@entrorove/skill 0.1.24 → 0.1.28

package/local-invocations.mjs

@@ -9,6 +9,7 @@ const UUID = /^[a-f0-9-]{36}$/;
 const ID = /^[a-z][a-z0-9-]{0,63}$/;
 const COUNTS = ['inputTokens', 'outputTokens', 'durationMs'];
 const events = new Set(['started', 'completed', 'rejected', 'outcome-unknown', 'not-sent', 'status']);
+const readOnlyOperations = new Set(['ledger-query', 'chain-ledger-query']);
 
 function receipt(value, requestId) {
   if (!value || !UUID.test(value.usageId) || value.requestId !== requestId
@@ -44,6 +45,22 @@ async function ledgerFile(home) {
   return path.join(directory, 'invocations.jsonl');
 }
 
+async function finalGateStateExists(input) {
+  if (!input || typeof input.home !== 'string' || typeof input.repositoryRoot !== 'string' || typeof input.gateId !== 'string') return false;
+  try {
+    const root = await fs.realpath(input.repositoryRoot);
+    const repositoryDigest = createHash('sha256').update(root).digest('hex');
+    const base = path.join(await fs.realpath(input.home), '.entrorove', 'calctool', 'final-gates', repositoryDigest);
+    for (const flow of await fs.readdir(base, { withFileTypes: true })) {
+      if (!flow.isDirectory() || flow.isSymbolicLink()) continue;
+      const target = path.join(base, flow.name, `${input.gateId}.json`);
+      try { const stat = await fs.lstat(target); if (stat.isFile() && !stat.isSymbolicLink()) return true; }
+      catch (error) { if (error?.code !== 'ENOENT') throw error; }
+    }
+  } catch (error) { if (!['ENOENT', 'ENOTDIR'].includes(error?.code)) throw error; }
+  return false;
+}
+
 export async function appendInvocation(value, home = os.homedir()) {
   if (!value || !SHA.test(value.requestId) || !ID.test(value.operation) || !events.has(value.event)
     || !['remote', 'local'].includes(value.kind)) throw new Error('Invalid invocation ledger metadata');
@@ -77,6 +94,24 @@ function canonical(value) {
 }
 
 export async function withLocalInvocation(operation, input, work) {
+  // A final-gate recovery carries only the immutable identity fields and must
+  // remain a read-only GET-style lookup. A fresh gate includes plans and keeps
+  // the normal invocation audit record.
+  if (readOnlyOperations.has(operation)) return work();
+  if (operation === 'final-gate' && input) {
+    if (!Object.hasOwn(input, 'plans')) return work();
+    try {
+      const { statePath16 } = await import('./local-final-gate16-state.mjs');
+      const target = await statePath16(input);
+      if (target) {
+        try { await fs.access(target); return work(); }
+        catch (error) { if (error?.code !== 'ENOENT') throw error; }
+      }
+      if (await finalGateStateExists(input)) return work();
+    } catch (error) {
+      if (error?.code !== 'ENOENT') throw error;
+    }
+  }
   const requestId = createHash('sha256').update(operation + canonical(input)).digest('hex');
   const metadata = { kind: 'local', operation, requestId };
   await appendInvocation({ ...metadata, event: 'started' }, input.home);

