes, target)) mutationFail14('ENTROROVE_MUTATION_PASS_CONSUMED', 'Mutation pass was already consumed or has an unresolved physical write');
+  const consumedWrite = ledger.writes[target];
+  if (allowTargetDrift) {
+    if (consumedWrite?.status !== 'written') mutationFail14('ENTROROVE_MUTATION_PASS_CONSUMED', 'Checkpoint requires a completed guarded write');
+    const current = await mutationRead14(input, binding.root, target);
+    if (current.sha256 !== consumedWrite.contentDigest) mutationFail14('ENTROROVE_MUTATION_WRITE_CHANGED', 'Checkpoint target differs from its completed guarded write');
+  } else if (consumedWrite) {
+    mutationFail14('ENTROROVE_MUTATION_PASS_CONSUMED', 'Mutation pass was already consumed or has an unresolved physical write');
+  }
   return { pass, target, binding, snapshot, locations, ledger };
 }
-export async function verifyMutationPass14(input) {
+export async function verifyMutationPass14(input, { allowTargetDrift = false } = {}) {
   return withMutationAudit14(input, 'mutation-pass-verify', async () => {
-    const value = await checkedPass(input);
+    const value = await checkedPass(input, undefined, { allowTargetDrift });
     return { schemaVersion: SCHEMA, verified: true, pass: value.pass, targetPath: value.target };
   });
 }

package/local-mutation-binding.mjs

@@ -39,7 +39,7 @@ export async function mutationOriginalBinding14(input, authority, state) {
   }
   return { root, home, context: ctx, state: current };
 }
-export async function mutationSnapshotBinding14(input, pass, { allSources = false, targetPath } = {}) {
+export async function mutationSnapshotBinding14(input, pass, { allSources = false, targetPath, allowTargetDrift = false } = {}) {
   mutationPass14(pass);
   const root = await mutationRoot14(input.repositoryRoot);
   const snapshot = await snapshotAuthority14(input, root, pass.snapshotReceipt);
@@ -53,7 +53,10 @@ export async function mutationSnapshotBinding14(input, pass, { allSources = fals
   if (snapshot.manifest.files.some(file => !file.exists && !pass.newFilePaths.includes(file.path))) {
     mutationFail14('ENTROROVE_MUTATION_NEW_FILE_SCOPE', 'Missing source is outside the original planned new-file set');
   }
-  if (allSources || targetPath) await verifySnapshotSources14(input, root, snapshot.manifest,
+  // ArchGuard validates the changed target after a guarded write. The original
+  // snapshot still binds the pass, while its target source is expected to drift
+  // before checkpoint evaluation. Ordinary mutation paths keep the hash check.
+  if (allSources || targetPath && !allowTargetDrift) await verifySnapshotSources14(input, root, snapshot.manifest,
     { paths: allSources ? snapshot.manifest.paths : [targetPath] });
   return { ...snapshot, root };
 }

package/local-mutation-files.mjs

@@ -63,6 +63,31 @@ async function inspectPath(target, { allowMissing = false, final = 'file', code
     else return { target: resolved, exists: true, stat, ancestors };
   }
 }
+async function canonicalDirectoryPath(value, { allowMissing = false, code }) {
+  const resolved = absolute(value, 'filesystem path');
+  const base = path.parse(resolved).root;
+  const parts = path.relative(base, resolved).split(path.sep).filter(Boolean);
+  let current = base;
+  for (const [index, part] of parts.entries()) {
+    const candidate = path.join(current, part);
+    let stat;
+    try { stat = await fs.lstat(candidate); } catch (error) {
+      if (error.code === 'ENOENT' && allowMissing) return path.join(current, ...parts.slice(index));
+      throw error;
+    }
+    if (stat.isSymbolicLink()) {
+      const linked = await fs.realpath(candidate);
+      const systemAlias = process.platform === 'darwin' && current === base
+        && ['/var', '/tmp', '/etc'].includes(candidate) && linked === path.join('/private', candidate);
+      if (!systemAlias) mutationFail14(code, 'mutation paths refuse symlink, non-directory ancestors, and invalid file types');
+      current = linked;
+      continue;
+    }
+    if (!stat.isDirectory()) mutationFail14(code, 'mutation paths refuse symlink, non-directory ancestors, and invalid file types');
+    current = candidate;
+  }
+  return current;
+}
 async function assertAncestors(item, code = 'ENTROROVE_STATE_CHANGED') {
   for (const ancestor of item.ancestors) {
     const stat = await fs.lstat(ancestor.path);
@@ -72,12 +97,12 @@ async function assertAncestors(item, code = 'ENTROROVE_STATE_CHANGED') {
   }
 }
 export async function mutationRoot14(value) {
-  const root = absolute(value, 'repositoryRoot');
-  await inspectPath(root, { final: 'directory', code: 'ENTROROVE_ROOT_INVALID' });
-  return root;
+  const canonicalRoot = await canonicalDirectoryPath(value, { code: 'ENTROROVE_ROOT_INVALID' });
+  await inspectPath(canonicalRoot, { final: 'directory', code: 'ENTROROVE_ROOT_INVALID' });
+  return canonicalRoot;
 }
 export async function mutationHome14(value = os.homedir()) {
-  const home = absolute(value, 'home');
+  const home = await canonicalDirectoryPath(value, { allowMissing: true, code: 'ENTROROVE_HOME_INVALID' });
   await inspectPath(home, { allowMissing: true, final: 'directory', code: 'ENTROROVE_HOME_INVALID' });
   return home;
 }

