@entrorove/skill 0.1.25 → 0.1.28

package/local-autocoord17-tasks.mjs

@@ -0,0 +1,68 @@
+import { canonical } from './local-integrity.mjs';
+import { canonicalSwarmPaths, swarmPathsOverlap } from './local-swarm-state.mjs';
+import { coordDuration17, coordExact17, coordFail17, coordId17, coordMessage17 } from './local-autocoord17-store.mjs';
+
+export function taskCard17(value, native) {
+  coordExact17(value, ['taskScope', 'plannedActions', 'deployTarget', 'eta', 'baselineHash', 'archConstraints']);
+  const taskScope = canonicalSwarmPaths(value.taskScope);
+  if (taskScope.some(target => !native.paths.includes(target)) || value.baselineHash !== native.grant.frozenManifestDigest
+    || !Array.isArray(value.plannedActions) || !value.plannedActions.length || value.plannedActions.some(item => typeof item !== 'string' || !item || item.length > 500)
+    || value.deployTarget !== null && (typeof value.deployTarget !== 'string' || !value.deployTarget || value.deployTarget.length > 500)
+    || !Number.isFinite(Date.parse(value.eta)) || !Array.isArray(value.archConstraints)
+    || value.archConstraints.some(item => typeof item !== 'string' || !/^(?:forbid-scope:[^\s]+|requirement:[^=\s]+=[^\s]+)$/.test(item))) {
+    coordFail17('ENTROROVE_COORD_TASKCARD', 'taskcard must preserve the original signed scope, baseline and explicit constraints');
+  }
+  return { ...structuredClone(value), taskScope };
+}
+export function taskConflicts17(state, task) {
+  return state.tasks.filter(other => other.taskId !== task.taskId).flatMap(other => {
+    const reasons = [];
+    if (other.card.taskScope.some(scope => task.card.taskScope.some(target => swarmPathsOverlap(scope, target)))) reasons.push('scope-overlap');
+    if (task.card.deployTarget && task.card.deployTarget === other.card.deployTarget) reasons.push('deploy-target');
+    for (const [left, right] of [[task, other], [other, task]]) for (const constraint of left.card.archConstraints) {
+      if (constraint.startsWith('forbid-scope:') && right.card.taskScope.some(target => swarmPathsOverlap(constraint.slice(13), target))) reasons.push('architecture-scope');
+      if (constraint.startsWith('requirement:')) {
+        const prefix = constraint.slice(0, constraint.indexOf('=') + 1);
+        if (right.card.archConstraints.some(value => value.startsWith(prefix) && value !== constraint)) reasons.push('decision-conflict');
+      }
+    }
+    return reasons.length ? [{ taskId: other.taskId, reasons: [...new Set(reasons)] }] : [];
+  });
+}
+export function registerTask17(state, input, native, cloud) {
+  coordId17(input.taskId); coordId17(input.agentId); coordId17(input.chainId);
+  if (input.taskId !== native.grant.taskId || input.chainId !== native.step.executionPlan.chainId
+    || input.material.repositoryRoot !== state.repositoryRoot) coordFail17('ENTROROVE_COORD_TASK_BINDING', 'taskcard changed its original signed task, chain or repository');
+  const card = taskCard17(input.card, native), task = { taskId: input.taskId, agentId: input.agentId, chainId: input.chainId,
+    material: structuredClone(input.material), card, ...cloud, registeredAt: new Date().toISOString() };
+  const existing = state.tasks.find(value => value.taskId === task.taskId);
+  if (existing) {
+    if (canonical({ ...existing, registeredAt: null }) !== canonical({ ...task, registeredAt: null })) coordFail17('ENTROROVE_COORD_TASK_CHANGED', 'same taskcard cannot change its original identity or contents');
+    return existing;
+  }
+  state.tasks.push(task);
+  for (const conflict of taskConflicts17(state, task)) for (const target of [task.taskId, conflict.taskId]) {
+    coordMessage17(state, target, 'task-conflict', { otherTaskId: target === task.taskId ? conflict.taskId : task.taskId,
+      reasons: conflict.reasons }, [task.taskId, conflict.taskId].sort().join(':'));
+  }
+  return task;
+}
+export function enqueueResource17(state, task, input) {
+  coordId17(input.queueId); coordId17(input.resource); coordDuration17(input.queueTimeoutMs);
+  if (!['file', 'build', 'deploy'].includes(input.kind) || input.baselineHash !== task.card.baselineHash) {
+    coordFail17('ENTROROVE_COORD_BASELINE', 'resource queue requires the original current taskcard baseline');
+  }
+  const paths = input.kind === 'file' ? canonicalSwarmPaths(input.paths) : [];
+  if (paths.some(target => !task.card.taskScope.includes(target))) coordFail17('ENTROROVE_COORD_SCOPE', 'queue paths exceed its original taskcard');
+  const request = { queueId: input.queueId, taskId: task.taskId, agentId: task.agentId, chainId: task.chainId,
+    kind: input.kind, resource: input.resource, paths, baselineHash: input.baselineHash, queueTimeoutMs: input.queueTimeoutMs };
+  const existing = state.lockQueues.find(value => value.queueId === request.queueId);
+  if (existing) {
+    if (canonical(existing.request) !== canonical(request)) coordFail17('ENTROROVE_COORD_QUEUE_CHANGED', 'queue identity cannot change its original request');
+    return existing;
+  }
+  const now = Date.now(), entry = { request, queueId: request.queueId, taskId: task.taskId, status: 'waiting',
+    registeredAt: new Date(now).toISOString(), deadlineAt: new Date(now + input.queueTimeoutMs).toISOString(),
+    grant: null, consumerAvailable: false, unsupported: input.kind === 'file' ? 'restrictive-native-subset-adapter' : `${input.kind}-consumer` };
+  state.lockQueues.push(entry); return entry;
+}

package/local-autocoord17-waits.mjs

@@ -0,0 +1,118 @@
+import { canonical, sha256 } from './local-integrity.mjs';
+import { canonicalSwarmPaths } from './local-swarm-state.mjs';
+import { coordDuration17, coordExact17, coordFail17, coordId17, coordEvent17, coordMessage17 } from './local-autocoord17-store.mjs';
+
+const ACTIVE = ['waiting', 'need-human'];