package/local-ledger.mjs

@@ -19,9 +19,20 @@ async function repository(value) { if (typeof value !== 'string' || !path.isAbso
 function repoDigest(root) { return sha(root).slice(0, 32); }
 async function privateDir(directory) { await fs.mkdir(directory, { recursive: true, mode: 0o700 }); const stat = await fs.lstat(directory); if (!stat.isDirectory() || stat.isSymbolicLink()) fail('ENTROROVE_STATE_INVALID', 'state directory must be a real directory'); if (process.platform !== 'win32') await fs.chmod(directory, 0o700); }
 async function atomic(file, value) { await privateDir(path.dirname(file)); const tmp = `${file}.${randomUUID()}.tmp`; await fs.writeFile(tmp, `${canonical(value)}\n`, { flag: 'wx', mode: 0o600 }); await fs.rename(tmp, file); if (process.platform !== 'win32') await fs.chmod(file, 0o600); }
-async function read(file) { await privateDir(path.dirname(file)); const stat = await fs.lstat(file); if (!stat.isFile() || stat.isSymbolicLink()) fail('ENTROROVE_STATE_INVALID', 'ledger state must be a regular file'); return JSON.parse(await fs.readFile(file, 'utf8')); }
+async function read(file, ensureDirectory = true) { if (ensureDirectory) await privateDir(path.dirname(file)); const stat = await fs.lstat(file); if (!stat.isFile() || stat.isSymbolicLink()) fail('ENTROROVE_STATE_INVALID', 'ledger state must be a regular file'); return JSON.parse(await fs.readFile(file, 'utf8')); }
 function ledgerPath(home, root) { return path.join(rootFor(home), 'ledgers', repoDigest(root), 'state.json'); }
 async function loadLedger(input, create = false) { const root = await repository(input.repositoryRoot); const file = ledgerPath(input.home, root); try { const state = await read(file); if (state.schemaVersion !== LEDGER_SCHEMA || state.repositoryDigest !== repoDigest(root)) fail('ENTROROVE_LEDGER_INVALID', 'ledger identity mismatch'); return { root, file, state }; } catch (error) { if (!create || error.code !== 'ENOENT') throw error; const state = { schemaVersion: LEDGER_SCHEMA, repositoryDigest: repoDigest(root), sequence: 0, head: null, activeBranch: null, branches: [], records: [] }; await atomic(file, state); return { root, file, state }; } }
+async function readLedgerForQuery(input) {
+  const root = await repository(input.repositoryRoot); const file = ledgerPath(input.home, root);
+  try {
+    const state = await read(file, false);
+    if (state.schemaVersion !== LEDGER_SCHEMA || state.repositoryDigest !== repoDigest(root)) fail('ENTROROVE_LEDGER_INVALID', 'ledger identity mismatch');
+    return { root, file, state };
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+    return { root, file, state: { schemaVersion: LEDGER_SCHEMA, repositoryDigest: repoDigest(root), sequence: 0, head: null, activeBranch: null, branches: [], records: [] } };
+  }
+}
 async function append(input, event, data = {}) { const root = await repository(input.repositoryRoot); const file = ledgerPath(input.home, root); const previous = ledgerLocks.get(file) ?? Promise.resolve(); let release; const current = new Promise(resolve => { release = resolve; }); const queued = previous.then(() => current); ledgerLocks.set(file, queued); await previous; try { return await withStateLock(file, async () => { const authority = await loadLedger(input, true); const at = new Date().toISOString(); const unsigned = { sequence: authority.state.sequence + 1, event, at, ...data }; const record = { ...unsigned, previousDigest: authority.state.head, digest: sha(canonical(unsigned) + (authority.state.head ?? '')) }; const state = { ...authority.state, sequence: record.sequence, head: record.digest, records: [...authority.state.records, record] }; await atomic(authority.file, state); return { authority, state, record }; }); } finally { release(); if (ledgerLocks.get(file) === queued) ledgerLocks.delete(file); } }
 export async function appendLedgerRecord(input, event, data = {}) { if (typeof event !== 'string' || !event.trim()) fail('ENTROROVE_LEDGER_EVENT', 'ledger event is required'); return (await append(input, event, data)).record; }
 export async function branchCreate(input) { const name = id(input.name ?? input.branchName, 'branchName'); const fromRef = typeof input.fromRef === 'string' && input.fromRef ? input.fromRef : 'working-tree'; const authority = await loadLedger(input, true); if (authority.state.branches.some(item => item.name === name)) fail('ENTROROVE_BRANCH_EXISTS', `virtual branch already exists: ${name}`); const branch = { branchId: `branch-${randomUUID()}`, name, fromRef, description: input.description ?? '', virtual: true, createdAt: new Date().toISOString(), snapshotId: input.snapshotId ?? null }; const state = { ...authority.state, branches: [...authority.state.branches, branch], activeBranch: authority.state.activeBranch ?? name }; await atomic(authority.file, state); await append(input, 'branch-create', { name, fromRef, virtual: true }); return { schemaVersion: LEDGER_SCHEMA, status: 'verified', branch, forbidGitBranch: true, forbidWorktree: true }; }
@@ -36,7 +47,7 @@ export async function preflight(input) {
   const reasons = []; if (!archguard.verified) reasons.push(archguard.reason); if (!evidence) reasons.push('trusted signed evidence bound to this flow, snapshot, and contract with exitCode 0 is required');
   return { schemaVersion: LEDGER_SCHEMA, status: archguard.verified && evidence ? 'verified' : 'blocked', source: 'entrorove-ledger', checks: { archguard: archguard.verified, evidence }, reasons, virtualOnly: true, keyId: archguard.keyId ?? null };
 }
-export async function ledgerQuery(input) { const authority = await loadLedger(input, true); const limit = Number.isSafeInteger(input.limit) ? Math.min(500, Math.max(1, input.limit)) : 100; return { schemaVersion: LEDGER_SCHEMA, status: 'verified', repositoryDigest: repoDigest(authority.root), records: authority.state.records.slice(-limit), head: authority.state.head, sequence: authority.state.sequence }; }
+export async function ledgerQuery(input) { const authority = await readLedgerForQuery(input); const limit = Number.isSafeInteger(input.limit) ? Math.min(500, Math.max(1, input.limit)) : 100; return { schemaVersion: LEDGER_SCHEMA, status: 'verified', repositoryDigest: repoDigest(authority.root), records: authority.state.records.slice(-limit), head: authority.state.head, sequence: authority.state.sequence }; }
 
 function validatePlan(plan) { if (!plan || typeof plan !== 'object' || Array.isArray(plan) || plan.schemaVersion !== 'entrorove.execution-plan/1.0' || !ID.test(plan.chainId) || !Array.isArray(plan.steps) || !plan.steps.length) fail('ENTROROVE_CHAIN_PLAN_INVALID', 'chain plan must declare a schema, chainId, and steps'); const seen = new Set(); for (const [index, step] of plan.steps.entries()) { if (!step || typeof step !== 'object' || !ID.test(step.stepId) || seen.has(step.stepId) || !['command', 'skill', 'coordinator', 'decision'].includes(step.kind)) fail('ENTROROVE_CHAIN_STEP_INVALID', `step ${index} is invalid`); seen.add(step.stepId); } return plan; }
 async function chainAuthority(input, create = false) { const root = await repository(input.repositoryRoot); const chainId = id(input.chainId ?? input.plan?.chainId, 'chainId'); const file = path.join(rootFor(input.home), 'chains', repoDigest(root), chainId, 'state.json'); try { const state = await read(file); if (state.schemaVersion !== CHAIN_SCHEMA || state.chainId !== chainId || state.repositoryDigest !== repoDigest(root)) fail('ENTROROVE_CHAIN_INVALID', 'chain state identity mismatch'); return { root, chainId, file, state }; } catch (error) { if (!create || error.code !== 'ENOENT') throw error; return { root, chainId, file, state: null }; } }