package/local-task-handoff-observation.mjs

@@ -9,7 +9,10 @@ function fail(message) { throw Object.assign(new Error(message), { code: 'ENTROR
 export async function loadTaskHandoffSigner(ctx, file, keyId) {
   async function control(target) {
     if (typeof target !== 'string' || !path.isAbsolute(target)) fail('runner signer controls are unavailable; an external absolute configuration is required');
-    const actual = await fs.realpath(target), relative = path.relative(ctx.root, actual);
+    let actual;
+    try { actual = await fs.realpath(target); }
+    catch { fail('runner signer controls are unavailable; an external absolute configuration is required'); }
+    const relative = path.relative(ctx.root, actual);
     if (actual !== path.resolve(target) || relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative))) fail('runner signer controls must be external real files');
     const value = await regular(target, 16 * 1024);
     if ((process.platform !== 'win32' && (value.stat.mode & 0o077)) || (typeof process.getuid === 'function' && value.stat.uid !== process.getuid())) fail('runner signer controls must be owned private files');

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.skill-manifest/1.0",
   "name": "entrorove",
-  "version": "0.1.24",
+  "version": "0.1.25",
   "endpoint": "https://entrorove.com",
   "requestSchemaVersion": "entrorove.skill.request/2.0",
   "supportedRequestSchemaVersions": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.24",
+  "version": "0.1.25",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"
@@ -37,6 +37,16 @@
     "local-evidence-verification.mjs",
     "local-formula.mjs",
     "local-ledger.mjs",
+    "local-chain-bindings.mjs",
+    "local-chain-broker.mjs",
+    "local-chain-contracts.mjs",
+    "local-chain-controller.mjs",
+    "local-chain-human.mjs",
+    "local-chain-lock.mjs",
+    "local-chain-operations.mjs",
+    "local-chain-plan.mjs",
+    "local-chain-release-labels.mjs",
+    "local-chain-results.mjs",
     "local-approved-plan.mjs",
     "workflow-local-runner.mjs",
     "workflow-local-client.mjs",
@@ -133,6 +143,7 @@
     "local-formula-tests.mjs",
     "local-calctool.mjs",
     "local-calctool-cli.mjs",
+    "local-error.mjs",
     "local-calctool-contracts.mjs",
     "local-calctool-runtime.mjs",
     "local-calctool-storage.mjs",