+const EVENT_TYPES = ['signal', 'peer-ready', 'task-reported', 'task-failed', 'lease-expired', 'lock-released'];
+export function requestDecision17(state, task, reason, key, paths = []) {
+  const decisionId = sha256(`${reason}\0${task.taskId}\0${key}`);
+  const existing = state.decisions.find(value => value.decisionId === decisionId);
+  if (existing) return existing;
+  const decision = { schemaVersion: 'entrorove.coordination-decision/1.0', decisionId, taskId: task.taskId,
+    agentId: task.agentId, chainId: task.chainId, status: 'need-human', reason, paths,
+    risk: 'high', request: { type: 'confirm', question: `Resolve coordination ${reason} for the original task ${task.taskId}.`,
+      riskDescription: 'Unresolved coordination may conflict with another original task; no engineering authority is granted.',
+      options: [{ id: 'resume', label: 'Resume this coordination wait' }, { id: 'cancel', label: 'Cancel this coordination wait' }],
+      callback: { operation: 'coordination-resolve-human', payload: { decisionId } } }, createdAt: new Date().toISOString(), audit: null };
+  state.decisions.push(decision); coordMessage17(state, task.taskId, 'need-human', { decisionId, reason }, key);
+  return decision;
+}
+function match(wait, event) {
+  return wait.request.waitFor.taskId === event.taskId && wait.request.event.type === event.type
+    && wait.request.event.resource === event.resource;
+}
+function cycle(state, start, current, seen = new Set()) {
+  if (current === start) return true;
+  if (seen.has(current)) return false;
+  seen.add(current);
+  return state.waits.filter(value => ACTIVE.includes(value.status) && value.taskId === current)
+    .some(value => cycle(state, start, value.request.waitFor.taskId, seen));
+}
+export function registerWait17(state, task, input) {
+  coordId17(input.waitId); coordDuration17(input.expectedWithinMs);
+  coordExact17(input.waitFor, ['taskId']); coordId17(input.waitFor.taskId);
+  coordExact17(input.event, ['type', 'resource']); coordId17(input.event.resource);
+  if (!EVENT_TYPES.includes(input.event.type) || !state.tasks.some(value => value.taskId === input.waitFor.taskId)
+    || !['resume', 'notify'].includes(input.onArrival) || !['cancel', 'notify', 'escalate-need-human'].includes(input.onTimeout)) {
+    coordFail17('ENTROROVE_COORD_WAIT', 'wait must name a registered original task, structured event and explicit policies');
+  }
+  const refetchPaths = input.refetchPaths.length ? canonicalSwarmPaths(input.refetchPaths) : [];
+  if (refetchPaths.some(target => !task.card.taskScope.includes(target))) coordFail17('ENTROROVE_COORD_SCOPE', 'wait refetch paths exceed the original taskcard');
+  const request = { waitId: input.waitId, waiter: { taskId: task.taskId, agentId: task.agentId, chainId: task.chainId },
+    waitFor: input.waitFor, event: input.event, expectedWithinMs: input.expectedWithinMs,
+    onArrival: input.onArrival, onTimeout: input.onTimeout, refetchPaths };
+  const previous = state.waits.find(value => value.waitId === input.waitId);
+  if (previous) {
+    if (canonical(previous.request) !== canonical(request)) coordFail17('ENTROROVE_COORD_WAIT_CHANGED', 'same wait ID cannot change its original dependency');
+    return previous;
+  }
+  const now = Date.now(), wait = { waitId: input.waitId, taskId: task.taskId, request, status: 'waiting',
+    registeredAt: new Date(now).toISOString(), deadlineAt: new Date(now + input.expectedWithinMs).toISOString(),
+    wakeup: null, decisionId: null };
+  state.waits.push(wait);
+  const existing = state.events.find(value => match(wait, value));
+  if (existing) arrive(state, task, wait, existing);
+  else if (cycle(state, task.taskId, input.waitFor.taskId)) {
+    const involved = state.waits.filter(value => ACTIVE.includes(value.status)
+      && (cycle(state, value.taskId, value.request.waitFor.taskId)));
+    for (const value of involved) {
+      const owner = state.tasks.find(item => item.taskId === value.taskId);
+      value.status = 'need-human'; value.decisionId = requestDecision17(state, owner, 'dependency-cycle', value.waitId, value.request.refetchPaths).decisionId;
+    }
+  }
+  return wait;
+}
+function arrive(state, task, wait, event) {
+  if (wait.status === 'need-human') return;
+  wait.status = ['task-failed', 'lease-expired'].includes(event.type) ? 'terminated' : 'arrived';
+  wait.wakeup = { event: structuredClone(event), refetchPaths: [...wait.request.refetchPaths],
+    freshAimlockSnapshotRequired: wait.request.refetchPaths.length > 0, receivedAt: new Date().toISOString() };
+  task.consecutiveTimeouts = 0;
+  coordMessage17(state, task.taskId, 'dependency-wakeup', { waitId: wait.waitId, ...wait.wakeup }, wait.waitId);
+}
+export function scanWaits17(state) {
+  const now = Date.now();
+  for (const wait of state.waits.filter(value => value.status === 'waiting')) {
+    const task = state.tasks.find(value => value.taskId === wait.taskId), event = state.events.find(value => match(wait, value));
+    const terminal = state.events.find(value => value.taskId === wait.request.waitFor.taskId
+      && ['task-failed', 'lease-expired'].includes(value.type));
+    if (event || terminal) { arrive(state, task, wait, event ?? terminal); continue; }
+    if (Date.parse(wait.deadlineAt) > now) continue;
+    task.consecutiveTimeouts = (task.consecutiveTimeouts ?? 0) + 1;
+    const human = wait.request.onTimeout === 'escalate-need-human' || task.consecutiveTimeouts >= 2;
+    wait.status = human ? 'need-human' : 'timed-out';
+    coordMessage17(state, task.taskId, 'dependency-timeout', { waitId: wait.waitId, consecutive: task.consecutiveTimeouts }, wait.waitId);
+    if (human) wait.decisionId = requestDecision17(state, task, 'dependency-timeout', wait.waitId, wait.request.refetchPaths).decisionId;
+  }
+  return state.waits;
+}
+export function cancelWait17(state, task, waitId) {