package/local-mutation-authority.mjs

@@ -4,7 +4,7 @@ import { appendLedgerRecord } from './local-ledger.mjs';
 import { withStateLock } from './local-state-lock.mjs';
 import { withTaskHandoffIssueFence, withTaskHandoffWriteFence, assertTaskHandoffSnapshotBinding } from './local-task-handoff-fence.mjs';
 import { mutationFail14, mutationPath14, mutationStateRoot14,
-  privateMutationDirectory14, writeMutationProjectFile14 } from './local-mutation-files.mjs';
+  mutationRead14, privateMutationDirectory14, writeMutationProjectFile14 } from './local-mutation-files.mjs';
 import { mutationPass14, mutationLifetime14 } from './local-mutation-wire.mjs';
 import { mutationOriginalBinding14, mutationSnapshotBinding14 } from './local-mutation-binding.mjs';
 import { installMutationPass14, mutationPassLocations14, readMutationConsumption14,
@@ -42,20 +42,27 @@ export async function issueMutationPass14(input) {
     });
   });
 }
-async function checkedPass(input, state) {
+async function checkedPass(input, state, { allowTargetDrift = false } = {}) {
   const pass = await readStoredMutationPass14(input), target = mutationPath14(input.targetPath, 'targetPath');
   if (!pass.paths.includes(target)) mutationFail14('ENTROROVE_MUTATION_WRITE_SCOPE', 'Guarded writing is outside the cloud pass path set');
   const binding = await mutationOriginalBinding14(input, pass, state);
-  const snapshot = await mutationSnapshotBinding14(input, pass, { targetPath: target });
+  const snapshot = await mutationSnapshotBinding14(input, pass, { targetPath: target, allowTargetDrift });
   assertTaskHandoffSnapshotBinding(binding.state, pass.snapshotReceipt);
   const locations = await mutationPassLocations14(input, binding, pass);
   const ledger = await readMutationConsumption14(pass, locations);
-  if (Object.hasOwn(ledger.writes, target)) mutationFail14('ENTROROVE_MUTATION_PASS_CONSUMED', 'Mutation pass was already consumed or has an unresolved physical write');
+  const consumedWrite = ledger.writes[target];
+  if (allowTargetDrift) {
+    if (consumedWrite?.status !== 'written') mutationFail14('ENTROROVE_MUTATION_PASS_CONSUMED', 'Checkpoint requires a completed guarded write');
+    const current = await mutationRead14(input, binding.root, target);
+    if (current.sha256 !== consumedWrite.contentDigest) mutationFail14('ENTROROVE_MUTATION_WRITE_CHANGED', 'Checkpoint target differs from its completed guarded write');
+  } else if (consumedWrite) {
+    mutationFail14('ENTROROVE_MUTATION_PASS_CONSUMED', 'Mutation pass was already consumed or has an unresolved physical write');
+  }
   return { pass, target, binding, snapshot, locations, ledger };
 }
-export async function verifyMutationPass14(input) {
+export async function verifyMutationPass14(input, { allowTargetDrift = false } = {}) {
   return withMutationAudit14(input, 'mutation-pass-verify', async () => {
-    const value = await checkedPass(input);
+    const value = await checkedPass(input, undefined, { allowTargetDrift });
     return { schemaVersion: SCHEMA, verified: true, pass: value.pass, targetPath: value.target };
   });
 }

package/local-mutation-binding.mjs

@@ -39,7 +39,7 @@ export async function mutationOriginalBinding14(input, authority, state) {
   }
   return { root, home, context: ctx, state: current };
 }
-export async function mutationSnapshotBinding14(input, pass, { allSources = false, targetPath } = {}) {
+export async function mutationSnapshotBinding14(input, pass, { allSources = false, targetPath, allowTargetDrift = false } = {}) {
   mutationPass14(pass);
   const root = await mutationRoot14(input.repositoryRoot);
   const snapshot = await snapshotAuthority14(input, root, pass.snapshotReceipt);
@@ -53,7 +53,10 @@ export async function mutationSnapshotBinding14(input, pass, { allSources = fals
   if (snapshot.manifest.files.some(file => !file.exists && !pass.newFilePaths.includes(file.path))) {
     mutationFail14('ENTROROVE_MUTATION_NEW_FILE_SCOPE', 'Missing source is outside the original planned new-file set');
   }
-  if (allSources || targetPath) await verifySnapshotSources14(input, root, snapshot.manifest,
+  // ArchGuard validates the changed target after a guarded write. The original
+  // snapshot still binds the pass, while its target source is expected to drift
+  // before checkpoint evaluation. Ordinary mutation paths keep the hash check.
+  if (allSources || targetPath && !allowTargetDrift) await verifySnapshotSources14(input, root, snapshot.manifest,
     { paths: allSources ? snapshot.manifest.paths : [targetPath] });
   return { ...snapshot, root };
 }

package/local-mutation-files.mjs

@@ -63,6 +63,31 @@ async function inspectPath(target, { allowMissing = false, final = 'file', code
     else return { target: resolved, exists: true, stat, ancestors };
   }
 }
+async function canonicalDirectoryPath(value, { allowMissing = false, code }) {
+  const resolved = absolute(value, 'filesystem path');
+  const base = path.parse(resolved).root;
+  const parts = path.relative(base, resolved).split(path.sep).filter(Boolean);
+  let current = base;
+  for (const [index, part] of parts.entries()) {
+    const candidate = path.join(current, part);
+    let stat;
+    try { stat = await fs.lstat(candidate); } catch (error) {
+      if (error.code === 'ENOENT' && allowMissing) return path.join(current, ...parts.slice(index));
+      throw error;
+    }
+    if (stat.isSymbolicLink()) {
+      const linked = await fs.realpath(candidate);
+      const systemAlias = process.platform === 'darwin' && current === base
+        && ['/var', '/tmp', '/etc'].includes(candidate) && linked === path.join('/private', candidate);
+      if (!systemAlias) mutationFail14(code, 'mutation paths refuse symlink, non-directory ancestors, and invalid file types');
+      current = linked;
+      continue;
+    }
+    if (!stat.isDirectory()) mutationFail14(code, 'mutation paths refuse symlink, non-directory ancestors, and invalid file types');
+    current = candidate;
+  }
+  return current;
+}
 async function assertAncestors(item, code = 'ENTROROVE_STATE_CHANGED') {
   for (const ancestor of item.ancestors) {
     const stat = await fs.lstat(ancestor.path);
@@ -72,12 +97,12 @@ async function assertAncestors(item, code = 'ENTROROVE_STATE_CHANGED') {
   }
 }
 export async function mutationRoot14(value) {
-  const root = absolute(value, 'repositoryRoot');
-  await inspectPath(root, { final: 'directory', code: 'ENTROROVE_ROOT_INVALID' });
-  return root;
+  const canonicalRoot = await canonicalDirectoryPath(value, { code: 'ENTROROVE_ROOT_INVALID' });
+  await inspectPath(canonicalRoot, { final: 'directory', code: 'ENTROROVE_ROOT_INVALID' });
+  return canonicalRoot;
 }
 export async function mutationHome14(value = os.homedir()) {
-  const home = absolute(value, 'home');
+  const home = await canonicalDirectoryPath(value, { allowMissing: true, code: 'ENTROROVE_HOME_INVALID' });
   await inspectPath(home, { allowMissing: true, final: 'directory', code: 'ENTROROVE_HOME_INVALID' });
   return home;
 }