package/release-state.json

@@ -1,13 +1,13 @@
 {
   "schemaVersion": "entrorove.release-state/1.0",
-  "version": "0.1.24",
-  "digest": "48ec31da93f81d541551d5168e946e2fcd0516e9a19970d994199d9e9ab42ba4",
+  "version": "0.1.25",
+  "digest": "51ba0446dc6d2004bdf31195d4cf62bdd522f3c0a76de1c35344df32ae130046",
   "files": {
     "local-final-gate16.mjs": "b30caab08441449ad556a6e9a3cefbf91190f0b3f7370f46d2a21156375aa8e3",
     "local-final-gate16-checks.mjs": "1dd30e9666d458d8b12ca6e4975f6f0ac8450c3ea9cbecc7401ae037f66b589a",
     "local-final-gate16-worker.mjs": "344d64b6c1c5552b96960e0d8514a876a3dbfa9762ab9eb749038e8351727121",
     "local-final-gate16-plan.mjs": "9d34c51fa239376e552abc312409a7f3258519efe0b29d88a5054680cdda483c",
-    "local-final-gate16-bundle.mjs": "92cc4008676abff816c8ca9244d06e5a2c16eed7e0e22b8c3a4e886417bf2b9c",
+    "local-final-gate16-bundle.mjs": "08cff47892199a0b1c08196e151770075ee09a9036e9aea4906fdb619edf7499",
     "local-final-gate16-state.mjs": "a8cf6ac28183fb2274772774d52418a82343485271f78b4d304d0dae7c8a642d",
     "local-final-gate16-proof.mjs": "5f7d5be29b1ce5fbb1a05fd2204969215ec5d0297ad84dcb7b29abb3ef285f56",
     "local-final-gate16-contract.mjs": "cffa9b0d89eab360ce6c27c73400b8b377adbdc32813b244f754423d10061fe0",
@@ -36,24 +36,34 @@
     "local-swarm-state.mjs": "ff84c5f35ef3e4a0ad9887d145e404f5786ae0dc92496116699d031b98e90c6a",
     "local-swarm-storage.mjs": "4b506481913fe22769f47a14a024a2cc4c0f1e986bb52ef606d14c7844226086",
     "local-swarm.mjs": "94b5adde0239cc21bada288886482934d409f4383d31076025437ed621ef43b6",
-    "cli.mjs": "f85f2583e657a8120666bf559d6d6fa39c3401f95f258f7d149c7d43b7ec80cd",
+    "cli.mjs": "c85289b1cbe0ea469a57e67edb1fc475dc9c626c2beae00f5e0954c00757481d",
     "review-client.mjs": "3491eef68ed533174b31db3c53febb6519b8f088f71a9964644714a9a4c03c77",
     "version.mjs": "1f392147d72c40af4b03b307ea607075fb815af5174fa07e254b95fe12dbf3e7",
-    "SKILL.md": "e4deb2f0a82829d156ddcf804cd593645c95ef1b1da0ded54b41e11ac7cf4ba3",
-    "CAPABILITY-MAP.md": "276426da6b76820b3a502fe4cd80ca246ccab2d6c70036f89793b63fbced1552",
+    "SKILL.md": "f6a140c4d0dd79b6985d1cd085c831a26c64119a4107e35d25c3ac5a566ed797",
+    "CAPABILITY-MAP.md": "1a58ac506efe894c0ba224605a758cbc8a1c8f7b9ed05ce355e0c9a3ce43c61f",
     "AGREEMENT.md": "f93a68e92c457200dd024610e65f74e478b8f60860f951da818b70561f1b9bf8",
-    "package.json": "8f12e62ea09b1fa70e9fd1c7fb59e199f150a1b5bd8d8148f2b0a1b5c85462b4",
+    "package.json": "a60c18189e680be7c8547c5331ceee74f64115dc571e8e069e76570a5fcede0b",
     "manifest.json": "ab06e307795bc9da5add926752b6c4dbdaf18625090261a035aa356a679c504f",
-    "release.mjs": "94f221b47049ccf19d887d06376a52b3668e56674eb95f55e21507461c4ba166",
-    "local-cli.mjs": "17146679dd2c7236bf37e6a1d5549a6b32372e6f9925adcd57fc60849c00abc9",
+    "release.mjs": "b6882c24084129a0853330ec707b46fac69c25d533cdcc23b95b23cdefda27e9",
+    "local-cli.mjs": "ecc85bc5f36a5663fef004e59525374dc7883d3889f5a0cfe219ae5e84b2d3ea",
     "local-state-lock.mjs": "1dbf64264642a0851faf043e07ee9f66d2ad0508e9f799b0626246e42fae893e",
-    "local-execution.mjs": "bb3efe6c7e19343aed2d542a74fc949c4dd8a22c412f8ef8b2a4c9612f6bb045",
+    "local-execution.mjs": "97dfad5e889e679e9cc34434005342526502795abba21078fa40673788073153",
     "local-integrity.mjs": "4f325376e536999c3b00245f66aac9ef1ae762c33012b363c231622008f72805",
     "local-evidence-verification.mjs": "9b7dea31777505272f63616fd62af7603338f703bb1285fc565d6451715c7ce0",
-    "local-formula.mjs": "64d19bd08798f21be3a67b0ce9d0965416131e576374cd6672b2cef0d01ad967",
-    "local-ledger.mjs": "d393dee5fb64c94afd32a235649b3793ef490b1091fbc8ada04b2298c711ec03",
+    "local-formula.mjs": "706d5ec0cb2caf95a547531a81ca746fe246d4c53d902e03595a3b360e8c85af",
+    "local-ledger.mjs": "2009fb68aadcd7292b72f1d0d99f378d03644be1c5b4b4150d9f6a0b3f7c15ce",
     "blueprint-criterion-wire.mjs": "fb6b7dcce0b97a699e3e8968372767a3fddd83fedc750998573f789177243072",
     "blueprint-criterion-runner.mjs": "761c0e670b4b20c6bed53e5ca5d0178759505c3977ea2ed1b7223383c534bc4c",
+    "local-chain-bindings.mjs": "b8eff999ccd17b53c614a3c9f5376da78fcaa8632bb3e07bc1adcceda2e75f6c",