+  const wait = state.waits.find(value => value.waitId === waitId && value.taskId === task.taskId);
+  if (!wait) coordFail17('ENTROROVE_COORD_WAIT_BINDING', 'cancel must name this original task wait');
+  if (wait.status === 'need-human') coordFail17('ENTROROVE_COORD_HUMAN_REQUIRED', 'cancellation cannot bypass an unresolved real human decision');
+  if (wait.status === 'waiting') {
+    wait.status = 'cancelled'; coordEvent17(state, 'wait-cancelled', task.taskId, waitId, { waitId }, waitId);
+  }
+  return wait;
+}
+export function scanQueues17(state) {
+  const now = Date.now(), decisions = [];
+  for (const queue of state.lockQueues.filter(value => value.status === 'waiting')) {
+    if (!Number.isFinite(Date.parse(queue.deadlineAt))) coordFail17('ENTROROVE_COORD_QUEUE_DEADLINE', 'queue cannot borrow an ETA or lock TTL');
+    if (Date.parse(queue.deadlineAt) > now) continue;
+    queue.status = 'timed-out';
+    const task = state.tasks.find(value => value.taskId === queue.taskId);
+    coordMessage17(state, task.taskId, 'lock-denied', { queueId: queue.queueId, resource: queue.request.resource }, queue.queueId);
+    decisions.push(requestDecision17(state, task, 'lock-queue-timeout', queue.queueId, queue.request.paths));
+  }
+  return decisions;
+}
+export function coordinationBlocked17(state, task, paths = []) {
+  const waits = state.waits.filter(value => value.taskId === task.taskId && ACTIVE.includes(value.status));
+  const decisions = state.decisions.filter(value => value.taskId === task.taskId && value.status === 'need-human');
+  const peers = state.intents.filter(value => value.taskId === task.taskId && ['waiting', 'partial'].includes(value.status)
+    && (!paths.length || paths.some(target => value.blockedPaths.includes(target))));
+  return { blocked: waits.length > 0 || decisions.length > 0 || peers.length > 0,
+    waitIds: waits.map(value => value.waitId), decisionIds: decisions.map(value => value.decisionId),
+    intentIds: peers.map(value => value.intentId), writeAuthorized: false };
+}

package/local-calctool-composition17.mjs

@@ -0,0 +1,50 @@
+import { createHash } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { runCalctoolLocal } from './local-calctool.mjs';
+import { verifyFormulaProgram } from './local-formula-engine.mjs';
+import { runWorkflowLocalStep } from './workflow-local-runner.mjs';
+
+const sha = bytes => createHash('sha256').update(bytes).digest('hex');
+function fail(message) { throw Object.assign(new Error(message), { code: 'ENTROROVE_CALCTOOL_COMPOSITION' }); }
+export async function compileCalctoolArtifacts17(program) {
+  verifyFormulaProgram(program);
+  const root = await fs.realpath(await fs.mkdtemp(path.join(os.tmpdir(), 'entrorove-calctool17-control-')));
+  try {
+    const repositoryRoot = path.join(root, 'repository'); const home = path.join(root, 'home');
+    await fs.mkdir(repositoryRoot, { mode: 0o700 }); await fs.mkdir(home, { mode: 0o700 });
+    const output = await runCalctoolLocal('generate', { repositoryRoot, home, program });
+    const files = await Promise.all(output.files.map(async entry => {
+      const bytes = await fs.readFile(path.join(output.directory, entry.path));
+      if (sha(bytes) !== entry.sha256) fail('Native generated Calctool bytes changed');
+      return { path: entry.path, sha256: entry.sha256 };
+    }));
+    if (files.map(file => file.path).sort().join('|') !== 'program.json|runtime.mjs|tool.mjs') fail('Native Calctool triplet is incomplete');
+    return files.sort((a, b) => a.path.localeCompare(b.path));
+  } finally { await fs.rm(root, { recursive: true, force: true }); }
+}
+export function assertCalctoolStep17(composition, step) {
+  verifyFormulaProgram(composition.program, composition);
+  if (composition.schemaVersion !== 'entrorove.calctool-composition/1.0' || !Array.isArray(composition.files)
+    || composition.files.length !== 3) fail('Original Calctool composition is required');
+  for (const file of composition.files) if (!step.executionPlan.files.some(entry => entry.path === file.path && entry.sha256 === file.sha256)) {
+    fail('Calctool generated bytes must be in the original frozen execution manifest');
+  }
+  const tool = composition.files.find(file => file.path.endsWith('/tool.mjs'));
+  if (!tool || JSON.stringify(step.executionPlan.policy.args) !== JSON.stringify([tool.path, '--verify'])
+    || !step.executionPlan.tests.some(test => test.path === tool.path)) fail('Calctool step must execute its original Decimal sample verifier');
+}
+export async function runCalctoolCompositionStep17(input) {
+  const { composition, ...managed } = input;
+  const native = await compileCalctoolArtifacts17(composition.program);
+  const expected = native.map(file => ({ ...file, path: `${composition.directory}/${file.path}` }));
+  if (JSON.stringify(expected) !== JSON.stringify(composition.files)) fail('Composition differs from actual native Calctool generation');
+  const step = managed.acceptedPlan?.steps.find(item => item.stepId === managed.stepId);
+  if (!step || managed.acceptedPlan.flowId !== composition.flowId || managed.acceptedPlan.ownerId !== composition.ownerId
+    || managed.acceptedPlan.taskDigest !== composition.taskDigest || managed.acceptedPlan.chainDigest !== composition.chainDigest) {
+    fail('Calctool composition must preserve its original accepted task and chain');
+  }
+  assertCalctoolStep17(composition, step);
+  return runWorkflowLocalStep(managed);
+}

package/local-validator-isolation17.mjs

@@ -0,0 +1,256 @@
+import { createHash, createPrivateKey, createPublicKey, randomUUID, sign, verify } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { runApprovedPlanObject, RUNNER_LIMITS } from './local-approved-plan.mjs';
+import { assertBudgetRunnerAllowed } from './local-budget-reads.mjs';
+
