@entrorove/skill 0.1.37 → 0.1.39

package/local-discipline-repository.mjs

@@ -0,0 +1,87 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { canonical, sha256 } from './local-integrity.mjs';
+import { mutationRead14, mutationPath14, mutationTarget14, mutationFail14 } from './local-mutation-files.mjs';
+import { analyzeDisciplineSources } from './local-discipline-analysis.mjs';
+import { importGraph, scopeCandidateImports } from './local-scope-repository.mjs';
+import { nativeDisciplineDefinitions } from './local-discipline-native.mjs';
+
+const script = /\.(?:[cm]?[jt]sx?|php|py|java|rs|vue|svelte|css)$/i;
+const excluded = new Set(['.git', 'node_modules']);
+async function inventory(root, prefix = '') {
+  const entries = await fs.readdir(path.join(root, prefix), { withFileTypes: true }), files = [];
+  for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+    if (excluded.has(entry.name)) continue;
+    const relative = mutationPath14(prefix ? `${prefix}/${entry.name}` : entry.name);
+    if (entry.isDirectory()) files.push(...await inventory(root, relative));
+    else if (entry.isFile() || entry.isSymbolicLink()) files.push(relative);
+    else mutationFail14('ENTROROVE_DISCIPLINE_SCAN_UNKNOWN', 'Repository comparison encountered an unsupported filesystem entry');
+  }
+  return files.sort();
+}
+export async function disciplineRepositoryObservation(input, root, { analyze = false, overrides = new Map() } = {}) {
+  const paths = await inventory(root), files = [], sources = [], unresolved = [];
+  for (const relative of paths) {
+    const stat = await fs.lstat(path.join(root, relative));
+    if (stat.isSymbolicLink()) {
+      files.push({ path: relative, sha256: sha256(await fs.readlink(path.join(root, relative))), mode: stat.mode & 0o777, kind: 'symlink' });
+      unresolved.push({ path: relative, reason: 'symlink-reference' }); continue;
+    }
+    const read = await mutationRead14(input, root, relative);
+    files.push({ path: relative, sha256: read.sha256, mode: read.mode, kind: 'file' });
+    if (analyze && script.test(relative)) sources.push({ path: relative, content: overrides.get(relative) ?? read.content.toString('utf8') });
+  }
+  if (canonical(paths) !== canonical(await inventory(root))) mutationFail14('ENTROROVE_DISCIPLINE_SCAN_CHANGED', 'Repository inventory changed while observing its original baseline');
+  const comparison = { schemaVersion: 'entrorove.repository-comparison/1.0', files,
+    scope: 'whole-repository-including-ignored-files', excludedDirectoryNames: [...excluded].sort() };
+  if (!analyze) return { comparison };
+  // The existing resolver supplies actual aliases, package exports and import edges.
+  // Unsupported/dynamic references stay unknown; they are never converted to unused.
+  const roots = sources.filter(file => /\.[cm]?[jt]sx?$/i.test(file.path)).map(file => ({ path: file.path, exists: true }));
+  for (const [relative, content] of overrides) if (!paths.includes(relative) && script.test(relative)) sources.push({ path: relative, content });
+  let graph;
+  try { graph = roots.length ? await importGraph(root, roots, input) : { edges: [], dynamicSources: [], complete: true }; }
+  catch (error) {
+    if (!['ENTROROVE_IMPORT_UNRESOLVED', 'ENTROROVE_IMPORT_INVALID', 'ENTROROVE_IMPORT_UNSUPPORTED', 'ENTROROVE_SCOPE_LIMIT'].includes(error.code)) throw error;
+    graph = { edges: [], dynamicSources: [], complete: false }; unresolved.push({ reason: error.code });
+  }
+  for (const [relative, content] of overrides) if (/\.[cm]?[jt]sx?$/i.test(relative)) {
+    try {
+      const candidate = await scopeCandidateImports(root, { path: relative, content }, input);
+      graph.edges = [...graph.edges.filter(edge => edge.from !== relative), ...candidate.edges];
+      if (candidate.dynamic) unresolved.push({ path: relative, reason: 'candidate-dynamic-import' });
+    } catch (error) {
+      if (!['ENTROROVE_IMPORT_UNRESOLVED', 'ENTROROVE_IMPORT_INVALID', 'ENTROROVE_IMPORT_UNSUPPORTED'].includes(error.code)) throw error;
+      unresolved.push({ path: relative, reason: error.code });
+    }
+  }
+  const analysis = analyzeDisciplineSources(sources, { edges: graph.edges,
+    unresolved: [...unresolved, ...graph.dynamicSources.map(item => ({ path: item.path, reason: 'dynamic-import' }))] });
+  analysis.definitions.push(...await nativeDisciplineDefinitions(sources));
+  return { comparison, analysis, scanComplete: graph.complete && analysis.unresolved.length === 0 };
+}
+export function disciplineRepositoryDifferences(before, after, authorized = new Map()) {
+  const left = new Map(before.files.map(file => [file.path, file])), right = new Map(after.files.map(file => [file.path, file]));
+  const changed = [];
+  for (const relative of [...new Set([...left.keys(), ...right.keys()])].sort()) {
+    const expected = authorized.has(relative) ? authorized.get(relative) : left.get(relative) ?? null;
+    if (canonical(expected) !== canonical(right.get(relative) ?? null)) changed.push(relative);
+  }
+  return changed;
+}
+export async function assertDisciplineRepository(input, root, review, ledger) {
+  const expected = new Map();
+  for (const [relative, write] of Object.entries(ledger.writes ?? {})) {
+    if (write.status !== 'written') mutationFail14('ENTROROVE_MUTATION_PASS_CONSUMED', 'Repository comparison found an unresolved physical action');
+    if (write.kind === 'delete') expected.set(relative, null);
+    else {
+      const baseline = review.comparison.files.find(file => file.path === relative);
+      expected.set(relative, { path: relative, sha256: write.contentDigest, mode: write.mode ?? baseline?.mode ?? 0o644,
+        kind: baseline?.kind ?? 'file' });
+    }
+  }
+  const current = await disciplineRepositoryObservation(input, root);
+  const changed = disciplineRepositoryDifferences(review.comparison, current.comparison, expected);
+  if (changed.length) mutationFail14('ENTROROVE_DISCIPLINE_REPOSITORY_DRIFT', `Whole-repository comparison differs outside completed declared actions: ${changed.join(', ')}`);
+  return current.comparison;
+}