+    "local-chain-broker.mjs": "0f43ae3d5e713a344d94c3f67891b0d5f6ed0b70a8d237a54d06c0fa36e4c6d8",
+    "local-chain-contracts.mjs": "d4d2be4e5c6980f2dda8ff598c7333a75e0bbf2f656aa7fe327af7c9fe73da07",
+    "local-chain-controller.mjs": "dd80d8001a11d8433b615a017a34c30dd130ff5cd9c5b58731314a8f93c9571b",
+    "local-chain-human.mjs": "9d5dbaef13ebbbe0cfdd1146cd9c48cefcca30f33ccc0b1566e67cbd730d3499",
+    "local-chain-lock.mjs": "e0bc9dccc3c152007f4d67eff0b48de40516ce991b6868f513bc88b53a9b41b2",
+    "local-chain-operations.mjs": "78ba550f374b3b7fd03abfc88ae773e1189795d498929a13089fbf50a5611d9f",
+    "local-chain-plan.mjs": "e45a9170f569c80f7e5532bbc109dbae3c24b696815316e503cb3779135be648",
+    "local-chain-release-labels.mjs": "7ce5350d1062d5236f57f10e7e81713c1101463d5e7f252604ef0c2a30840bfe",
+    "local-chain-results.mjs": "0455f72cad574cfef87c2c6c0928d6432bba7e5dbaff521a2b62a9575299ca10",
     "local-approved-plan.mjs": "bb31bf0f826ce22d1e57c6d9cda5314cbbb1fc04e6c0778eb319045ab23a3193",
     "local-budget-renewal.mjs": "6b436358066fe33b2f6d871fc90d8e7c551edd6255efd73c0d255d0fd35d5ef8",
     "local-probe.mjs": "9b948db1de1e34c7605c4c454cd4aced66d2b57d2cf4471adbb80bcc76dee635",
@@ -101,14 +111,14 @@
     "remote-client.mjs": "dabbcc7bd0fd16ba029163f407edb85e914df83cd5914221eb2ce0d061ca8f28",
     "remote-transport.mjs": "5e5a8c0b490371f7f5a052cffbeee6202d4cf713dff1c43b6d910fe944f8429c",
     "local-credential.mjs": "2a302a7f67b5ea8dc73453fc96ab33db349b59ca11fa9456e48ca1d9669d877c",
-    "local-invocations.mjs": "c7cc4a2d8fbe271865c12ff0cfb89b8db3bbd07e28f26854cd4df18698d31f94",
+    "local-invocations.mjs": "f6ac4c41c1a5ec34de358c4cca210ca8e403b3a913150a43bb55ec9be55d9998",
     "local-task-handoff-fence.mjs": "5532a359ee29b885f7ce0cf7178f76dba0fc9245bdd92ef460982275baf0d557",
     "local-task-handoff-storage.mjs": "f4d5046d54658e8092e035b31fdaeaed6fdbef55a6953827417c857f2e9e6638",
     "local-task-handoff-overlay-wire.mjs": "4fbe3f9d1ed8b6ddf839e9525cdc52c930a22e9d4f4ad562c6f193f621ee6527",
     "local-task-handoff-completion-wire.mjs": "2f3708b162d2d7524dde8c276bb0ad2328c17eefa597e50f30a2cd2ca1fa7fba",
     "local-task-handoff-contracts.mjs": "c03094185fd05308c8a968a719b121e04e2b86201cc0408f3656e7f81f1840ad",
     "local-task-handoff-write-constraints.mjs": "19cba9330dddd170d1cb8707405574f888292acea2dc3f48bc71f6b3c61065cc",
-    "local-task-handoff-observation.mjs": "1bb0d6fb42825f64c5fc3975be7fe3306992a98450382c7fde73d2571a860e91",
+    "local-task-handoff-observation.mjs": "d17c75dba647a1ce01681feeb9109c2f51927309255452166a2c2f7758c5ab50",
     "local-task-handoff-write-wire.mjs": "7b49b66de8ecc33c1c92e9dd50118528972f00e1c7748cb3a230a58eefa9ff3f",
     "local-task-handoff-read-authority.mjs": "7d2991cfac4562039232566d25441aa98106ce27bc9b7bcf6df4ff28d738e167",
     "local-task-handoff-write-archive.mjs": "3668f39d8ab5664ed717994cf1b4bcc7ea23e146a0e06291f851d30337faeb77",
@@ -119,10 +129,10 @@
     "workflow-local-request.mjs": "e8cce489ecadc756e27bf8686556a830e9e789df03a56e034f7b741e6455d3ae",
     "task-message-entry.mjs": "31d10056cb905237cd5649e8eb067009ff1612ec5dc1061e0373209fbc0b646a",
     "task-message-cli.mjs": "3ca65e96c28129b3bd5cac962d106e0859a1f17df1f6a66ee543c6efc22f918d",
-    "local-contracts.mjs": "805bf53e3ba9f83f7c0e889f605308f74ff981ff6606a92422e2cda25c33dc0b",
-    "local-contract-types.mjs": "b338b623ea8085dc04536795e4a01c208189cf430e12ef8c08aaa5e21b01b0b9",
+    "local-contracts.mjs": "43715cd73460ccea734501a3dd5667184da0f6a5b0189e038319a439ba52fc76",
+    "local-contract-types.mjs": "5d244237fc69052b2fa83098022761bae929e8b75a0683883b620711bc132050",
     "local-archguard-ast.mjs": "cefd835312a623e83bf48e4d8e1f76ac6a8adc56c35843705c16967d16bec4e6",
-    "local-archguard-checkpoint.mjs": "beaedc6992f0d9b36b6e881abf4ea5798f678d7b5dd00e1cc15feb254edeefc7",
+    "local-archguard-checkpoint.mjs": "1ee3a40561940a62583382036d4049321627fe9e41e0f31a973ef40bc86fcb55",
     "local-archguard-components.mjs": "a8fb3d0fd787f9160905013fd333cc0b9e8cf624cce797461f36f4ab31d170ad",
     "local-archguard-contract.mjs": "cfc397a1ce171ab84f8bf1db152e6d8d280b7ca041da56a7a4cd62b02c2e2e89",