+export const ISOLATION_SCHEMA17 = 'entrorove.validator-isolation-receipt/1.0';
+const CONTROL_SCHEMA = 'entrorove.validator-isolation-control/1.0';
+const SANDBOX = '/usr/bin/sandbox-exec';
+const MARKER = 'ENTROROVE_ISOLATION17:';
+export const isolationCanonical17 = value => Array.isArray(value) ? `[${value.map(isolationCanonical17).join(',')}]`
+  : value && typeof value === 'object' ? `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${isolationCanonical17(value[key])}`).join(',')}}` : JSON.stringify(value);
+export const isolationDigest17 = value => createHash('sha256').update(value).digest('hex');
+function fail(code, message) { throw Object.assign(new Error(message), { code }); }
+function exact(value, fields, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).sort().join('|') !== [...fields].sort().join('|')) {
+    fail('ENTROROVE_ISOLATION_INVALID', `${label} requires its exact original fields`);
+  }
+}
+function platform() {
+  if (process.platform !== 'darwin') fail('ENTROROVE_ISOLATION_PLATFORM_UNSUPPORTED', 'Validator isolation17 requires the macOS Seatbelt backend');
+}
+function inside(root, target) { const r = path.relative(root, target); return r === '' || !path.isAbsolute(r) && r !== '..' && !r.startsWith('../'); }
+async function directory(value, privateDirectory = false) {
+  if (typeof value !== 'string' || !path.isAbsolute(value)) fail('ENTROROVE_ISOLATION_PATH', 'isolation directory must be absolute');
+  const canonical = await fs.realpath(value), stat = await fs.lstat(canonical);
+  if (canonical !== value || !stat.isDirectory() || stat.isSymbolicLink() || privateDirectory && (stat.uid !== process.getuid() || (stat.mode & 0o777) !== 0o700)) {
+    fail('ENTROROVE_ISOLATION_PATH', 'isolation directory must be canonical, owned and private where required');
+  }
+  return canonical;
+}
+async function regular(file, privateFile = false) {
+  const stat = await fs.lstat(file);
+  if (!stat.isFile() || stat.isSymbolicLink() || stat.size > RUNNER_LIMITS.maxExecutableBytes || await fs.realpath(file) !== file
+    || privateFile && (stat.uid !== process.getuid() || (stat.mode & 0o777) !== 0o600 || stat.nlink !== 1 || stat.size > RUNNER_LIMITS.maxControlBytes)) {
+    fail('ENTROROVE_ISOLATION_FILE', 'isolation input must be its canonical bounded regular file');
+  }
+  const bytes = await fs.readFile(file); return { bytes, sha256: isolationDigest17(bytes) };
+}
+async function privateControl(root, file) {
+  if (typeof file !== 'string' || !path.isAbsolute(file) || inside(root, file)) fail('ENTROROVE_ISOLATION_CONTROL', 'isolation controls must be outside the repository');
+  await directory(path.dirname(file), true); return regular(file, true);
+}
+const BOOTSTRAP = `import {readFileSync,writeFileSync} from 'node:fs';
+import net from 'node:net';import {spawn} from 'node:child_process';
+const [nonce,readTarget,writeTarget,port,executable,...args]=process.argv.slice(2);
+const denied=work=>{try{work();return {denied:false,code:'ALLOWED'};}catch(e){return {denied:['EPERM','EACCES'].includes(e.code),code:e.code??'UNKNOWN'};}};
+const probes={externalRead:denied(()=>readFileSync(readTarget)),externalWrite:denied(()=>writeFileSync(writeTarget,'DENIED17'))};
+probes.network=await new Promise(resolve=>{const socket=net.connect({host:'127.0.0.1',port:Number(port)});let done=false;
+const finish=result=>{if(done)return;done=true;clearTimeout(timer);socket.destroy();resolve(result)};
+const timer=setTimeout(()=>finish({denied:false,code:'TIMEOUT'}),2000);
+socket.once('connect',()=>finish({denied:false,code:'ALLOWED'}));socket.once('error',e=>finish({denied:['EPERM','EACCES'].includes(e.code),code:e.code??'UNKNOWN'}));});
+process.stdout.write('${MARKER}'+JSON.stringify({nonce,probes})+'\\n');
+if(Object.values(probes).some(p=>!p.denied)){process.exitCode=78;}else{
+const child=spawn(executable,args,{cwd:process.cwd(),env:process.env,shell:false,stdio:['ignore','inherit','inherit']});
+child.once('error',()=>{process.exitCode=79});child.once('close',(code,signal)=>{if(signal)process.kill(process.pid,signal);else process.exitCode=code??79;});}
+`;
+export const ISOLATION_BOOTSTRAP_SHA25617 = isolationDigest17(BOOTSTRAP);
+function ancestors(files) {
+  const result = new Set();
+  for (const file of files) { let at = path.dirname(file); while (true) { result.add(at); if (at === '/') break; at = path.dirname(at); } }
+  return [...result].sort();
+}
+function profile(root, plan, node, bootstrapPath) {
+  const files = [...plan.files.map(file => path.resolve(root, file.path)), node, plan.policy.executable, bootstrapPath];
+  if (plan.files.some(file => !inside(root, path.resolve(root, file.path)) || !file.path || path.isAbsolute(file.path))) {
+    fail('ENTROROVE_ISOLATION_MANIFEST', 'isolation reads require the exact original repository manifest');
+  }
+  const literals = values => [...new Set(values)].sort().map(value => `(literal ${JSON.stringify(value)})`).join(' ');
+  return ['(version 1)', '(deny default)', '(allow process-fork)', `(allow process-exec ${literals([node, plan.policy.executable])})`,
+    '(allow signal (target self))', '(allow sysctl-read)', '(allow file-read-metadata)',
+    '(allow file-read-data (subpath "/System/Library") (subpath "/usr/lib") (subpath "/private/var/db/dyld")'
+      + ` (literal "/dev/null") (literal "/dev/random") (literal "/dev/urandom") ${literals(files)})`,
+    `(allow file-read* ${literals(ancestors([...files, path.join(root, 'directory-entry')]))})`].join('\n');
+}
+function wrapped(control) {
+  const plan = structuredClone(control.originalPlan);
+  plan.policy = { ...plan.policy, executable: SANDBOX, executableSha256: control.sandboxSha256,
+    args: ['-f', control.profilePath, control.nodeExecutable, control.bootstrapPath,