package/local-discipline-snapshot.mjs

@@ -0,0 +1,29 @@
+import path from 'node:path';
+import { canonical, sha256 } from './local-integrity.mjs';
+import { atomicMutationJson14, mutationFail14, readMutationJson14 } from './local-mutation-files.mjs';
+import { disciplineRepositoryObservation } from './local-discipline-repository.mjs';
+
+export function snapshotDisciplineBinding(value) {
+  if (!Object.hasOwn(value, 'disciplineReviewDigest')) return {};
+  if (!/^[0-9a-f]{64}$/.test(value.disciplineReviewDigest ?? '')) mutationFail14('ENTROROVE_DISCIPLINE_REVIEW_INVALID', 'Snapshot discipline review digest is invalid');
+  return { disciplineReviewDigest: value.disciplineReviewDigest };
+}
+export async function captureDisciplineSnapshot(input, root, location, binding) {
+  const observed = await disciplineRepositoryObservation(input, root, { analyze: true });
+  const review = { schemaVersion: 'entrorove.discipline-review/1.0', ...binding,
+    repositoryDigest: sha256(root).slice(0, 32), createdAt: new Date().toISOString(), ...observed,
+    thresholds: { deletionAdditionRatio: null, semanticOverlap: null, directLines: null, usageScopeLimit: null } };
+  const digest = sha256(canonical(review));
+  await atomicMutationJson14(path.join(location.snapshotRoot, 'discipline-review.json'), review, { privateFrom: location.stateRoot });
+  return { disciplineReviewDigest: digest };
+}
+export async function readDisciplineSnapshot(snapshot) {
+  const manifest = snapshot.manifest;
+  if (!manifest.disciplineReviewDigest) mutationFail14('ENTROROVE_DISCIPLINE_REVIEW_REQUIRED', 'A new write requires its original deterministic repository and usage review; reconnect the original snapshot');
+  const review = await readMutationJson14(path.join(snapshot.snapshotRoot, 'discipline-review.json'));
+  if (review.schemaVersion !== 'entrorove.discipline-review/1.0' || sha256(canonical(review)) !== manifest.disciplineReviewDigest
+    || ['snapshotId', 'flowId', 'stepId', 'repositoryDigest'].some(key => review[key] !== manifest[key])) {
+    mutationFail14('ENTROROVE_DISCIPLINE_REVIEW_INVALID', 'Repository or usage review differs from the original signed snapshot');
+  }
+  return review;
+}

package/local-equivalence-runner.mjs

@@ -0,0 +1,33 @@
+import { validatorBindEquivalenceResult, validatorParallelDeclarationsValid } from './runtime/validator-runtime-v7.0.44.mjs';
+
+export function validateRunnerParallelPaths(plan) {
+  const pairs = plan.policy.parallelPaths;
+  if (pairs === undefined) return;
+  if (!validatorParallelDeclarationsValid(pairs) || pairs.some(pair =>
+    ![pair.originalPath, pair.candidatePath].every(path => plan.files.some(file => file.path === path))
+    || !plan.files.some(file => file.path === pair.baselinePath && file.sha256 === pair.baselineSha256)
+    || plan.goldenBaseline.source.kind !== 'artifact' || plan.goldenBaseline.source.locator !== pair.baselinePath
+    || plan.goldenBaseline.source.digestSha256 !== pair.baselineSha256)) {
+    throw Object.assign(new Error('Parallel paths must bind the original frozen manifest and real prior output baseline'), { code: 'ENTROROVE_EQ_PLAN_INVALID' });
+  }
+}
+export async function captureRunnerEquivalence(authority, result, readFile) {
+  const pairs = authority.plan.policy.parallelPaths;
+  if (!pairs) return undefined;
+  let output;
+  try { output = JSON.parse(result.stdout); } catch { return undefined; }
+  if (!Array.isArray(output?.equivalence)) return undefined;
+  if (output.equivalence.some(item => !item || Object.keys(item).sort().join('|') !== 'cases|comparisonId')
+    || new Set(output.equivalence.map(item => item.comparisonId)).size !== output.equivalence.length
+    || output.equivalence.some(item => !pairs.some(pair => pair.comparisonId === item.comparisonId))) {
+    throw Object.assign(new Error('Actual comparison output contains undeclared identities'), { code: 'ENTROROVE_EQ_OUTPUT_INVALID' });
+  }
+  const results = [];
+  for (const pair of pairs) {
+    const actual = output.equivalence.find(item => item.comparisonId === pair.comparisonId);
+    if (!actual) continue;
+    const baseline = await readFile(authority.root, pair.baselinePath);
+    results.push(validatorBindEquivalenceResult(pair, baseline.bytes, actual.cases, authority.plan.goldenBaseline.frozenAt));
+  }
+  return results;
+}