package/local-task-handoff-observation.mjs

@@ -9,7 +9,10 @@ function fail(message) { throw Object.assign(new Error(message), { code: 'ENTROR
 export async function loadTaskHandoffSigner(ctx, file, keyId) {
   async function control(target) {
     if (typeof target !== 'string' || !path.isAbsolute(target)) fail('runner signer controls are unavailable; an external absolute configuration is required');
-    const actual = await fs.realpath(target), relative = path.relative(ctx.root, actual);
+    let actual;
+    try { actual = await fs.realpath(target); }
+    catch { fail('runner signer controls are unavailable; an external absolute configuration is required'); }
+    const relative = path.relative(ctx.root, actual);
     if (actual !== path.resolve(target) || relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative))) fail('runner signer controls must be external real files');
     const value = await regular(target, 16 * 1024);
     if ((process.platform !== 'win32' && (value.stat.mode & 0o077)) || (typeof process.getuid === 'function' && value.stat.uid !== process.getuid())) fail('runner signer controls must be owned private files');

package/local-validator-isolation17.mjs

@@ -0,0 +1,256 @@
+import { createHash, createPrivateKey, createPublicKey, randomUUID, sign, verify } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { runApprovedPlanObject, RUNNER_LIMITS } from './local-approved-plan.mjs';
+import { assertBudgetRunnerAllowed } from './local-budget-reads.mjs';
+
+export const ISOLATION_SCHEMA17 = 'entrorove.validator-isolation-receipt/1.0';
+const CONTROL_SCHEMA = 'entrorove.validator-isolation-control/1.0';
+const SANDBOX = '/usr/bin/sandbox-exec';
+const MARKER = 'ENTROROVE_ISOLATION17:';
+export const isolationCanonical17 = value => Array.isArray(value) ? `[${value.map(isolationCanonical17).join(',')}]`
+  : value && typeof value === 'object' ? `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${isolationCanonical17(value[key])}`).join(',')}}` : JSON.stringify(value);
+export const isolationDigest17 = value => createHash('sha256').update(value).digest('hex');
+function fail(code, message) { throw Object.assign(new Error(message), { code }); }
+function exact(value, fields, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).sort().join('|') !== [...fields].sort().join('|')) {
+    fail('ENTROROVE_ISOLATION_INVALID', `${label} requires its exact original fields`);
+  }
+}
+function platform() {
+  if (process.platform !== 'darwin') fail('ENTROROVE_ISOLATION_PLATFORM_UNSUPPORTED', 'Validator isolation17 requires the macOS Seatbelt backend');
+}
+function inside(root, target) { const r = path.relative(root, target); return r === '' || !path.isAbsolute(r) && r !== '..' && !r.startsWith('../'); }
+async function directory(value, privateDirectory = false) {
+  if (typeof value !== 'string' || !path.isAbsolute(value)) fail('ENTROROVE_ISOLATION_PATH', 'isolation directory must be absolute');
+  const canonical = await fs.realpath(value), stat = await fs.lstat(canonical);
+  if (canonical !== value || !stat.isDirectory() || stat.isSymbolicLink() || privateDirectory && (stat.uid !== process.getuid() || (stat.mode & 0o777) !== 0o700)) {
+    fail('ENTROROVE_ISOLATION_PATH', 'isolation directory must be canonical, owned and private where required');
+  }
+  return canonical;
+}
+async function regular(file, privateFile = false) {
+  const stat = await fs.lstat(file);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > RUNNER_LIMITS.maxExecutableBytes || await fs.realpath(file) !== file
+    || privateFile && (stat.uid !== process.getuid() || (stat.mode & 0o777) !== 0o600 || stat.nlink !== 1 || stat.size > RUNNER_LIMITS.maxControlBytes)) {
+    fail('ENTROROVE_ISOLATION_FILE', 'isolation input must be its canonical bounded regular file');
+  }
+  const bytes = await fs.readFile(file); return { bytes, sha256: isolationDigest17(bytes) };
+}
+async function privateControl(root, file) {
+  if (typeof file !== 'string' || !path.isAbsolute(file) || inside(root, file)) fail('ENTROROVE_ISOLATION_CONTROL', 'isolation controls must be outside the repository');
+  await directory(path.dirname(file), true); return regular(file, true);
+}
+const BOOTSTRAP = `import {readFileSync,writeFileSync} from 'node:fs';
+import net from 'node:net';import {spawn} from 'node:child_process';
+const [nonce,readTarget,writeTarget,port,executable,...args]=process.argv.slice(2);
+const denied=work=>{try{work();return {denied:false,code:'ALLOWED'};}catch(e){return {denied:['EPERM','EACCES'].includes(e.code),code:e.code??'UNKNOWN'};}};
+const probes={externalRead:denied(()=>readFileSync(readTarget)),externalWrite:denied(()=>writeFileSync(writeTarget,'DENIED17'))};
+probes.network=await new Promise(resolve=>{const socket=net.connect({host:'127.0.0.1',port:Number(port)});let done=false;
+const finish=result=>{if(done)return;done=true;clearTimeout(timer);socket.destroy();resolve(result)};
+const timer=setTimeout(()=>finish({denied:false,code:'TIMEOUT'}),2000);
+socket.once('connect',()=>finish({denied:false,code:'ALLOWED'}));socket.once('error',e=>finish({denied:['EPERM','EACCES'].includes(e.code),code:e.code??'UNKNOWN'}));});
+process.stdout.write('${MARKER}'+JSON.stringify({nonce,probes})+'\\n');
+if(Object.values(probes).some(p=>!p.denied)){process.exitCode=78;}else{
+const child=spawn(executable,args,{cwd:process.cwd(),env:process.env,shell:false,stdio:['ignore','inherit','inherit']});
+child.once('error',()=>{process.exitCode=79});child.once('close',(code,signal)=>{if(signal)process.kill(process.pid,signal);else process.exitCode=code??79;});}
+`;
+export const ISOLATION_BOOTSTRAP_SHA25617 = isolationDigest17(BOOTSTRAP);
+function ancestors(files) {
+  const result = new Set();