+      control.nonce, control.readTarget, control.writeTarget, String(control.networkProbePort), control.originalPlan.policy.executable, ...control.originalPlan.policy.args] };
+  return plan;
+}
+const command = plan => [plan.policy.executable, ...plan.policy.args].map(value => JSON.stringify(value)).join(' ');
+function guardEnvironment(environment) {
+  if (!environment || typeof environment !== 'object' || Object.keys(environment).some(key => /^(DYLD_|LD_|NODE_OPTIONS$|NODE_PATH$)/.test(key))) {
+    fail('ENTROROVE_ISOLATION_ENVIRONMENT', 'isolation cannot inherit loader injection or alternate Node startup policies');
+  }
+}
+export async function prepareValidatorIsolation17(input) {
+  platform(); await assertBudgetRunnerAllowed(input);
+  const fields = ['repositoryRoot', 'executionPlan', 'controlRoot', ...['networkProbePort', 'home', 'flowId'].filter(key => input[key] !== undefined)];
+  exact(input, fields, 'isolation preparation');
+  const root = await directory(input.repositoryRoot), controlRoot = await directory(input.controlRoot, true);
+  if (inside(root, controlRoot)) fail('ENTROROVE_ISOLATION_CONTROL', 'isolation control root must be external');
+  const originalPlan = structuredClone(input.executionPlan); guardEnvironment(originalPlan?.policy?.environment);
+  if (!Array.isArray(originalPlan?.files) || !originalPlan.files.length || typeof originalPlan.policy.executable !== 'string') {
+    fail('ENTROROVE_ISOLATION_PLAN', 'original frozen execution plan is required');
+  }
+  const nodeExecutable = await fs.realpath(process.execPath), node = await regular(nodeExecutable), sandbox = await regular(SANDBOX);
+  const original = await regular(originalPlan.policy.executable);
+  if (original.sha256 !== originalPlan.policy.executableSha256 || originalPlan.policy.executable === SANDBOX) {
+    fail('ENTROROVE_ISOLATION_EXECUTABLE', 'original approved executable must match its actual independent digest');
+  }
+  const port = input.networkProbePort ?? 9;
+  if (!Number.isSafeInteger(port) || port < 1 || port > 65535) fail('ENTROROVE_ISOLATION_PROBE', 'network denial probe requires a bounded loopback port');
+  const owned = await fs.mkdtemp(path.join(controlRoot, 'isolation17-')), nonce = randomUUID();
+  const bootstrapPath = path.join(owned, 'bootstrap.mjs'), profilePath = path.join(owned, 'profile.sb');
+  const control = { schemaVersion: CONTROL_SCHEMA, repositoryRoot: root, originalPlan,
+    originalPlanSha256: isolationDigest17(isolationCanonical17(originalPlan) + '\n'), nonce,
+    nodeExecutable, nodeSha256: node.sha256, sandboxSha256: sandbox.sha256, profilePath, bootstrapPath,
+    producerSha256: (await regular(await fs.realpath(fileURLToPath(import.meta.url)))).sha256,
+    profile: profile(root, originalPlan, nodeExecutable, bootstrapPath),
+    readTarget: path.join(owned, 'outside-read.canary'), writeTarget: path.join(owned, 'outside-write.canary'), networkProbePort: port };
+  await fs.writeFile(bootstrapPath, BOOTSTRAP, { flag: 'wx', mode: 0o600 });
+  await fs.writeFile(profilePath, control.profile, { flag: 'wx', mode: 0o600 });
+  await fs.writeFile(control.readTarget, `CANARY17:${nonce}`, { flag: 'wx', mode: 0o600 });
+  const isolationControlPath = path.join(owned, 'control.json');
+  await fs.writeFile(isolationControlPath, isolationCanonical17(control) + '\n', { flag: 'wx', mode: 0o600 });
+  const executionPlan = wrapped(control);
+  if (command(executionPlan).length > 2000) fail('ENTROROVE_ISOLATION_COMMAND_LIMIT', 'wrapped command must fit the original exact native target limit');
+  return { executionPlan, command: command(executionPlan), isolationControlPath, originalPlanSha256: control.originalPlanSha256,
+    runnerIdentity: identity(control), approvalRequired: true };
+}
+export async function bindValidatorIsolation17(input) {
+  platform(); await assertBudgetRunnerAllowed(input);
+  exact(input, ['repositoryRoot', 'isolationControlPath', 'executionPlan', 'evidencePolicy',
+    ...['home', 'flowId'].filter(key => input[key] !== undefined)], 'isolation evidence binding');
+  const loaded = await loadControl(input), policy = input.evidencePolicy;
+  exact(policy, ['kind', 'runner', 'flowId', 'stepId', 'localVerification'], 'isolation evidence policy');
+  exact(policy.localVerification, ['operation', 'requestedTarget', 'requirementsSha256'], 'native local verification');
+  if (!['test', 'security'].includes(policy.kind) || policy.runner !== 'sandbox'
+    || !['sandbox-run', 'intrusive-test'].includes(policy.localVerification.operation)
+    || policy.kind !== (policy.localVerification.operation === 'sandbox-run' ? 'test' : 'security')
+    || policy.localVerification.requestedTarget !== command(input.executionPlan)
+    || !/^[0-9a-f]{64}$/.test(policy.localVerification.requirementsSha256)
+    || [policy.flowId, policy.stepId].some(value => typeof value !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value))) {
+    fail('ENTROROVE_ISOLATION_BINDING', 'binding must declare its exact actual wrapped native request');
+  }
+  const control = loaded.value; control.originalPlan.evidencePolicy = structuredClone(policy);
+  control.originalPlanSha256 = isolationDigest17(isolationCanonical17(control.originalPlan) + '\n');
+  const temporary = input.isolationControlPath + '.' + randomUUID() + '.tmp';
+  try { await fs.writeFile(temporary, isolationCanonical17(control) + '\n', { flag: 'wx', mode: 0o600 }); await fs.rename(temporary, input.isolationControlPath); }
+  finally { await fs.rm(temporary, { force: true }); }
+  const executionPlan = wrapped(control);
+  return { executionPlan, command: command(executionPlan), isolationControlPath: input.isolationControlPath,
+    originalPlanSha256: control.originalPlanSha256, runnerIdentity: identity(control), approvalRequired: true };
+}
+function identity(control) {
+  return { backend: 'macos-seatbelt', platform: 'darwin', sandboxExecutable: SANDBOX,