package/local-error.mjs

@@ -9,9 +9,19 @@ export const LOCAL_ERROR_CODE_CATALOG = Object.freeze({
   ENTROROVE_BUDGET_LEASE_EXPIRED: Object.freeze({ disposition: 'retriable', stability: 'stable' }),
   ENTROROVE_GIT_READER_UNSUPPORTED: Object.freeze({ disposition: 'terminal', stability: 'stable' }),
   ENTROROVE_GIT_UNAVAILABLE: Object.freeze({ disposition: 'needs-human', stability: 'stable' }),
+  ENTROROVE_DISCIPLINE_NEEDS_HUMAN: Object.freeze({ disposition: 'needs-human', stability: 'stable' }),
+  ENTROROVE_DISCIPLINE_USAGE_UNKNOWN: Object.freeze({ disposition: 'needs-human', stability: 'stable' }),
+  ENTROROVE_DISCIPLINE_REVIEW_REQUIRED: Object.freeze({ disposition: 'needs-human', stability: 'stable' }),
+  ENTROROVE_DISCIPLINE_DATA_SNAPSHOT_REQUIRED: Object.freeze({ disposition: 'needs-human', stability: 'stable' }),
+  ENTROROVE_IDE_GUARD_REQUIRED: Object.freeze({ disposition: 'needs-human', stability: 'stable' }),
+  ENTROROVE_IDE_GUARD_UNSUPPORTED: Object.freeze({ disposition: 'terminal', stability: 'stable' }),
 });
 
 const BLOCKED_CODES = new Set([
+  'ENTROROVE_DISCIPLINE_NEEDS_HUMAN', 'ENTROROVE_DISCIPLINE_USAGE_UNKNOWN', 'ENTROROVE_DISCIPLINE_REVIEW_REQUIRED',
+  'ENTROROVE_DISCIPLINE_DATA_SNAPSHOT_REQUIRED', 'ENTROROVE_DISCIPLINE_REPOSITORY_DRIFT', 'ENTROROVE_DISCIPLINE_FORMAT_SCOPE',
+  'ENTROROVE_DISCIPLINE_SPECULATIVE', 'ENTROROVE_DISCIPLINE_REVIEW_INVALID',
+  'ENTROROVE_IDE_GUARD_REQUIRED', 'ENTROROVE_IDE_GUARD_UNSUPPORTED', 'ENTROROVE_IDE_ACCOUNT',
   'ENTROROVE_GIT_UNAVAILABLE',
   'ENTROROVE_MUTATE_NOT_ACCEPTED', 'ENTROROVE_MUTATION_AUTHORITY_REQUIRED',
   'ENTROROVE_MUTATION_PASS_INVALID', 'ENTROROVE_MUTATION_PASS_EXPIRED',

package/local-execution.mjs

@@ -277,6 +277,7 @@ export async function finalGate(input) {
 
 const LOCAL_OPERATION_GROUPS = Object.freeze(['core', 'budget', 'scope', 'merge', 'chain', 'handoff', 'archguard', 'calctool', 'swarm', 'validator', 'formula', 'evidence']);
 const PASS_REQUIRED_OPERATIONS = new Set(['mutation-snapshot-attest', 'mutate-gate', 'gate-issue', 'gate-verify', 'guarded-write',
+  'discipline-review', 'discipline-check', 'guarded-delete', 'guarded-move',
   'merge-verified', 'rollback', 'archguard-contract-create', 'archguard-contract-update', 'archguard-checkpoint', 'archguard-scope-request',
   'budget-handoff', 'budget-transition', 'spawn-bind', 'peer-complete', 'complete']);
 function operationGroup(operation) {

package/local-integrity.d.mts

@@ -0,0 +1,5 @@
+export function canonical(value: unknown): string;
+export function sha256(value: string | Buffer): string;
+export function verifySnapshotManifest(manifest: unknown, binding: {
+  snapshotId: string; flowId: string; stepId: string; repositoryDigest: string;
+}): { verified: boolean; reason?: string };

package/local-integrity.mjs

@@ -48,6 +48,10 @@ export function verifySnapshotManifest(manifest, binding) {
   }
   const core = { snapshotId: manifest.snapshotId, flowId: manifest.flowId, stepId: manifest.stepId,
     paths: manifest.paths, files: manifest.files, contractDigest: manifest.contractDigest };
+  if (Object.hasOwn(manifest, 'disciplineReviewDigest')) {
+    if (!SHA256.test(manifest.disciplineReviewDigest ?? '')) return { verified: false, reason: 'snapshot discipline digest is invalid' };
+    core.disciplineReviewDigest = manifest.disciplineReviewDigest;
+  }
   try { Object.assign(core, snapshotHandoffBinding(manifest)); }
   catch { return { verified: false, reason: 'snapshot handoff binding is invalid' }; }
   return manifest.snapshotDigest === sha256(canonical(core))

package/local-merge-controller.mjs

@@ -85,6 +85,7 @@ async function commit(ctx, input, state, registration, images, assertCurrent) {
       token = await bridge.beginMutationBatch14({ ...ctx.input, signerConfigPath: input.runnerSignerConfigPath }, {
         mutationPass: images.mutation.pass, contract: input.contract, contractDigest, transactionId,
         beforeFiles: journal.before.filter(file => input.preparation.paths.includes(file.path)),
+        contents: images.afterWide.filter(file => input.preparation.paths.includes(file.path) && file.exists).map(file => ({ path: file.path, contentBase64: file.bytes.toString('base64') })),
         afterFiles: journal.after.filter(file => input.preparation.paths.includes(file.path)) }); },
     progress: async progress => { journal = { ...journal, ...progress }; await saveMergeJournal(ctx, journal); },
     finish: async () => {