+  for (const file of files) { let at = path.dirname(file); while (true) { result.add(at); if (at === '/') break; at = path.dirname(at); } }
+  return [...result].sort();
+}
+function profile(root, plan, node, bootstrapPath) {
+  const files = [...plan.files.map(file => path.resolve(root, file.path)), node, plan.policy.executable, bootstrapPath];
+  if (plan.files.some(file => !inside(root, path.resolve(root, file.path)) || !file.path || path.isAbsolute(file.path))) {
+    fail('ENTROROVE_ISOLATION_MANIFEST', 'isolation reads require the exact original repository manifest');
+  }
+  const literals = values => [...new Set(values)].sort().map(value => `(literal ${JSON.stringify(value)})`).join(' ');
+  return ['(version 1)', '(deny default)', '(allow process-fork)', `(allow process-exec ${literals([node, plan.policy.executable])})`,
+    '(allow signal (target self))', '(allow sysctl-read)', '(allow file-read-metadata)',
+    '(allow file-read-data (subpath "/System/Library") (subpath "/usr/lib") (subpath "/private/var/db/dyld")'
+      + ` (literal "/dev/null") (literal "/dev/random") (literal "/dev/urandom") ${literals(files)})`,
+    `(allow file-read* ${literals(ancestors([...files, path.join(root, 'directory-entry')]))})`].join('\n');
+}
+function wrapped(control) {
+  const plan = structuredClone(control.originalPlan);
+  plan.policy = { ...plan.policy, executable: SANDBOX, executableSha256: control.sandboxSha256,
+    args: ['-f', control.profilePath, control.nodeExecutable, control.bootstrapPath,
+      control.nonce, control.readTarget, control.writeTarget, String(control.networkProbePort), control.originalPlan.policy.executable, ...control.originalPlan.policy.args] };
+  return plan;
+}
+const command = plan => [plan.policy.executable, ...plan.policy.args].map(value => JSON.stringify(value)).join(' ');
+function guardEnvironment(environment) {
+  if (!environment || typeof environment !== 'object' || Object.keys(environment).some(key => /^(DYLD_|LD_|NODE_OPTIONS$|NODE_PATH$)/.test(key))) {
+    fail('ENTROROVE_ISOLATION_ENVIRONMENT', 'isolation cannot inherit loader injection or alternate Node startup policies');
+  }
+}
+export async function prepareValidatorIsolation17(input) {
+  platform(); await assertBudgetRunnerAllowed(input);
+  const fields = ['repositoryRoot', 'executionPlan', 'controlRoot', ...['networkProbePort', 'home', 'flowId'].filter(key => input[key] !== undefined)];
+  exact(input, fields, 'isolation preparation');
+  const root = await directory(input.repositoryRoot), controlRoot = await directory(input.controlRoot, true);
+  if (inside(root, controlRoot)) fail('ENTROROVE_ISOLATION_CONTROL', 'isolation control root must be external');
+  const originalPlan = structuredClone(input.executionPlan); guardEnvironment(originalPlan?.policy?.environment);
+  if (!Array.isArray(originalPlan?.files) || !originalPlan.files.length || typeof originalPlan.policy.executable !== 'string') {
+    fail('ENTROROVE_ISOLATION_PLAN', 'original frozen execution plan is required');
+  }
+  const nodeExecutable = await fs.realpath(process.execPath), node = await regular(nodeExecutable), sandbox = await regular(SANDBOX);
+  const original = await regular(originalPlan.policy.executable);
+  if (original.sha256 !== originalPlan.policy.executableSha256 || originalPlan.policy.executable === SANDBOX) {
+    fail('ENTROROVE_ISOLATION_EXECUTABLE', 'original approved executable must match its actual independent digest');
+  }
+  const port = input.networkProbePort ?? 9;
+  if (!Number.isSafeInteger(port) || port < 1 || port > 65535) fail('ENTROROVE_ISOLATION_PROBE', 'network denial probe requires a bounded loopback port');
+  const owned = await fs.mkdtemp(path.join(controlRoot, 'isolation17-')), nonce = randomUUID();
+  const bootstrapPath = path.join(owned, 'bootstrap.mjs'), profilePath = path.join(owned, 'profile.sb');
+  const control = { schemaVersion: CONTROL_SCHEMA, repositoryRoot: root, originalPlan,
+    originalPlanSha256: isolationDigest17(isolationCanonical17(originalPlan) + '\n'), nonce,
+    nodeExecutable, nodeSha256: node.sha256, sandboxSha256: sandbox.sha256, profilePath, bootstrapPath,
+    producerSha256: (await regular(await fs.realpath(fileURLToPath(import.meta.url)))).sha256,
+    profile: profile(root, originalPlan, nodeExecutable, bootstrapPath),
+    readTarget: path.join(owned, 'outside-read.canary'), writeTarget: path.join(owned, 'outside-write.canary'), networkProbePort: port };
+  await fs.writeFile(bootstrapPath, BOOTSTRAP, { flag: 'wx', mode: 0o600 });
+  await fs.writeFile(profilePath, control.profile, { flag: 'wx', mode: 0o600 });
+  await fs.writeFile(control.readTarget, `CANARY17:${nonce}`, { flag: 'wx', mode: 0o600 });
+  const isolationControlPath = path.join(owned, 'control.json');
+  await fs.writeFile(isolationControlPath, isolationCanonical17(control) + '\n', { flag: 'wx', mode: 0o600 });
+  const executionPlan = wrapped(control);
+  if (command(executionPlan).length > 2000) fail('ENTROROVE_ISOLATION_COMMAND_LIMIT', 'wrapped command must fit the original exact native target limit');
+  return { executionPlan, command: command(executionPlan), isolationControlPath, originalPlanSha256: control.originalPlanSha256,
+    runnerIdentity: identity(control), approvalRequired: true };
+}
+export async function bindValidatorIsolation17(input) {
+  platform(); await assertBudgetRunnerAllowed(input);
+  exact(input, ['repositoryRoot', 'isolationControlPath', 'executionPlan', 'evidencePolicy',
+    ...['home', 'flowId'].filter(key => input[key] !== undefined)], 'isolation evidence binding');
+  const loaded = await loadControl(input), policy = input.evidencePolicy;