     "local-archguard-contracts.mjs": "29e9b86f14dc086aa0b791c874d6efc50d849f806b3f2b8725481114f01ba8ba",
@@ -132,31 +142,31 @@
     "local-archguard-operations.mjs": "1a35268b857b86eab54dd4efa78fc54bf08b39dfab4fa980c7dd63b8959206b0",
     "local-archguard-scope.mjs": "afbd23a79c175f198892ddb2026ecac219a1650ee6115763736d9b1ee5a07ee0",
     "local-archguard-signing.mjs": "7de0fe4b8f6f5a92d043ad8976054faaa76b7b37556ed582e5e012c6f0facc87",
-    "local-archguard-snapshot.mjs": "9c47d68ebfd3b05fc0c2acd04f6c69f5c10b7676a5c3ecceee786d72e0505d4b",
+    "local-archguard-snapshot.mjs": "81b456915232b8e87d9b663912bf95062753a0bd0e38a096cbd80c2ef03683f9",
     "local-archguard-state.mjs": "1d3c74c4ec222646e82120be4aa6a00c52d2867fb8c20323420d6ab0bf2cd46c",
     "local-archguard.mjs": "4c8ec5d569d728b15161eb88e49371c77def7d1fe511aa16694581a2c1d59433",
     "archguard-runtime-build.mjs": "45bf31764763973bd8de32b3e16d194162407e7cb74802df3ab363f0fd30e866",
     "runtime/archguard-runtime-v7.0.44.mjs": "836f20b270139371bef43e3934fa7232371e42d46371c513db2a5e3c5622b215",
     "local-decimal.mjs": "93580b0cbdac2e881942658c1cd10394b432219f8657afaaaf4cb1c35c91d644",
-    "local-formula-ast.mjs": "e7475176409f146f46eb8565be8df4108c88f12b46c9b600915834f9843089d7",
-    "local-formula-engine.mjs": "3b6ed599575b17d3da738e0c798804264540cbff87c58459e2ef3fa6072cd003",
+    "local-formula-ast.mjs": "768ec4aa88a127588035d5b94aa2721df00e3e0576dc7e341baaead44795f314",
+    "local-formula-engine.mjs": "cfc44f03bb8dc4797f9f9e859a64a2dd5e4dd316db45624c03f7f8fad3202ede",
     "local-formula-tests.mjs": "d6d2809572c46955e6b556023ed6a12362c8acd0ad0d5be3b1b2dd64439215c0",
-    "local-calctool.mjs": "52c5a53a4c2dda5b62bfc00dfd0f027cbc6ec0c601f10c848842a06ffd5ee93a",
-    "local-calctool-cli.mjs": "75eb8916efbb9049e382a25a312fb0e1fc8bbad6f051e4f024a7e0a2b1588953",
+    "local-calctool.mjs": "9398e642250b38b2831ec58e490fbbef761455ce9ae49af033baa8c3ba8d778e",
+    "local-calctool-cli.mjs": "a6b46e2aa9a91dfb73fc0dc415b2281a0343e22e317ff1bfcf58cadbb8093122",
     "local-calctool-contracts.mjs": "d8fccf662b2dd7aefd5cc6770b2473014af7a28855074fcf294937ca5a49eae8",
-    "local-calctool-runtime.mjs": "a8ec5bc77925a6f43cf4a1bae666d46d109e90b59b1064e4832e6c5bb209f187",
+    "local-calctool-runtime.mjs": "9070b6900d1782bf77357fea1cc522bf796898d56929f96d7cb935b3036ac82f",
     "local-calctool-storage.mjs": "4c3f352847aeb368dea1247759a1055beeab25534adf25b6e7323196d76fd684",
-    "local-mutation-files.mjs": "2de96efc1def554a7fca062e1e605c3dbb60aecd0942b19eb4d179100f0e258f",
+    "local-mutation-files.mjs": "b99a1987e0884cee1f0f04552300fbf61853ea2547d74c77b77c71fc3ebb89ad",
     "local-mutation-snapshot.mjs": "a2f5f1df1fa0ecb40bdd4776e319c5244508ed04a2aa4493aebcec926fc61148",
     "local-mutation-audit.mjs": "5a30ee3446f632e032ffcfe46bcd97d6dfc0f099a76ea5185c3f9a9118c4f6cb",
     "local-mutation-wire.mjs": "dc79992422254d876bec94c621407bede94c9f43c95367a2c9f16a2a64b15576",
-    "local-mutation-binding.mjs": "a4d91da2a7199c8c74adf53c67ae8ccdb2912cb96401c59c7b6c72d36c4e9241",
+    "local-mutation-binding.mjs": "a1756642dd758701b476d332a48799b4af56fdd8f67aba6d46ca9bb2341b6327",
     "local-mutation-pass-store.mjs": "8d6b57c6d1ea3df15a794e6a4cd39497f4412a5f911b9a30b0437498f51f92c0",
-    "local-mutation-authority.mjs": "3a8c275218129afe2674391771d32f7041fe31925431d7e6b73c16a2f664d61e",
+    "local-mutation-authority.mjs": "28561b5b672838a46fa13b0044b5d9302630d073aa5893a7e0990e6567336499",
     "local-mutation-batch.mjs": "80293d8111203687e2527cd23b771447cc44ff58c0b0155c368bcbfa05aa3bb8",
     "local-mutation-batch-receipt.mjs": "b0e6a8522867255d899e60b66677885933f6a1c4c771cbb52f84dbbbdcf5e5c2",
-    "calctool-runtime-entry.mjs": "ae0c678c5b81edb20b5e947548b57c69737659c71fa1c012e4efa5b2153ac261",
+    "calctool-runtime-entry.mjs": "98d2bc8df38d16131fc56db0a3d4d260531ba4df412baa5ddc4b8b5c5ca99fe9",
     "calctool-runtime-build.mjs": "3c5a9bd40bc1abe02e3b6e307809eea4eaaf198e8f0db6f5d6b2583dd68a59d2",
-    "runtime/calctool-runtime-v7.0.43.mjs": "5d3506320d6baba4a8ca42cf55d062ae2b10f186741896c8cc93e536734f961f"
+    "runtime/calctool-runtime-v7.0.43.mjs": "5473427c350411f62c16ac5239fa0db7b96e7b2c19458f9046768dcb4ada87d1"
   }
 }