+    sandboxExecutableSha256: control.sandboxSha256, nodeExecutable: control.nodeExecutable, nodeExecutableSha256: control.nodeSha256,
+    profilePath: control.profilePath, profileSha256: isolationDigest17(control.profile), bootstrapPath: control.bootstrapPath,
+    bootstrapSha256: ISOLATION_BOOTSTRAP_SHA25617, producerSha256: control.producerSha256, originalPlanSha256: control.originalPlanSha256 };
+}
+async function loadControl(input) {
+  const root = await directory(input.repositoryRoot), file = await privateControl(root, input.isolationControlPath);
+  let value; try { value = JSON.parse(file.bytes.toString('utf8')); } catch { fail('ENTROROVE_ISOLATION_CONTROL', 'isolation control JSON is invalid'); }
+  exact(value, ['schemaVersion', 'repositoryRoot', 'originalPlan', 'originalPlanSha256', 'nonce', 'nodeExecutable', 'nodeSha256',
+    'sandboxSha256', 'profilePath', 'bootstrapPath', 'producerSha256', 'profile', 'readTarget', 'writeTarget', 'networkProbePort'], 'isolation control');
+  if (value.schemaVersion !== CONTROL_SCHEMA || value.repositoryRoot !== root || value.nodeExecutable !== await fs.realpath(process.execPath)
+    || value.originalPlanSha256 !== isolationDigest17(isolationCanonical17(value.originalPlan) + '\n')
+    || value.profile !== profile(root, value.originalPlan, value.nodeExecutable, value.bootstrapPath)
+    || isolationCanonical17(input.executionPlan) !== isolationCanonical17(wrapped(value))
+    || value.readTarget !== path.join(path.dirname(input.isolationControlPath), 'outside-read.canary')
+    || value.writeTarget !== path.join(path.dirname(input.isolationControlPath), 'outside-write.canary')
+    || value.bootstrapPath !== path.join(path.dirname(input.isolationControlPath), 'bootstrap.mjs')
+    || value.profilePath !== path.join(path.dirname(input.isolationControlPath), 'profile.sb')) {
+    fail('ENTROROVE_ISOLATION_CHANGED', 'isolation command, profile, source plan or private original control changed');
+  }
+  guardEnvironment(value.originalPlan.policy.environment);
+  if ((await privateControl(root, value.bootstrapPath)).sha256 !== ISOLATION_BOOTSTRAP_SHA25617
+    || (await privateControl(root, value.profilePath)).sha256 !== isolationDigest17(value.profile)
+    || (await regular(await fs.realpath(fileURLToPath(import.meta.url)))).sha256 !== value.producerSha256) {
+    fail('ENTROROVE_ISOLATION_CHANGED', 'actual private bootstrap, profile or first-party producer source changed');
+  }
+  for (const [binary, expected] of [[SANDBOX, value.sandboxSha256], [value.nodeExecutable, value.nodeSha256],
+    [value.originalPlan.policy.executable, value.originalPlan.policy.executableSha256]]) {
+    if ((await regular(binary)).sha256 !== expected) fail('ENTROROVE_ISOLATION_EXECUTABLE', 'actual isolation executable identity changed');
+  }
+  if ((await privateControl(root, value.readTarget)).bytes.toString('utf8') !== `CANARY17:${value.nonce}`) {
+    fail('ENTROROVE_ISOLATION_PROBE', 'original private external read canary changed');
+  }
+  try { await fs.lstat(value.writeTarget); fail('ENTROROVE_ISOLATION_PROBE', 'external write canary must not exist'); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; }
+  return { value, sha256: file.sha256 };
+}
+async function signing(input) {
+  const root = input.repositoryRoot, file = await privateControl(root, input.signerConfigPath);
+  let config; try { config = JSON.parse(file.bytes.toString('utf8')); } catch { fail('ENTROROVE_ISOLATION_SIGNER', 'external signer config JSON is invalid'); }
+  exact(config, ['schemaVersion', 'privateKeyPath', 'keyId', 'receiptTtlMs'], 'external signer');
+  const pinned = process.env.ENTROROVE_VALIDATOR_RECEIPT_PUBLIC_KEY?.trim();
+  if (!pinned || config.schemaVersion !== 'validator.runner-signer/1.0') fail('ENTROROVE_ISOLATION_SIGNER', 'trusted external Validator receipt public key is required');
+  let publicKey;
+  try { publicKey = createPublicKey(pinned.includes('BEGIN PUBLIC KEY') ? pinned : { key: Buffer.from(pinned, 'base64'), format: 'der', type: 'spki' }); }
+  catch { fail('ENTROROVE_ISOLATION_SIGNER', 'trusted Validator public key configuration is invalid'); }
+  if (publicKey.asymmetricKeyType !== 'ed25519' || config.keyId !== isolationDigest17(publicKey.export({ format: 'der', type: 'spki' }))) {
+    fail('ENTROROVE_ISOLATION_SIGNER', 'caller signer cannot replace the externally pinned Validator key');
+  }
+  const privateFile = await privateControl(root, config.privateKeyPath); let privateKey;
+  try { privateKey = createPrivateKey(privateFile.bytes); } finally { privateFile.bytes.fill(0); }
+  if (privateKey.asymmetricKeyType !== 'ed25519' || isolationDigest17(createPublicKey(privateKey).export({ format: 'der', type: 'spki' })) !== config.keyId) {
+    fail('ENTROROVE_ISOLATION_SIGNER', 'external signer private key differs from the configured trusted identity');
+  }
+  return { privateKey, publicKey, keyId: config.keyId, configSha256: file.sha256 };
+}
+function probes(result, control) {
+  const lines = result.process.stdout.split('\n').filter(line => line.startsWith(MARKER));
+  if (lines.length !== 1 || !result.process.stdout.startsWith(MARKER)) fail('ENTROROVE_ISOLATION_UNPROVEN', 'fixed isolation bootstrap did not produce one original denial result');
+  let value; try { value = JSON.parse(lines[0].slice(MARKER.length)); } catch { fail('ENTROROVE_ISOLATION_UNPROVEN', 'original isolation denial result is malformed'); }
+  exact(value, ['nonce', 'probes'], 'bootstrap result'); exact(value.probes, ['externalRead', 'externalWrite', 'network'], 'kernel probes');
+  if (value.nonce !== control.nonce) fail('ENTROROVE_ISOLATION_UNPROVEN', 'kernel probes lost their private original nonce');
+  for (const probe of Object.values(value.probes)) {
+    exact(probe, ['denied', 'code'], 'kernel denial');