+  exact(policy, ['kind', 'runner', 'flowId', 'stepId', 'localVerification'], 'isolation evidence policy');
+  exact(policy.localVerification, ['operation', 'requestedTarget', 'requirementsSha256'], 'native local verification');
+  if (!['test', 'security'].includes(policy.kind) || policy.runner !== 'sandbox'
+    || !['sandbox-run', 'intrusive-test'].includes(policy.localVerification.operation)
+    || policy.kind !== (policy.localVerification.operation === 'sandbox-run' ? 'test' : 'security')
+    || policy.localVerification.requestedTarget !== command(input.executionPlan)
+    || !/^[0-9a-f]{64}$/.test(policy.localVerification.requirementsSha256)
+    || [policy.flowId, policy.stepId].some(value => typeof value !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value))) {
+    fail('ENTROROVE_ISOLATION_BINDING', 'binding must declare its exact actual wrapped native request');
+  }
+  const control = loaded.value; control.originalPlan.evidencePolicy = structuredClone(policy);
+  control.originalPlanSha256 = isolationDigest17(isolationCanonical17(control.originalPlan) + '\n');
+  const temporary = input.isolationControlPath + '.' + randomUUID() + '.tmp';
+  try { await fs.writeFile(temporary, isolationCanonical17(control) + '\n', { flag: 'wx', mode: 0o600 }); await fs.rename(temporary, input.isolationControlPath); }
+  finally { await fs.rm(temporary, { force: true }); }
+  const executionPlan = wrapped(control);
+  return { executionPlan, command: command(executionPlan), isolationControlPath: input.isolationControlPath,
+    originalPlanSha256: control.originalPlanSha256, runnerIdentity: identity(control), approvalRequired: true };
+}
+function identity(control) {
+  return { backend: 'macos-seatbelt', platform: 'darwin', sandboxExecutable: SANDBOX,
+    sandboxExecutableSha256: control.sandboxSha256, nodeExecutable: control.nodeExecutable, nodeExecutableSha256: control.nodeSha256,
+    profilePath: control.profilePath, profileSha256: isolationDigest17(control.profile), bootstrapPath: control.bootstrapPath,
+    bootstrapSha256: ISOLATION_BOOTSTRAP_SHA25617, producerSha256: control.producerSha256, originalPlanSha256: control.originalPlanSha256 };
+}
+async function loadControl(input) {
+  const root = await directory(input.repositoryRoot), file = await privateControl(root, input.isolationControlPath);
+  let value; try { value = JSON.parse(file.bytes.toString('utf8')); } catch { fail('ENTROROVE_ISOLATION_CONTROL', 'isolation control JSON is invalid'); }
+  exact(value, ['schemaVersion', 'repositoryRoot', 'originalPlan', 'originalPlanSha256', 'nonce', 'nodeExecutable', 'nodeSha256',
+    'sandboxSha256', 'profilePath', 'bootstrapPath', 'producerSha256', 'profile', 'readTarget', 'writeTarget', 'networkProbePort'], 'isolation control');
+  if (value.schemaVersion !== CONTROL_SCHEMA || value.repositoryRoot !== root || value.nodeExecutable !== await fs.realpath(process.execPath)
+    || value.originalPlanSha256 !== isolationDigest17(isolationCanonical17(value.originalPlan) + '\n')
+    || value.profile !== profile(root, value.originalPlan, value.nodeExecutable, value.bootstrapPath)
+    || isolationCanonical17(input.executionPlan) !== isolationCanonical17(wrapped(value))
+    || value.readTarget !== path.join(path.dirname(input.isolationControlPath), 'outside-read.canary')
+    || value.writeTarget !== path.join(path.dirname(input.isolationControlPath), 'outside-write.canary')
+    || value.bootstrapPath !== path.join(path.dirname(input.isolationControlPath), 'bootstrap.mjs')
+    || value.profilePath !== path.join(path.dirname(input.isolationControlPath), 'profile.sb')) {
+    fail('ENTROROVE_ISOLATION_CHANGED', 'isolation command, profile, source plan or private original control changed');
+  }
+  guardEnvironment(value.originalPlan.policy.environment);
+  if ((await privateControl(root, value.bootstrapPath)).sha256 !== ISOLATION_BOOTSTRAP_SHA25617
+    || (await privateControl(root, value.profilePath)).sha256 !== isolationDigest17(value.profile)
+    || (await regular(await fs.realpath(fileURLToPath(import.meta.url)))).sha256 !== value.producerSha256) {
+    fail('ENTROROVE_ISOLATION_CHANGED', 'actual private bootstrap, profile or first-party producer source changed');
+  }
+  for (const [binary, expected] of [[SANDBOX, value.sandboxSha256], [value.nodeExecutable, value.nodeSha256],
+    [value.originalPlan.policy.executable, value.originalPlan.policy.executableSha256]]) {
+    if ((await regular(binary)).sha256 !== expected) fail('ENTROROVE_ISOLATION_EXECUTABLE', 'actual isolation executable identity changed');
+  }
+  if ((await privateControl(root, value.readTarget)).bytes.toString('utf8') !== `CANARY17:${value.nonce}`) {
+    fail('ENTROROVE_ISOLATION_PROBE', 'original private external read canary changed');
+  }
+  try { await fs.lstat(value.writeTarget); fail('ENTROROVE_ISOLATION_PROBE', 'external write canary must not exist'); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; }
+  return { value, sha256: file.sha256 };
+}
+async function signing(input) {
+  const root = input.repositoryRoot, file = await privateControl(root, input.signerConfigPath);
+  let config; try { config = JSON.parse(file.bytes.toString('utf8')); } catch { fail('ENTROROVE_ISOLATION_SIGNER', 'external signer config JSON is invalid'); }
+  exact(config, ['schemaVersion', 'privateKeyPath', 'keyId', 'receiptTtlMs'], 'external signer');
+  const pinned = process.env.ENTROROVE_VALIDATOR_RECEIPT_PUBLIC_KEY?.trim();
+  if (!pinned || config.schemaVersion !== 'validator.runner-signer/1.0') fail('ENTROROVE_ISOLATION_SIGNER', 'trusted external Validator receipt public key is required');
+  let publicKey;
+  try { publicKey = createPublicKey(pinned.includes('BEGIN PUBLIC KEY') ? pinned : { key: Buffer.from(pinned, 'base64'), format: 'der', type: 'spki' }); }