package/release.mjs

@@ -3,6 +3,7 @@ import { createHash } from 'node:crypto'
 import { readFile, writeFile, rename, rm } from 'node:fs/promises'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
+import { chainReleaseLabels } from './local-chain-release-labels.mjs'
 
 const directory = path.dirname(fileURLToPath(import.meta.url))
 const swarmSourceFiles = Object.freeze([
@@ -38,6 +39,9 @@ const sourceFiles = [
   'package.json', 'manifest.json', 'release.mjs',
   'local-cli.mjs', 'local-state-lock.mjs', 'local-execution.mjs', 'local-integrity.mjs', 'local-evidence-verification.mjs', 'local-formula.mjs', 'local-ledger.mjs',
   'blueprint-criterion-wire.mjs', 'blueprint-criterion-runner.mjs',
+  'local-chain-bindings.mjs', 'local-chain-broker.mjs', 'local-chain-contracts.mjs', 'local-chain-controller.mjs',
+  'local-chain-human.mjs', 'local-chain-lock.mjs', 'local-chain-operations.mjs', 'local-chain-plan.mjs',
+  'local-chain-release-labels.mjs', 'local-chain-results.mjs',
   'local-approved-plan.mjs', 'local-budget-renewal.mjs', 'local-probe.mjs',
   'local-budget-grants.mjs', 'local-budget-handoff.mjs', 'local-budget-handoff-contracts.mjs', 'local-budget-lock.mjs',
   'local-budget-handoff-completion.mjs',
@@ -227,7 +231,7 @@ function releaseNote(changed) {
   if (suppliedZh && suppliedEn) return {
     zh: suppliedZh.replaceAll(/\s+/g, ' '), en: suppliedEn.replaceAll(/\s+/g, ' '),
   }
-  const labels = withFinalGate16ReleaseLabels({ ...calctoolReleaseLabels, ...mutationReleaseLabels, ...swarmReleaseLabels, ...nativeReadReleaseLabels, ...feedbackReleaseLabels, ...invocationReleaseLabels,
+  const labels = withFinalGate16ReleaseLabels({ ...calctoolReleaseLabels, ...mutationReleaseLabels, ...swarmReleaseLabels, ...nativeReadReleaseLabels, ...feedbackReleaseLabels, ...invocationReleaseLabels, ...chainReleaseLabels,
     'blueprint-criterion-wire.mjs': { zh: '蓝图验收标准执行授权', en: 'Blueprint criterion execution authority' },
     'blueprint-criterion-runner.mjs': { zh: '蓝图验收标准实际执行器', en: 'Blueprint criterion process runner' },
     'local-archguard-ast.mjs': { zh: 'Archguard 架构合同与执行守卫', en: 'Archguard architecture contract and execution guard' },

package/releases.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.1.25",
+    "date": "2026-10-07",
+    "zh": "原链本地执行与固定Git计费收口，补齐macOS路径和发布夹具",
+    "en": "Close original-chain local execution and fixed Git accounting, with macOS path and release fixture coverage"
+  },
   {
     "version": "0.1.24",
     "date": "2026-10-07",

package/runtime/calctool-runtime-v7.0.43.mjs

@@ -1528,7 +1528,8 @@ class Decimal {
 const Decimal28 = Decimal;
 