package/local-merge-rollback.mjs

@@ -65,7 +65,8 @@ async function rollbackCommit(ctx, input, state, journal, images, assertCurrent)
       latest = await saveMergeJournal(ctx, { ...journal, rollback: attempt });
       token = await bridge.beginMutationBatch14({ ...ctx.input, signerConfigPath: input.runnerSignerConfigPath }, {
         mutationPass: images.mutation.pass, contract: auth, contractDigest: binding.contractDigest, transactionId: auth.transactionId,
-        beforeFiles: selected(before), afterFiles: selected(after) });
+        beforeFiles: selected(before), afterFiles: selected(after),
+        contents: after.filter(file => auth.paths.includes(file.path) && file.exists).map(file => ({ path: file.path, contentBase64: file.bytes.toString('base64') })) });
     },
     progress: async progress => { attempt = { ...attempt, ...progress }; latest = await saveMergeJournal(ctx, { ...journal, rollback: attempt }); },
     finish: async () => {

package/local-mutation-authority.mjs

@@ -4,13 +4,16 @@ import { appendLedgerRecord } from './local-ledger.mjs';
 import { withStateLock } from './local-state-lock.mjs';
 import { withTaskHandoffIssueFence, withTaskHandoffWriteFence, assertTaskHandoffSnapshotBinding } from './local-task-handoff-fence.mjs';
 import { mutationFail14, mutationPath14, mutationStateRoot14,
-  mutationRead14, privateMutationDirectory14, writeMutationProjectFile14 } from './local-mutation-files.mjs';
+  mutationRead14, mutationTarget14, privateMutationDirectory14, writeMutationProjectFile14 } from './local-mutation-files.mjs';
 import { mutationPass14, mutationLifetime14 } from './local-mutation-wire.mjs';
 import { mutationOriginalBinding14, mutationSnapshotBinding14 } from './local-mutation-binding.mjs';
 import { installMutationPass14, mutationPassLocations14, readMutationConsumption14,
   readStoredMutationPass14, saveMutationConsumption14 } from './local-mutation-pass-store.mjs';
 import { auditMutation14, withMutationAudit14 } from './local-mutation-audit.mjs';
 import { withSwarmMutationLease } from './local-swarm-mutation.mjs';
+import { disciplineWritePreflight } from './local-discipline-gate.mjs';
+import { readDisciplineSnapshot } from './local-discipline-snapshot.mjs';
+import { assertDisciplineRepository } from './local-discipline-repository.mjs';
 export { beginMutationBatch14, finishMutationBatch14, failMutationBatch14 } from './local-mutation-batch.mjs';
 
 const SCHEMA = 'entrorove.local-execution/1.0';
@@ -42,7 +45,7 @@ export async function issueMutationPass14(input) {
     });
   });
 }
-async function checkedPass(input, state, { allowTargetDrift = false } = {}) {
+export async function checkedPass(input, state, { allowTargetDrift = false } = {}) {
   const pass = await readStoredMutationPass14(input), target = mutationPath14(input.targetPath, 'targetPath');
   if (!pass.paths.includes(target)) mutationFail14('ENTROROVE_MUTATION_WRITE_SCOPE', 'Guarded writing is outside the cloud pass path set');
   const binding = await mutationOriginalBinding14(input, pass, state);
@@ -53,8 +56,10 @@ async function checkedPass(input, state, { allowTargetDrift = false } = {}) {
   const consumedWrite = ledger.writes[target];
   if (allowTargetDrift) {
     if (consumedWrite?.status !== 'written') mutationFail14('ENTROROVE_MUTATION_PASS_CONSUMED', 'Checkpoint requires a completed guarded write');
-    const current = await mutationRead14(input, binding.root, target);
-    if (current.sha256 !== consumedWrite.contentDigest) mutationFail14('ENTROROVE_MUTATION_WRITE_CHANGED', 'Checkpoint target differs from its completed guarded write');
+    if (consumedWrite.kind !== 'delete') {
+      const current = await mutationRead14(input, binding.root, target);
+      if (current.sha256 !== consumedWrite.contentDigest) mutationFail14('ENTROROVE_MUTATION_WRITE_CHANGED', 'Checkpoint target differs from its completed guarded write');
+    } else if ((await mutationTarget14(binding.root, target, true)).exists) mutationFail14('ENTROROVE_MUTATION_WRITE_CHANGED', 'Deleted checkpoint target was recreated');
   } else if (consumedWrite) {
     mutationFail14('ENTROROVE_MUTATION_PASS_CONSUMED', 'Mutation pass was already consumed or has an unresolved physical write');
   }
@@ -80,12 +85,16 @@ async function performWrite(input, state, value) {
   if (canonical(value.pass) !== canonical(pass)) mutationFail14('ENTROROVE_MUTATION_PASS_CHANGED', 'Mutation pass changed while waiting for its original write lock');
   return withSwarmMutationLease(input, pass, async () => {
     const baseline = snapshot.manifest.files.find(file => file.path === target), content = contentFor(input, baseline);
-    const entry = { status: 'pending', contentDigest: sha256(content), at: new Date().toISOString() };
+    const discipline = await disciplineWritePreflight(input, current, content);
+    const entry = { status: 'pending', contentDigest: sha256(content), mode: baseline.mode ?? 0o644, at: new Date().toISOString() };
     await saveMutationConsumption14(locations, { ...ledger, writes: { ...ledger.writes, [target]: entry } });
-    await auditMutation14(input, 'guarded-write-authorized', { passId: pass.passId, sha256: entry.contentDigest });
+    await auditMutation14(input, 'guarded-write-authorized', { passId: pass.passId, sha256: entry.contentDigest,
+      disciplineReviewDigest: discipline.reviewDigest, declaredKind: discipline.declaredKind });
     mutationLifetime14(pass);
     const written = await writeMutationProjectFile14(input, binding.root, target, content, baseline);
-    await saveMutationConsumption14(locations, { ...ledger, writes: { ...ledger.writes, [target]: { ...entry, status: 'written' } } });
+    const completed = { ...ledger, writes: { ...ledger.writes, [target]: { ...entry, status: 'written' } } };
+    await saveMutationConsumption14(locations, completed);
+    await assertDisciplineRepository(input, binding.root, await readDisciplineSnapshot(snapshot), completed);
     await auditMutation14(input, 'guarded-write', { passId: pass.passId, sha256: written.sha256 });
     const stateRoot = await mutationStateRoot14(input);
     await privateMutationDirectory14(path.join(stateRoot, 'ledgers', pass.repositoryDigest), { privateFrom: stateRoot });