+  catch { fail('ENTROROVE_ISOLATION_SIGNER', 'trusted Validator public key configuration is invalid'); }
+  if (publicKey.asymmetricKeyType !== 'ed25519' || config.keyId !== isolationDigest17(publicKey.export({ format: 'der', type: 'spki' }))) {
+    fail('ENTROROVE_ISOLATION_SIGNER', 'caller signer cannot replace the externally pinned Validator key');
+  }
+  const privateFile = await privateControl(root, config.privateKeyPath); let privateKey;
+  try { privateKey = createPrivateKey(privateFile.bytes); } finally { privateFile.bytes.fill(0); }
+  if (privateKey.asymmetricKeyType !== 'ed25519' || isolationDigest17(createPublicKey(privateKey).export({ format: 'der', type: 'spki' })) !== config.keyId) {
+    fail('ENTROROVE_ISOLATION_SIGNER', 'external signer private key differs from the configured trusted identity');
+  }
+  return { privateKey, publicKey, keyId: config.keyId, configSha256: file.sha256 };
+}
+function probes(result, control) {
+  const lines = result.process.stdout.split('\n').filter(line => line.startsWith(MARKER));
+  if (lines.length !== 1 || !result.process.stdout.startsWith(MARKER)) fail('ENTROROVE_ISOLATION_UNPROVEN', 'fixed isolation bootstrap did not produce one original denial result');
+  let value; try { value = JSON.parse(lines[0].slice(MARKER.length)); } catch { fail('ENTROROVE_ISOLATION_UNPROVEN', 'original isolation denial result is malformed'); }
+  exact(value, ['nonce', 'probes'], 'bootstrap result'); exact(value.probes, ['externalRead', 'externalWrite', 'network'], 'kernel probes');
+  if (value.nonce !== control.nonce) fail('ENTROROVE_ISOLATION_UNPROVEN', 'kernel probes lost their private original nonce');
+  for (const probe of Object.values(value.probes)) {
+    exact(probe, ['denied', 'code'], 'kernel denial');
+    if (probe.denied !== true || !['EPERM', 'EACCES'].includes(probe.code)) fail('ENTROROVE_ISOLATION_UNPROVEN', 'actual kernel did not deny every required external access');
+  }
+  return value.probes;
+}
+export async function runValidatorIsolation17(input) {
+  platform(); await assertBudgetRunnerAllowed(input);
+  exact(input, ['repositoryRoot', 'executionPlan', 'approvalPath', 'signerConfigPath', 'isolationControlPath',
+    ...['home', 'flowId', 'executionDeadlineAt'].filter(key => input[key] !== undefined)], 'isolation execution');
+  const before = await loadControl(input), signer = await signing(input);
+  const { isolationControlPath: _control, ...runnerInput } = input;
+  const result = await runApprovedPlanObject(runnerInput), actualProbes = probes(result, before.value);
+  const after = await loadControl(input), afterSigner = await signing(input);
+  if (after.sha256 !== before.sha256 || afterSigner.configSha256 !== signer.configSha256) fail('ENTROROVE_ISOLATION_CHANGED', 'original isolation authority changed during execution');
+  const evidence = result.evidence[0], receipt = evidence?.receipt;
+  if (!receipt || receipt.keyId !== signer.keyId || receipt.subjectDigest !== evidence.subjectDigest || receipt.subjectDigest !== isolationDigest17(isolationCanonical17(result.subject))) {
+    fail('ENTROROVE_ISOLATION_UNPROVEN', 'actual approved execution has no original trusted bound receipt');
+  }
+  const { signature, ...original } = receipt;
+  if (!verify(null, Buffer.from(isolationCanonical17(original)), signer.publicKey, Buffer.from(signature, 'base64url'))) {
+    fail('ENTROROVE_ISOLATION_UNPROVEN', 'original approved execution signature is invalid');
+  }
+  const issuedAt = new Date().toISOString();
+  if (Date.parse(receipt.expiresAt) <= Date.parse(issuedAt)) fail('ENTROROVE_ISOLATION_EXPIRED', 'original approved receipt expired before isolation attestation');
+  const body = { schemaVersion: ISOLATION_SCHEMA17, keyId: signer.keyId, subjectDigest: evidence.subjectDigest,
+    evidenceReceiptDigest: isolationDigest17(isolationCanonical17(receipt)), evidenceReceiptNonce: receipt.nonce,
+    processDigest: isolationDigest17(isolationCanonical17(result.process)), planSha256: result.planSha256,
+    approvalSha256: result.approvalSha256, runnerIdentity: identity(before.value), probes: actualProbes, issuedAt, expiresAt: receipt.expiresAt };
+  return { ...result, isolationReceipt: { ...body, signature: sign(null, Buffer.from(isolationCanonical17(body)), signer.privateKey).toString('base64url') } };
+}
+
+const shaSchema = { type: 'string', pattern: '^[0-9a-f]{64}$' };
+const stringSchema = { type: 'string', minLength: 1 };
+const objectSchema = properties => ({ type: 'object', additionalProperties: false, required: Object.keys(properties), properties });
+const denialSchema = objectSchema({ denied: { const: true }, code: { enum: ['EPERM', 'EACCES'] } });
+export const VALIDATOR_ISOLATION_RECEIPT_SCHEMA17 = objectSchema({ schemaVersion: { const: ISOLATION_SCHEMA17 }, keyId: shaSchema,
+  subjectDigest: shaSchema, evidenceReceiptDigest: shaSchema, evidenceReceiptNonce: stringSchema, processDigest: shaSchema,
+  planSha256: shaSchema, approvalSha256: shaSchema, runnerIdentity: objectSchema({ backend: { const: 'macos-seatbelt' },
+    platform: { const: 'darwin' }, sandboxExecutable: { const: SANDBOX }, sandboxExecutableSha256: shaSchema,
+    nodeExecutable: stringSchema, nodeExecutableSha256: shaSchema, profilePath: stringSchema, profileSha256: shaSchema,
+    bootstrapPath: stringSchema, bootstrapSha256: shaSchema, producerSha256: shaSchema, originalPlanSha256: shaSchema }),
+  probes: objectSchema({ externalRead: denialSchema, externalWrite: denialSchema, network: denialSchema }),
+  issuedAt: { ...stringSchema, format: 'date-time' }, expiresAt: { ...stringSchema, format: 'date-time' },
+  signature: { type: 'string', pattern: '^[A-Za-z0-9_-]{86}$' } });