+    if (probe.denied !== true || !['EPERM', 'EACCES'].includes(probe.code)) fail('ENTROROVE_ISOLATION_UNPROVEN', 'actual kernel did not deny every required external access');
+  }
+  return value.probes;
+}
+export async function runValidatorIsolation17(input) {
+  platform(); await assertBudgetRunnerAllowed(input);
+  exact(input, ['repositoryRoot', 'executionPlan', 'approvalPath', 'signerConfigPath', 'isolationControlPath',
+    ...['home', 'flowId', 'executionDeadlineAt'].filter(key => input[key] !== undefined)], 'isolation execution');
+  const before = await loadControl(input), signer = await signing(input);
+  const { isolationControlPath: _control, ...runnerInput } = input;
+  const result = await runApprovedPlanObject(runnerInput), actualProbes = probes(result, before.value);
+  const after = await loadControl(input), afterSigner = await signing(input);
+  if (after.sha256 !== before.sha256 || afterSigner.configSha256 !== signer.configSha256) fail('ENTROROVE_ISOLATION_CHANGED', 'original isolation authority changed during execution');
+  const evidence = result.evidence[0], receipt = evidence?.receipt;
+  if (!receipt || receipt.keyId !== signer.keyId || receipt.subjectDigest !== evidence.subjectDigest || receipt.subjectDigest !== isolationDigest17(isolationCanonical17(result.subject))) {
+    fail('ENTROROVE_ISOLATION_UNPROVEN', 'actual approved execution has no original trusted bound receipt');
+  }
+  const { signature, ...original } = receipt;
+  if (!verify(null, Buffer.from(isolationCanonical17(original)), signer.publicKey, Buffer.from(signature, 'base64url'))) {
+    fail('ENTROROVE_ISOLATION_UNPROVEN', 'original approved execution signature is invalid');
+  }
+  const issuedAt = new Date().toISOString();
+  if (Date.parse(receipt.expiresAt) <= Date.parse(issuedAt)) fail('ENTROROVE_ISOLATION_EXPIRED', 'original approved receipt expired before isolation attestation');
+  const body = { schemaVersion: ISOLATION_SCHEMA17, keyId: signer.keyId, subjectDigest: evidence.subjectDigest,
+    evidenceReceiptDigest: isolationDigest17(isolationCanonical17(receipt)), evidenceReceiptNonce: receipt.nonce,
+    processDigest: isolationDigest17(isolationCanonical17(result.process)), planSha256: result.planSha256,
+    approvalSha256: result.approvalSha256, runnerIdentity: identity(before.value), probes: actualProbes, issuedAt, expiresAt: receipt.expiresAt };
+  return { ...result, isolationReceipt: { ...body, signature: sign(null, Buffer.from(isolationCanonical17(body)), signer.privateKey).toString('base64url') } };
+}
+
+const shaSchema = { type: 'string', pattern: '^[0-9a-f]{64}$' };
+const stringSchema = { type: 'string', minLength: 1 };
+const objectSchema = properties => ({ type: 'object', additionalProperties: false, required: Object.keys(properties), properties });
+const denialSchema = objectSchema({ denied: { const: true }, code: { enum: ['EPERM', 'EACCES'] } });
+export const VALIDATOR_ISOLATION_RECEIPT_SCHEMA17 = objectSchema({ schemaVersion: { const: ISOLATION_SCHEMA17 }, keyId: shaSchema,
+  subjectDigest: shaSchema, evidenceReceiptDigest: shaSchema, evidenceReceiptNonce: stringSchema, processDigest: shaSchema,
+  planSha256: shaSchema, approvalSha256: shaSchema, runnerIdentity: objectSchema({ backend: { const: 'macos-seatbelt' },
+    platform: { const: 'darwin' }, sandboxExecutable: { const: SANDBOX }, sandboxExecutableSha256: shaSchema,
+    nodeExecutable: stringSchema, nodeExecutableSha256: shaSchema, profilePath: stringSchema, profileSha256: shaSchema,
+    bootstrapPath: stringSchema, bootstrapSha256: shaSchema, producerSha256: shaSchema, originalPlanSha256: shaSchema }),
+  probes: objectSchema({ externalRead: denialSchema, externalWrite: denialSchema, network: denialSchema }),
+  issuedAt: { ...stringSchema, format: 'date-time' }, expiresAt: { ...stringSchema, format: 'date-time' },
+  signature: { type: 'string', pattern: '^[A-Za-z0-9_-]{86}$' } });

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.skill-manifest/1.0",
   "name": "entrorove",
-  "version": "0.1.25",
+  "version": "0.1.28",
   "endpoint": "https://entrorove.com",
   "requestSchemaVersion": "entrorove.skill.request/2.0",
   "supportedRequestSchemaVersions": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.25",
+  "version": "0.1.28",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"
@@ -24,6 +24,14 @@
     "local-swarm-state.mjs",
     "local-swarm-storage.mjs",
     "local-swarm.mjs",
+    "local-autocoord17-authority.mjs",
+    "local-autocoord17-controller.mjs",
+    "local-autocoord17-peers.mjs",
+    "local-autocoord17-store.mjs",
+    "local-autocoord17-tasks.mjs",
+    "local-autocoord17-waits.mjs",
+    "local-validator-isolation17.mjs",
+    "local-calctool-composition17.mjs",
     "local-mutation-files.mjs",
     "local-mutation-snapshot.mjs",
     "local-mutation-audit.mjs",
@@ -35,6 +43,7 @@
     "local-mutation-batch-receipt.mjs",
     "local-integrity.mjs",
     "local-evidence-verification.mjs",
+    "local-error.mjs",
     "local-formula.mjs",
     "local-ledger.mjs",
     "local-chain-bindings.mjs",
@@ -176,7 +185,7 @@
     "local-final-gate16-release.mjs"
   ],
   "scripts": {
-    "test": "node --test test/*.test.mjs",
+    "test": "node --test --test-concurrency=1 test/*.test.mjs",
     "prepublishOnly": "node release.mjs",
     "prepare:archguard": "node archguard-runtime-build.mjs",
     "check:archguard": "node archguard-runtime-build.mjs --check",

package/release-state.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.release-state/1.0",
-  "version": "0.1.25",
-  "digest": "51ba0446dc6d2004bdf31195d4cf62bdd522f3c0a76de1c35344df32ae130046",
+  "version": "0.1.28",
+  "digest": "45cbb490c5d7fc99eb1ee6d4d852f9695e614ea3fd0c9923e30a6d24e777401e",
   "files": {
     "local-final-gate16.mjs": "b30caab08441449ad556a6e9a3cefbf91190f0b3f7370f46d2a21156375aa8e3",