package/local-mutation-batch.mjs

@@ -9,6 +9,8 @@ import { readStoredMutationPass14, mutationPassLocations14, readMutationConsumpt
   saveMutationConsumption14 } from './local-mutation-pass-store.mjs';
 import { auditMutation14, withMutationAudit14 } from './local-mutation-audit.mjs';
 import { mutationBatchReceiptBinding14, signMutationBatchReceipt14 } from './local-mutation-batch-receipt.mjs';
+import { disciplineBatchBefore } from './local-discipline-batch.mjs';
+import { assertDisciplineRepository } from './local-discipline-repository.mjs';
 
 const tokens = new WeakMap(), MISSING = sha256('entrorove.missing-file/1.0');
 function clone(value) {
@@ -26,7 +28,7 @@ function files(value, paths) {
 }
 function options(value) {
   if (!value || typeof value !== 'object' || Array.isArray(value)
-    || Object.keys(value).some(field => !['mutationPass', 'beforeFiles', 'afterFiles', 'contract', 'contractDigest', 'transactionId'].includes(field))) {
+    || Object.keys(value).some(field => !['mutationPass', 'beforeFiles', 'afterFiles', 'contents', 'contract', 'contractDigest', 'transactionId'].includes(field))) {
     mutationFail14('ENTROROVE_MUTATION_BATCH_INPUT', 'Batch begin requires its original pass and exact before and after images');
   }
   return value;
@@ -47,7 +49,7 @@ async function authority(input, supplied) {
   return { pass, binding, snapshot, locations: await mutationPassLocations14(input, binding, pass) };
 }
 function batchEntry(state, file, status = 'pending') {
-  return { status, contentDigest: file.sha256, at: state.at, batchId: state.batchId, batchDigest: state.batchDigest,
+  return { status, contentDigest: file.sha256, kind: file.exists ? 'modify' : 'delete', mode: file.mode, at: state.at, batchId: state.batchId, batchDigest: state.batchDigest,
     beforeDigest: state.beforeDigest, afterDigest: state.afterDigest };
 }
 async function originalLedger(state) {
@@ -85,8 +87,9 @@ export async function beginMutationBatch14(rawInput, rawOptions) {
       }
       const snapshot = await mutationSnapshotBinding14(input, fresh.pass, { allSources: true });
       if (canonical(before) !== canonical(snapshot.manifest.files)) mutationFail14('ENTROROVE_MUTATION_BATCH_BEFORE', 'Batch before image differs from the real original signed snapshot');
+      const review = await disciplineBatchBefore(input, { ...fresh, snapshot }, value, before, after, ledger);
       mutationLifetime14(fresh.pass);
-      const state = { ...fresh, ...receiptBinding, input, before, after, status: 'pending', batchId: randomUUID(), at: new Date().toISOString(),
+      const state = { ...fresh, ...receiptBinding, input, before, after, review, status: 'pending', batchId: randomUUID(), at: new Date().toISOString(),
         passDigest: sha256(canonical(fresh.pass)), beforeDigest: sha256(canonical(before)), afterDigest: sha256(canonical(after)) };
       state.batchDigest = sha256(canonical({ passDigest: state.passDigest, beforeDigest: state.beforeDigest,
         afterDigest: state.afterDigest, batchId: state.batchId }));
@@ -114,6 +117,7 @@ export async function finishMutationBatch14(token) {
     mutationLifetime14(fresh.pass);
     const writes = { ...ledger.writes };
     for (const file of state.after) writes[file.path] = batchEntry(state, file, 'written');
+    await assertDisciplineRepository(state.input, state.binding.root, state.review, { ...ledger, writes });
     await saveMutationConsumption14(state.locations, { ...ledger, writes });
     state.status = 'completed';
     await auditMutation14(state.input, 'mutation-batch-finished', { passId: state.pass.passId, batchId: state.batchId,

package/local-mutation-files.mjs

@@ -268,3 +268,25 @@ export async function writeMutationProjectFile14(input, root, relative, content,
     return { target: published.target, sha256: sha256(content), mode: published.stat.mode & 0o777 };
   } finally { await handle.close(); await cleanupTemporary(temporary, saved); }
 }
+export async function removeMutationProjectFile14(input, root, expected) {
+  if (!expected?.exists) mutationFail14('ENTROROVE_DISCIPLINE_BASELINE', 'Deletion requires an existing original snapshot copy');
+  const before = await expectedProjectFile(input, root, expected.path, expected);
+  await assertAncestors(before, 'ENTROROVE_FILE_CHANGED');
+  const latest = await expectedProjectFile(input, root, expected.path, expected);
+  if (!sameNode(before.stat, latest.stat)) mutationFail14('ENTROROVE_FILE_CHANGED', 'Deletion target changed before removal');
+  await fs.unlink(before.target);
+  await assertAncestors(before, 'ENTROROVE_FILE_CHANGED');
+  if ((await mutationTarget14(root, expected.path, true)).exists) mutationFail14('ENTROROVE_FILE_CHANGED', 'Deleted file was replaced during removal');
+}
+export async function moveMutationProjectFile14(input, root, source, destination) {
+  if (!source?.exists || destination?.exists) mutationFail14('ENTROROVE_DISCIPLINE_BASELINE', 'Move requires an existing original source and an absent planned destination');
+  await expectedProjectFile(input, root, source.path, source);
+  await projectParents(root, destination.path);
+  const before = await expectedProjectFile(input, root, source.path, source), after = await expectedProjectFile(input, root, destination.path, destination);
+  await assertAncestors(before, 'ENTROROVE_FILE_CHANGED'); await assertAncestors(after, 'ENTROROVE_FILE_CHANGED');
+  await fs.link(before.target, after.target);
+  const linked = await mutationTarget14(root, destination.path);
+  if (!sameNode(before.stat, linked.stat)) mutationFail14('ENTROROVE_FILE_CHANGED', 'Move destination changed during publication');
+  await removeMutationProjectFile14(input, root, source);
+  await assertAncestors(after, 'ENTROROVE_FILE_CHANGED');
+}