 const FORMULA_OPERATORS = Object.freeze(['add', 'sub', 'mul', 'div', 'safeDivide', 'percentOf', 'round', 'if']);
-const ARITY = { add: [0, 1000], mul: [0, 1000], sub: [2, 2], div: [2, 2], safeDivide: [2, 2], percentOf: [2, 2], round: [1, 1], if: [3, 3] };
+const FORMULA_ROUNDING_POLICY = Object.freeze({ decimalPlaces: 2, mode: 'half-away-from-zero' });
+const ARITY = { add: [1, 1000], mul: [1, 1000], sub: [2, 2], div: [2, 2], safeDivide: [2, 2], percentOf: [2, 2], round: [1, 1], if: [3, 3] };
 function formulaKey(value) {
   if (typeof value !== 'string' || !value.trim() || value.length > 128 || /[\u0000-\u001f\u007f]/.test(value)) throw formulaError('FORMULA_KEY_INVALID', 'formula and field keys must be non-empty strings of at most 128 characters');
   return value;
@@ -1557,28 +1558,35 @@ function formulaRefs(node, output = new Set()) {
   if (node.args) for (const item of node.args) formulaRefs(item, output);
   return [...output].sort();
 }
-function evaluateNode(node, resolve) {
+function roundPlaces(policy) {
+  const value = policy?.decimalPlaces;
+  if (!Number.isInteger(value) || value < 0 || value > 28) throw formulaError('ROUND_POLICY_INVALID', 'rounding policy decimalPlaces must be an integer from 0 to 28');
+  if (policy.mode !== 'half-away-from-zero') throw formulaError('ROUND_POLICY_INVALID', 'rounding policy mode must be half-away-from-zero');
+  return value;
+}
+function evaluateNode(node, resolve, policy) {
   if (Object.hasOwn(node, 'lit')) return Decimal.from(node.lit);
   if (Object.hasOwn(node, 'ref')) return Decimal.from(resolve(node.ref));
   const [left, right, alternate] = node.args;
   switch (node.op) {
-    case 'add': return node.args.reduce((total, item) => total.plus(evaluateNode(item, resolve)), Decimal.from('0'));
-    case 'mul': return node.args.reduce((total, item) => total.times(evaluateNode(item, resolve)), Decimal.from('1'));
-    case 'sub': return evaluateNode(left, resolve).minus(evaluateNode(right, resolve));
-    case 'div': return evaluateNode(left, resolve).div(evaluateNode(right, resolve));
-    case 'safeDivide': { const denominator = evaluateNode(right, resolve); return denominator.isZero() ? Decimal.from('0') : evaluateNode(left, resolve).div(denominator); }
-    case 'percentOf': return evaluateNode(left, resolve).div(evaluateNode(right, resolve)).times('100');
-    case 'round': return evaluateNode(left, resolve).rounded(2);
-    case 'if': return evaluateNode(left, resolve).isZero() ? evaluateNode(alternate, resolve) : evaluateNode(right, resolve);
+    case 'add': return node.args.reduce((total, item) => total.plus(evaluateNode(item, resolve, policy)), Decimal.from('0'));
+    case 'mul': return node.args.reduce((total, item) => total.times(evaluateNode(item, resolve, policy)), Decimal.from('1'));
+    case 'sub': return evaluateNode(left, resolve, policy).minus(evaluateNode(right, resolve, policy));
+    case 'div': return evaluateNode(left, resolve, policy).div(evaluateNode(right, resolve, policy));
+    case 'safeDivide': { const denominator = evaluateNode(right, resolve, policy); if (denominator.isZero()) throw formulaError('DIV_ZERO', 'division by zero', { nodeId: 'safeDivide' }); return evaluateNode(left, resolve, policy).div(denominator); }
+    case 'percentOf': return evaluateNode(left, resolve, policy).div(evaluateNode(right, resolve, policy)).times('100');
+    case 'round': return evaluateNode(left, resolve, policy).rounded(roundPlaces(policy));
+    case 'if': return evaluateNode(left, resolve, policy).isZero() ? evaluateNode(alternate, resolve, policy) : evaluateNode(right, resolve, policy);
     default: throw formulaError('UNSUPPORTED_OPERATOR', 'unsupported normalized formula operator');
   }
 }
-function evaluateFormula(node, values = {}) {
+function evaluateFormula(node, values = {}, options = {}) {
   formulaObject(values, 'formula values');
+  const policy = options.roundingPolicy ?? FORMULA_ROUNDING_POLICY;
   return evaluateNode(normalizeFormula(node), key => {
     if (!Object.hasOwn(values, key) || values[key] === null || values[key] === undefined || values[key] === '') throw formulaError('MISSING_INPUT', `missing input: ${key}`, { fieldId: key });
     return values[key];
-  });
+  }, policy);
 }
 function compileFormulaGraph(formulas, fieldKeys) {
   if (!Array.isArray(formulas) || formulas.length > 1000) throw formulaError('FORMULA_GRAPH_INVALID', 'formulas must be an array of at most 1000 definitions');
@@ -1605,8 +1613,9 @@ function compileFormulaGraph(formulas, fieldKeys) {
   for (const key of [...definitions.keys()].sort()) visit(key);
   return { formulas: [...definitions.values()].sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0), dependencies, order };
 }
-function evaluateFormulaGraph(formulas, inputs = {}) {
+function evaluateFormulaGraph(formulas, inputs = {}, options = {}) {
   formulaObject(inputs, 'formula inputs');
+  const policy = options.roundingPolicy ?? FORMULA_ROUNDING_POLICY;
   const values = new Map(Object.entries(inputs).map(([key, value]) => [key, Decimal.from(value)]));
   const graph = compileFormulaGraph(formulas);
   const definitions = new Map(graph.formulas.map(item => [item.key, item.expression]));
@@ -1618,13 +1627,14 @@ function evaluateFormulaGraph(formulas, inputs = {}) {
       return values.get(key);
     }
     if (visiting.has(key)) throw formulaError('FORMULA_CYCLE', `formula cycle at ${key}`);
-    visiting.add(key); const value = evaluateNode(definitions.get(key), resolve); visiting.delete(key); results.set(key, value); return value;
+    visiting.add(key); const value = evaluateNode(definitions.get(key), resolve, policy); visiting.delete(key); results.set(key, value); return value;
   };
   return Object.fromEntries(graph.formulas.map(item => [item.key, resolve(item.key).toString()]));
 }
 