     "local-final-gate16-checks.mjs": "1dd30e9666d458d8b12ca6e4975f6f0ac8450c3ea9cbecc7401ae037f66b589a",
@@ -36,15 +36,23 @@
     "local-swarm-state.mjs": "ff84c5f35ef3e4a0ad9887d145e404f5786ae0dc92496116699d031b98e90c6a",
     "local-swarm-storage.mjs": "4b506481913fe22769f47a14a024a2cc4c0f1e986bb52ef606d14c7844226086",
     "local-swarm.mjs": "94b5adde0239cc21bada288886482934d409f4383d31076025437ed621ef43b6",
+    "local-autocoord17-authority.mjs": "86b79798f6019523b1260b819622070a5b0d39670f607da930fb6923259dff1d",
+    "local-autocoord17-controller.mjs": "1307c4decf8dc98a447e4072d27f69caec64149f8d48545c84ef7cc50a561777",
+    "local-autocoord17-peers.mjs": "103d6a6634bbd3b4b850c5db7b571e3f05736b94e59a8fd7da63741281c903a4",
+    "local-autocoord17-store.mjs": "b48847a4a40c3aeb16bc1431b6a16221fb5ffdc0a6ba5c263acf196279d80ed1",
+    "local-autocoord17-tasks.mjs": "44b9f2d326ab3060c36657685b48b50a98711644e5baf47d4e8cb72c4c45f2a7",
+    "local-autocoord17-waits.mjs": "2b0a713987822548a94e1ed3a9a891532db45383797dfc5d5bc8d1e35593cf25",
+    "local-validator-isolation17.mjs": "48e94604e28b8fddd567dfb35ff60b73fd094a5803bd49f076388b7f310f92aa",
+    "local-calctool-composition17.mjs": "ac89fcb41ab0d0d9b47c1b5696945281b0894eb064820775e36a011c76314e6a",
     "cli.mjs": "c85289b1cbe0ea469a57e67edb1fc475dc9c626c2beae00f5e0954c00757481d",
     "review-client.mjs": "3491eef68ed533174b31db3c53febb6519b8f088f71a9964644714a9a4c03c77",
     "version.mjs": "1f392147d72c40af4b03b307ea607075fb815af5174fa07e254b95fe12dbf3e7",
-    "SKILL.md": "f6a140c4d0dd79b6985d1cd085c831a26c64119a4107e35d25c3ac5a566ed797",
-    "CAPABILITY-MAP.md": "1a58ac506efe894c0ba224605a758cbc8a1c8f7b9ed05ce355e0c9a3ce43c61f",
+    "SKILL.md": "87c5e85b0c767c85660ebb9958bccaeb69f3f8c2f122f210f5b38e30df891014",
+    "CAPABILITY-MAP.md": "128ecc8d90b2c17846ce6f0c650eada9e7fa7240f5d3c03b31e3ee01135557b8",
     "AGREEMENT.md": "f93a68e92c457200dd024610e65f74e478b8f60860f951da818b70561f1b9bf8",
-    "package.json": "a60c18189e680be7c8547c5331ceee74f64115dc571e8e069e76570a5fcede0b",
+    "package.json": "cb54098a13e05f22ef09bcb6a35a47995415bb14732791b61c0334ec7c7d1403",
     "manifest.json": "ab06e307795bc9da5add926752b6c4dbdaf18625090261a035aa356a679c504f",
-    "release.mjs": "b6882c24084129a0853330ec707b46fac69c25d533cdcc23b95b23cdefda27e9",
+    "release.mjs": "607f63013ed2cdf9448d451c7e5a4e130715be5bae70e8905fb15d874ea7b93a",
     "local-cli.mjs": "ecc85bc5f36a5663fef004e59525374dc7883d3889f5a0cfe219ae5e84b2d3ea",
     "local-state-lock.mjs": "1dbf64264642a0851faf043e07ee9f66d2ad0508e9f799b0626246e42fae893e",
     "local-execution.mjs": "97dfad5e889e679e9cc34434005342526502795abba21078fa40673788073153",
@@ -52,6 +60,7 @@
     "local-evidence-verification.mjs": "9b7dea31777505272f63616fd62af7603338f703bb1285fc565d6451715c7ce0",
     "local-formula.mjs": "706d5ec0cb2caf95a547531a81ca746fe246d4c53d902e03595a3b360e8c85af",
     "local-ledger.mjs": "2009fb68aadcd7292b72f1d0d99f378d03644be1c5b4b4150d9f6a0b3f7c15ce",
+    "local-error.mjs": "66484e2e27c9870a17dc0f1cf64d108ea384ad9fb41b7adc3aacb243ae65fe2e",
     "blueprint-criterion-wire.mjs": "fb6b7dcce0b97a699e3e8968372767a3fddd83fedc750998573f789177243072",
     "blueprint-criterion-runner.mjs": "761c0e670b4b20c6bed53e5ca5d0178759505c3977ea2ed1b7223383c534bc4c",
     "local-chain-bindings.mjs": "b8eff999ccd17b53c614a3c9f5376da78fcaa8632bb3e07bc1adcceda2e75f6c",
@@ -126,13 +135,13 @@
     "workflow-local-runner.mjs": "9fa899a11da2b6b7a436bf9b561641856adcbc5f8b914f6ba89a64dae224900d",
     "workflow-local-contracts.mjs": "604afa9e97c6dfc3d07b01509ef2476887a2fc219c9e827bcac5d563ab4719e7",
     "workflow-local-client.mjs": "45c954f694d96bf0ea87ee2dc6902a6763dac2cb1df713b6a5e749632054e9af",
-    "workflow-local-request.mjs": "e8cce489ecadc756e27bf8686556a830e9e789df03a56e034f7b741e6455d3ae",
+    "workflow-local-request.mjs": "4e24c543ce386292a87dc9cd41f90d23375f12079cacffc515c8cd01fd571780",
     "task-message-entry.mjs": "31d10056cb905237cd5649e8eb067009ff1612ec5dc1061e0373209fbc0b646a",
     "task-message-cli.mjs": "3ca65e96c28129b3bd5cac962d106e0859a1f17df1f6a66ee543c6efc22f918d",
     "local-contracts.mjs": "43715cd73460ccea734501a3dd5667184da0f6a5b0189e038319a439ba52fc76",
     "local-contract-types.mjs": "5d244237fc69052b2fa83098022761bae929e8b75a0683883b620711bc132050",
     "local-archguard-ast.mjs": "cefd835312a623e83bf48e4d8e1f76ac6a8adc56c35843705c16967d16bec4e6",
-    "local-archguard-checkpoint.mjs": "1ee3a40561940a62583382036d4049321627fe9e41e0f31a973ef40bc86fcb55",
+    "local-archguard-checkpoint.mjs": "37896902520cc995720c96288e4a5ed3585952b55c9c35be281f91fa754c71ec",
     "local-archguard-components.mjs": "a8fb3d0fd787f9160905013fd333cc0b9e8cf624cce797461f36f4ab31d170ad",
     "local-archguard-contract.mjs": "cfc397a1ce171ab84f8bf1db152e6d8d280b7ca041da56a7a4cd62b02c2e2e89",
     "local-archguard-contracts.mjs": "29e9b86f14dc086aa0b791c874d6efc50d849f806b3f2b8725481114f01ba8ba",
@@ -142,7 +151,7 @@
     "local-archguard-operations.mjs": "1a35268b857b86eab54dd4efa78fc54bf08b39dfab4fa980c7dd63b8959206b0",
     "local-archguard-scope.mjs": "afbd23a79c175f198892ddb2026ecac219a1650ee6115763736d9b1ee5a07ee0",
     "local-archguard-signing.mjs": "7de0fe4b8f6f5a92d043ad8976054faaa76b7b37556ed582e5e012c6f0facc87",
-    "local-archguard-snapshot.mjs": "81b456915232b8e87d9b663912bf95062753a0bd0e38a096cbd80c2ef03683f9",
+    "local-archguard-snapshot.mjs": "81282fa7d0e3bbf879fc5a3c6a9e4f44fb15dee36029bb0ce2a5e4f1710cf4c9",
     "local-archguard-state.mjs": "1d3c74c4ec222646e82120be4aa6a00c52d2867fb8c20323420d6ab0bf2cd46c",
     "local-archguard.mjs": "4c8ec5d569d728b15161eb88e49371c77def7d1fe511aa16694581a2c1d59433",
     "archguard-runtime-build.mjs": "45bf31764763973bd8de32b3e16d194162407e7cb74802df3ab363f0fd30e866",