package/local-mutation-snapshot.mjs

@@ -3,6 +3,7 @@ import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { canonical, sha256, snapshotHandoffBinding, verifySnapshotManifest } from './local-integrity.mjs';
 import { budgetBindingForRead } from './local-budget-reads.mjs';
+import { captureDisciplineSnapshot, snapshotDisciplineBinding } from './local-discipline-snapshot.mjs';
 import { atomicMutationJson14, cleanupMutationDirectory14, mutationFail14, mutationId14, mutationPaths14,
   mutationPath14, mutationRead14, mutationRoot14, mutationStateRoot14, mutationTarget14, privateMutationDirectory14,
   readMutationJson14, writeMutationFile14 } from './local-mutation-files.mjs';
@@ -26,7 +27,7 @@ function handoffBinding(value) {
 function receiptCore(receipt) {
   return { schemaVersion: RECEIPT_SCHEMA, snapshotId: receipt.snapshotId, flowId: receipt.flowId, stepId: receipt.stepId,
     repositoryDigest: receipt.repositoryDigest, snapshotDigest: receipt.snapshotDigest, contractDigest: receipt.contractDigest ?? null,
-    paths: receipt.paths, fileManifestDigest: receipt.fileManifestDigest, ...handoffBinding(receipt), ...layoutBinding(receipt) };
+    paths: receipt.paths, fileManifestDigest: receipt.fileManifestDigest, ...handoffBinding(receipt), ...layoutBinding(receipt), ...snapshotDisciplineBinding(receipt) };
 }
 export function loadSnapshotReceipt14(receipt) {
   if (!receipt || typeof receipt !== 'object' || Array.isArray(receipt) || receipt.schemaVersion !== RECEIPT_SCHEMA
@@ -161,7 +162,8 @@ export async function snapshotPlan14(input, { handoffBinding: binding = {} } = {
     await privateMutationDirectory14(path.join(loc.snapshotRoot, 'files'), { privateFrom: loc.stateRoot });
     const files = [];
     for (const relative of paths) files.push(await copySource(input, root, loc.snapshotRoot, relative, loc.stateRoot));
-    const core = { snapshotId, flowId, stepId, paths, files, contractDigest, ...handoff };
+    const discipline = await captureDisciplineSnapshot(input, root, loc, { snapshotId, flowId, stepId });
+    const core = { snapshotId, flowId, stepId, paths, files, contractDigest, ...handoff, ...discipline };
     const manifest = { schemaVersion: SNAPSHOT_SCHEMA, ...core, repositoryDigest: repoKey(root), copyLayout: COPY_LAYOUT,
       createdAt: new Date().toISOString(), snapshotDigest: sha256(canonical(core)) };
     await atomicMutationJson14(loc.manifestPath, manifest, { privateFrom: loc.stateRoot });
@@ -193,7 +195,8 @@ export async function snapshotAuthority14(input, root, value) {
   const manifest = checkManifest(await readMutationJson14(loc.manifestPath), root, receipt);
   if (manifest.snapshotDigest !== receipt.snapshotDigest || canonical(manifest.paths) !== canonical(receipt.paths)
     || manifest.contractDigest !== receipt.contractDigest || canonical(handoffBinding(manifest)) !== canonical(handoffBinding(receipt))
-    || canonical(layoutBinding(manifest)) !== canonical(layoutBinding(receipt))) mutationFail14('ENTROROVE_SNAPSHOT_BINDING', 'snapshot receipt does not match its manifest or layout');
+    || canonical(layoutBinding(manifest)) !== canonical(layoutBinding(receipt))
+    || canonical(snapshotDisciplineBinding(manifest)) !== canonical(snapshotDisciplineBinding(receipt))) mutationFail14('ENTROROVE_SNAPSHOT_BINDING', 'snapshot receipt does not match its manifest or layout');
   const files = await copyFacts(input, loc.snapshotRoot, manifest);
   if (receipt.fileManifestDigest !== sha256(canonical(files))) mutationFail14('ENTROROVE_SNAPSHOT_BINDING', 'snapshot receipt file manifest digest is invalid');
   return { manifest, manifestPath: loc.manifestPath, snapshotRoot: loc.snapshotRoot, copyRoot: copyRoot(loc.snapshotRoot, manifest) };

package/local-mutation-wire.mjs

@@ -2,6 +2,8 @@ import { createPublicKey, verify } from 'node:crypto';
 import { canonical, sha256 } from './local-integrity.mjs';
 import { canonicalHandoffSignature } from './local-task-handoff-overlay-wire.mjs';
 import { mutationFail14, mutationPaths14 } from './local-mutation-files.mjs';
+import { disciplineApprovedPolicy } from './local-discipline-contracts.mjs';
+import { validatorParallelDeclarationsValid } from './runtime/validator-runtime-v7.0.44.mjs';
 