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.skill-manifest/1.0",
   "name": "entrorove",
-  "version": "0.1.24",
+  "version": "0.1.28",
   "endpoint": "https://entrorove.com",
   "requestSchemaVersion": "entrorove.skill.request/2.0",
   "supportedRequestSchemaVersions": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.24",
+  "version": "0.1.28",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"
@@ -24,6 +24,14 @@
     "local-swarm-state.mjs",
     "local-swarm-storage.mjs",
     "local-swarm.mjs",
+    "local-autocoord17-authority.mjs",
+    "local-autocoord17-controller.mjs",
+    "local-autocoord17-peers.mjs",
+    "local-autocoord17-store.mjs",
+    "local-autocoord17-tasks.mjs",
+    "local-autocoord17-waits.mjs",
+    "local-validator-isolation17.mjs",
+    "local-calctool-composition17.mjs",
     "local-mutation-files.mjs",
     "local-mutation-snapshot.mjs",
     "local-mutation-audit.mjs",
@@ -35,8 +43,19 @@
     "local-mutation-batch-receipt.mjs",
     "local-integrity.mjs",
     "local-evidence-verification.mjs",
+    "local-error.mjs",
     "local-formula.mjs",
     "local-ledger.mjs",
+    "local-chain-bindings.mjs",
+    "local-chain-broker.mjs",
+    "local-chain-contracts.mjs",
+    "local-chain-controller.mjs",
+    "local-chain-human.mjs",
+    "local-chain-lock.mjs",
+    "local-chain-operations.mjs",
+    "local-chain-plan.mjs",
+    "local-chain-release-labels.mjs",
+    "local-chain-results.mjs",
     "local-approved-plan.mjs",
     "workflow-local-runner.mjs",
     "workflow-local-client.mjs",
@@ -133,6 +152,7 @@
     "local-formula-tests.mjs",
     "local-calctool.mjs",
     "local-calctool-cli.mjs",
+    "local-error.mjs",
     "local-calctool-contracts.mjs",
     "local-calctool-runtime.mjs",
     "local-calctool-storage.mjs",
@@ -165,7 +185,7 @@
     "local-final-gate16-release.mjs"
   ],
   "scripts": {
-    "test": "node --test test/*.test.mjs",
+    "test": "node --test --test-concurrency=1 test/*.test.mjs",
     "prepublishOnly": "node release.mjs",
     "prepare:archguard": "node archguard-runtime-build.mjs",
     "check:archguard": "node archguard-runtime-build.mjs --check",