 const FORMULA_SCHEMA = 'entrorove.formula-engine/1.0';
 const FORMULA_RUNTIME_VERSION = 'decimal28-ast/1.0';
+{ FORMULA_ROUNDING_POLICY };
 const TYPES = ['number', 'integer', 'money', 'percent', 'text', 'date', 'enum'];
 const NUMERIC = TYPES.slice(0, 4);
 const ID = /^[a-z0-9][a-z0-9._-]{0,127}$/;
@@ -1642,6 +1652,14 @@ function cloned(value) { return JSON.parse(formulaCanonical(value)); }
 function requiredText(value, field) {
   if (typeof value !== 'string' || !value.trim()) throw formulaError('ENGINE_REQUIRED_FIELD', `${field} is required`);
 }
+function normalizeRoundingPolicy(value) {
+  const policy = value ?? FORMULA_ROUNDING_POLICY;
+  formulaObject(policy, 'roundingPolicy');
+  if (Object.keys(policy).sort().join(',') !== 'decimalPlaces,mode'
+    || !Number.isInteger(policy.decimalPlaces) || policy.decimalPlaces < 0 || policy.decimalPlaces > 28
+    || policy.mode !== 'half-away-from-zero') throw formulaError('ROUND_POLICY_INVALID', 'roundingPolicy must declare decimalPlaces 0..28 and half-away-from-zero mode');
+  return { decimalPlaces: policy.decimalPlaces, mode: policy.mode };
+}
 function normalizeEngine(engine) {
   formulaObject(engine, 'engine');
   if (engine.schemaVersion !== 'engine.spec/1') throw formulaError('ENGINE_SCHEMA_VERSION', 'Expected engine.spec/1');
@@ -1662,12 +1680,14 @@ function normalizeEngine(engine) {
     if (NUMERIC.includes(field.type) && typeof field.unit !== 'string') throw formulaError('FIELD_UNIT_MISSING', 'numeric fields require an explicit unit');
     if (field.required !== undefined && typeof field.required !== 'boolean') throw formulaError('FIELD_REQUIRED_INVALID', 'field required must be boolean');
   }
+  const roundingPolicy = normalizeRoundingPolicy(engine.roundingPolicy);
   const graph = compileFormulaGraph(engine.formulas, [...keys]);
   for (const item of graph.formulas) for (const ref of graph.dependencies[item.key]) {
     const field = engine.fields.find(entry => entry.key === ref);
     if (field && !NUMERIC.includes(field.type)) throw formulaError('FORMULA_REF_TYPE', `formula reference ${ref} must be numeric`);
   }
   const normalized = cloned(engine);
+  normalized.roundingPolicy = roundingPolicy;
   normalized.formulas = engine.formulas.map(item => ({ ...cloned(item), expression: graph.formulas.find(entry => entry.key === item.key).expression }));
   return { engine: normalized, graph };
 }
@@ -1683,7 +1703,8 @@ function buildFormulaEngine(requirements) {
     semanticVersion: requirements.semanticVersion ?? '1.0.0', status: 'draft', compatibilityProfile: 'legacy-compatible',
     decimalPolicy: requirements.decimalPolicy ?? 'decimal-string', defaultLocale: requirements.defaultLocale ?? 'zh-CN',
     category: requirements.category ?? 'general', inputMethod: requirements.inputMethod ?? 'manual', output: requirements.output ?? ['metric-cards'],
-    constraints: requirements.constraints ?? '', fields: requirements.inputs, formulas: requirements.formulas,
+    constraints: requirements.constraints ?? '', roundingPolicy: requirements.roundingPolicy ?? FORMULA_ROUNDING_POLICY,
+    fields: requirements.inputs, formulas: requirements.formulas,
     rules: requirements.rules ?? [], views: requirements.views ?? [], importProfiles: requirements.importProfiles ?? [],
     reports: requirements.reports ?? [], testSuites: requirements.testSuites ?? [], acceptance: requirements.acceptance ?? '',
   };
@@ -1692,6 +1713,7 @@ function buildFormulaEngine(requirements) {
 function compileFormulaEngine(engine) {
   const normalized = normalizeEngine(engine);
   const program = { schemaVersion: FORMULA_SCHEMA, runtimeVersion: FORMULA_RUNTIME_VERSION, decimalPolicy: DECIMAL_POLICY,
+    roundingPolicy: normalized.engine.roundingPolicy,
     engineId: normalized.engine.engineId, engineVersion: normalized.engine.semanticVersion,
     engineDigest: formulaDigest(normalized.engine), engine: normalized.engine,
     formulas: normalized.graph.formulas, dependencies: normalized.graph.dependencies, order: normalized.graph.order };
@@ -1719,7 +1741,8 @@ function evaluateFormulaProgram(program, inputs = {}, expected = {}) {
     } else if (typeof value !== 'string') throw formulaError('ENGINE_INPUT_TYPE', `${key} must be text`);
   }
   for (const field of fields.values()) if (field.required && (!Object.hasOwn(inputs, field.key) || inputs[field.key] === '' || inputs[field.key] === null)) throw formulaError('MISSING_INPUT', `missing input: ${field.key}`, { fieldId: field.key });
-  return evaluateFormulaGraph(verified.formulas, Object.fromEntries(Object.entries(inputs).filter(([key]) => NUMERIC.includes(fields.get(key).type))));
+  return evaluateFormulaGraph(verified.formulas, Object.fromEntries(Object.entries(inputs).filter(([key]) => NUMERIC.includes(fields.get(key).type))),
+    { roundingPolicy: verified.roundingPolicy });
 }
 function formulaImpact(program, changedKeys) {
   const verified = verifyFormulaProgram(program);
@@ -1818,7 +1841,7 @@ function createCalctoolEntrypoint(core) {
         const output = await core.run(request, options);
         return { ...output, capabilities: { ...output.capabilities, operations: CLOUD_OPERATIONS, localRunnerOperations: LOCAL_OPERATIONS,
           formulaOperators: FORMULA_OPERATORS, engineSchema: 'engine.spec/1', formulaRuntime: 'decimal28-ast/1.0',
-          decimalPolicy: { precision: 28, rounding: 'half-away-from-zero', representation: 'decimal-string' } },
+          decimalPolicy: { precision: 28, rounding: 'half-away-from-zero', representation: 'decimal-string' }, roundingPolicy: FORMULA_ROUNDING_POLICY },
           localRunner: { command: 'entrorove local calctool-<operation>', requiredFor: LOCAL_OPERATIONS } };
       }
       if (request.operation === 'validate') {