 export const MUTATION_IDENTITY_FIELDS14 = ['flowId', 'taskId', 'ownerId', 'taskDigest', 'chainDigest', 'chainRevision',
   'acceptanceReceiptId', 'acceptanceDigest', 'routeDigest', 'receiver', 'receiverDigest', 'stepId', 'leaseId', 'leaseDigest',
@@ -80,7 +82,10 @@ export function mutationChallenge14(value, options) {
   return authority(value, CHALLENGE_FIELDS, 'entrorove.mutation-snapshot-challenge/1.0', options);
 }
 export function mutationPass14(value, options) {
-  const pass = authority(value, PASS_FIELDS, 'entrorove.mutation-pass/1.0', options);
+  const fields = [...PASS_FIELDS, ...['disciplinePolicy', 'parallelPaths'].filter(key => Object.hasOwn(value ?? {}, key))];
+  const pass = authority(value, fields, 'entrorove.mutation-pass/1.0', options);
+  if (pass.disciplinePolicy) disciplineApprovedPolicy(pass.disciplinePolicy);
+  if (pass.parallelPaths && !validatorParallelDeclarationsValid(pass.parallelPaths)) mutationFail14('ENTROROVE_MUTATION_AUTHORITY_INVALID', 'Parallel paths must match the frozen equivalence contract');
   if (!ID.test(pass.passId) || !ID.test(pass.challengeNonce) || pass.handoffEpoch !== pass.epoch || pass.coordinationRequired !== false
     || ['challengeDigest', 'snapshotDigest', 'snapshotReceiptDigest', 'snapshotManifestDigest', 'attestationDigest'].some(field => !SHA.test(pass[field]))) {
     mutationFail14('ENTROROVE_MUTATION_AUTHORITY_INVALID', 'Mutation pass has invalid snapshot or original epoch bindings');

package/local-runner-discipline.mjs

@@ -0,0 +1,23 @@
+import { canonical, sha256 } from './local-integrity.mjs';
+import { disciplineRepositoryObservation, disciplineRepositoryDifferences } from './local-discipline-repository.mjs';
+import { atomicMutationJson14, privateMutationDirectory14, mutationStateRoot14 } from './local-mutation-files.mjs';
+import path from 'node:path';
+
+export async function runnerDisciplineBefore(input, authority) {
+  if (!authority.plan.policy.discipline) return null;
+  const original = await disciplineRepositoryObservation(input, authority.root);
+  return { input, original: original.comparison };
+}
+export async function runnerDisciplineAfter(before, authority) {
+  if (!before) return null;
+  const after = (await disciplineRepositoryObservation(before.input, authority.root)).comparison;
+  const changed = disciplineRepositoryDifferences(before.original, after);
+  const report = { schemaVersion: 'entrorove.discipline-runner-diff/1.0', planId: authority.plan.planId,
+    comparisonScope: after.scope, originalManifestDigest: sha256(canonical(before.original)), actualManifestDigest: sha256(canonical(after)),
+    changedCount: changed.length, changedPaths: changed.slice(0, 256), gates: { repositoryUnchanged: changed.length === 0 } };
+  const reportDigest = sha256(canonical(report)), state = await mutationStateRoot14(before.input);
+  const directory = await privateMutationDirectory14(path.join(state, 'discipline-reports'));
+  await atomicMutationJson14(path.join(directory.target, `${reportDigest}.json`), { ...report, reportDigest,
+    original: before.original, actual: after }, { replace: true });
+  return { ...report, reportDigest };
+}

package/local-scope-repository.mjs

@@ -260,6 +260,22 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
   return { nodes, edges: edges.sort((a, b) => `${a.from}:${a.specifier}`.localeCompare(`${b.from}:${b.specifier}`)),
     dynamic, complete: !dynamic, dynamicSources: dynamicSources.sort((a, b) => a.path.localeCompare(b.path)), workspaceMetadata };
 }
+export async function scopeCandidateImports(root, file, input = { repositoryRoot: root }) {
+  const parsed = importSpecifiers(Buffer.from(file.content), file.path);
+  const workspace = await workspaceIndex(root, input);
+  const context = (input.importContexts ?? []).filter(item => file.path === item.sourcePrefix || file.path.startsWith(`${item.sourcePrefix}/`))
+    .sort((a, b) => b.sourcePrefix.length - a.sourcePrefix.length)[0];
+  const aliases = await scopeTsconfigImports(async relative => {
+    const read = await scopeRead(root, relative, input);
+    return { path: relative, sha256: read.sha256, contentBase64: read.content.toString('base64') };
+  }, file.path, context?.configPath);
+  const declarations = declarationModules(Buffer.from(file.content), file.path), edges = [];
+  for (const specifier of parsed.specifiers) {
+    const target = await resolveImport(root, file.path, specifier, workspace, input, aliases, context?.configPath, declarations);
+    edges.push({ from: file.path, to: target, external: target === null, specifier });
+  }
+  return { edges, dynamic: parsed.dynamic };
+}
 export async function collectScopeFacts(root, requested, baselineRef, knownFiles = [], input = { repositoryRoot: root }) {
   const selected = await scopeFiles(root, requested, knownFiles); const files = [];
   for (const relative of selected) {

package/local-task-handoff-write-receipts.mjs

@@ -6,6 +6,9 @@ import { receiverClaim } from './local-task-handoff-overlay-wire.mjs';
 import { checkHandoffWriteConstraints } from './local-task-handoff-write-constraints.mjs';
 import { verifyHandoffWriteArchive, verifyTaskHandoffWriteArchives } from './local-task-handoff-write-archive.mjs';
 import { handoffWriteFail as fail, writeReceiptIdentity, verifyWriteReceipt, verifyWriteNativeResult, assertWriteReceiptFields } from './local-task-handoff-write-wire.mjs';
+import { disciplineWritePreflight } from './local-discipline-gate.mjs';
+import { readDisciplineSnapshot } from './local-discipline-snapshot.mjs';
+import { assertDisciplineRepository } from './local-discipline-repository.mjs';
 
 function sourceReadContext(ctx) { return Object.freeze({ home: ctx.home, repositoryRoot: ctx.root, flowId: ctx.flowId }); }
 async function fileObservation(ctx, relative) {
@@ -50,6 +53,11 @@ export async function runHandoffTrustedWrite({ input, context: ctx, state, persi
   const key = await loadTaskHandoffSigner(ctx, process.env.ENTROROVE_TASK_HANDOFF_WRITE_SIGNER_CONFIG, pass.runnerKeyId);
   const content = typeof input.content === 'string' ? input.content : JSON.stringify(input.content);
   if (typeof content !== 'string') fail('actual proposed content must be text or JSON');
+  const snapshot = { manifest, snapshotRoot: snapshotDirectory };
+  const writes = Object.fromEntries([...verified.files].filter(([name, file]) => file.exists
+    && manifest.files.find(original => original.path === name)?.sha256 !== file.sha256).map(([name, file]) =>
+    [name, { status: 'written', contentDigest: file.sha256, mode: manifest.files.find(original => original.path === name)?.mode ?? 0o644 }]));
+  await disciplineWritePreflight(input, { pass, snapshot, binding: { root: ctx.root }, ledger: { writes }, target: input.targetPath }, content);
   const last = archive.receipts.at(-1), nonce = randomUUID();
   const pending = { blockId: `${pass.passId}:${nonce}`, path: input.targetPath, beforeSha256: actual.sha256,
     beforeExists: actual.exists, proposedAfterSha256: sha256(content), observedAt: new Date().toISOString(), nonce,
@@ -92,6 +100,9 @@ export async function runHandoffTrustedWrite({ input, context: ctx, state, persi
   const finalScope = new Map(verified.files); finalScope.set(input.targetPath, projected);
   await verifyActualScope(ctx, finalScope);
   const core = receiptCore(archive, ctx, pending, rejected ? 'blocked' : 'retained', after, result, key);
+  const review = await readDisciplineSnapshot(snapshot);
+  await assertDisciplineRepository(input, ctx.root, review, { writes: rejected ? writes : { ...writes,
+    [input.targetPath]: { status: 'written', contentDigest: after.sha256, mode: manifest.files.find(file => file.path === input.targetPath)?.mode ?? 0o644 } } });
   const receipt = { ...core, signature: sign(null, Buffer.from(canonical(core)), key.privateKey).toString('base64url') };
   await saveCompleted(state, ctx, persist, archive, receipt);
   if (rejected) throw rejected;

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.skill-manifest/1.0",
   "name": "entrorove",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "endpoint": "https://entrorove.com",
   "requestSchemaVersion": "entrorove.skill.request/2.0",
   "supportedRequestSchemaVersions": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"
@@ -43,6 +43,7 @@
     "local-mutation-batch.mjs",
     "local-mutation-batch-receipt.mjs",
     "local-integrity.mjs",
+    "local-integrity.d.mts",
     "local-evidence-verification.mjs",
     "local-error.mjs",
     "local-formula.mjs",
@@ -196,16 +197,45 @@
     "local-final-gate16-contract.mjs",
     "local-final-gate16-release.mjs",
     "native-client.mjs",
-    "native-notification.mjs"
+    "native-notification.mjs",
+    "ide-code-mode.mjs",
+    "ide-command.mjs",
+    "ide-hook.mjs",
+    "ide-install.mjs",
+    "ide-session.mjs",
+    "ide-results.mjs",
+    "ide-queue.mjs",
+    "local-discipline-actions.mjs",
+    "local-discipline-analysis.mjs",
+    "local-discipline-batch.mjs",
+    "local-discipline-contracts.mjs",
+    "local-discipline-gate.mjs",
+    "local-discipline-native.mjs",
+    "local-discipline-operations.mjs",
+    "local-discipline-repository.mjs",
+    "local-discipline-snapshot.mjs",
+    "local-equivalence-runner.mjs",
+    "local-runner-discipline.mjs",
+    "snapshot-retention.mjs",
+    "snapshot-cleanup-journal.mjs",
+    "validator-runtime-build.mjs",
+    "local-discipline-contracts.d.mts",
+    "runtime/validator-runtime-v7.0.44.mjs",
+    "runtime/validator-runtime-v7.0.44.d.mts",
+    "IDE-EXECUTION.md",
+    "REUSE-DISCIPLINE.md",
+    "reuse-discipline-release.mjs"
   ],
   "scripts": {
     "test": "node --test --test-concurrency=1 test/*.test.mjs",
     "prepublishOnly": "node release.mjs",
     "prepare:archguard": "node archguard-runtime-build.mjs",
     "check:archguard": "node archguard-runtime-build.mjs --check",
-    "prepack": "node archguard-runtime-build.mjs && node calctool-runtime-build.mjs",
+    "prepack": "node archguard-runtime-build.mjs && node calctool-runtime-build.mjs && node validator-runtime-build.mjs",
     "prepare:calctool": "node calctool-runtime-build.mjs",
-    "check:calctool": "node calctool-runtime-build.mjs --check"
+    "check:calctool": "node calctool-runtime-build.mjs --check",
+    "prepare:validator": "node validator-runtime-build.mjs",
+    "check:validator": "node validator-runtime-build.mjs --check"
   },
   "engines": {
     "node": ">=20"