@entrorove/skill 0.1.52 → 0.1.53

package/mutation-client.mjs

@@ -0,0 +1,290 @@
+import path from 'node:path';
+import { canonical, sha256 } from './local-integrity.mjs';
+import { withStateLock } from './local-state-lock.mjs';
+import { mutationId14, mutationPaths14, mutationTarget14, mutationFail14, privateMutationDirectory14,
+  readMutationJson14, atomicMutationJson14 } from './local-mutation-files.mjs';
+import { preparePreservedMutationSigner, preservedMutationLocation } from './local-preserved-mutation-signer.mjs';
+import { snapshotPlan14, snapshotVerify14 } from './local-mutation-snapshot.mjs';
+import { attestMutationSnapshot14 } from './local-mutation-binding.mjs';
+import { issueMutationPass14 } from './local-mutation-authority.mjs';
+import { readStoredMutationPass14 } from './local-mutation-pass-store.mjs';
+import { mutationChallenge14, mutationPass14 } from './local-mutation-wire.mjs';
+import { buildInvocation, invokeRemoteResult } from './remote-client.mjs';
+import { parseTransportResponse, requestTransport, trustedOrigin } from './remote-transport.mjs';
+import { acknowledgeAutomaticFeedback, verifyAutomaticFeedback, queryAutomaticFeedback } from './automatic-feedback-client.mjs';
+import { ideClientHeaders } from './ide-presentation.mjs';
+import { appendInvocation, readInvocations } from './local-invocations.mjs';
+import { bootstrapCloudMutationAuthority } from './cloud-mutation-authority.mjs';
+import { attestMutationConsumption14, preservedMutationConsumptionState } from './local-mutation-consumption.mjs';
+
+const schema = 'entrorove.mutation-connection-state/1.0';
+const fields = ['taskId', 'flowId', 'stepId', 'leaseId', 'generation', 'runnerId', 'paths'];
+const fail = message => mutationFail14('ENTROROVE_MUTATION_CONNECTION_BINDING', message);
+const unknown = requestId => Object.assign(new Error(`Mutation connection outcome is unknown; recover original requestId=${requestId} without repeating its POST`),
+  { outcomeUnknown: true, requestId });
+const notSent = requestId => Object.assign(new Error('Mutation operation was not transmitted; repair its local or discovery prerequisite and reuse the original input'),
+  { code: 'ENTROROVE_MUTATION_CONNECTION_NOT_SENT', requestId, knownBeforeTransmission: true });
+const save = (location, value) => atomicMutationJson14(location.file, value, { privateFrom: location.stateRoot, replace: true });
+function inputIdentity(input) {
+  if (!input || typeof input !== 'object' || Array.isArray(input)
+    || canonical(Object.keys(input).sort()) !== canonical([...fields, ...['previousPassId'].filter(field => Object.hasOwn(input, field))].sort())
+    || !Number.isSafeInteger(input.generation) || input.generation < 1) {
+    mutationFail14('ENTROROVE_MUTATION_CONNECTION_INPUT', 'Mutation connection requires its exact original task, flow, step, lease, generation, runner and existing paths');
+  }
+  for (const field of fields.filter(field => !['generation', 'paths'].includes(field))) mutationId14(input[field], field);
+  if (Object.hasOwn(input, 'previousPassId')) mutationId14(input.previousPassId, 'previousPassId');
+  return { ...input, paths: mutationPaths14(input.paths) };
+}
+async function readConnection(location, identity) {
+  let value;
+  try { value = await readMutationJson14(location.file); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; }
+  if (!value) return { schemaVersion: schema, identity };
+  if (value.schemaVersion !== schema || canonical(value.identity) !== canonical(identity)
+    || value.pending && (value.pending.requestId !== buildInvocation(value.pending.operation, value.pending.input).requestId
+      || !['mutation-snapshot-challenge', 'mutation-pass-issue', 'mutation-pass-settle'].includes(value.pending.operation))) {
+    fail('Mutation connection journal differs from the original repository, request or physical key');
+  }
+  return value;
+}
+async function recoverRemote(pending, dependencies) {
+  try {
+    const token = await dependencies.readCredential(dependencies.home), origin = trustedOrigin(dependencies.apiOrigin());
+    const response = await requestTransport(origin, `/api/skill/status/${pending.requestId}`, { headers: { authorization: `Bearer ${token}`, ...ideClientHeaders() } });
+    const result = await parseTransportResponse(response, 'original mutation connection status');
+    if (!response.ok || result?.output?.requestId !== pending.requestId || ['running', 'pending'].includes(result.output.status)) throw unknown(pending.requestId);
+    result.feedback ??= await queryAutomaticFeedback(pending.requestId, dependencies);
+    verifyAutomaticFeedback(result.feedback, pending.requestId, pending.requestId);
+    result.feedback = await acknowledgeAutomaticFeedback(result.feedback, origin, token, ideClientHeaders());
+    await appendInvocation({ kind: 'remote', operation: 'status', requestId: pending.requestId, event: 'status', usage: result.usage ?? [] }, dependencies.home);
+    return { response, result };
+  } catch { throw unknown(pending.requestId); }
+}
+async function knownNotSent(error, pending, home) {
+  if (error?.requestId && error.requestId !== pending.requestId || error?.retryableBeforeTransmission === true) return true;
+  try {
+    const records = (await readInvocations(home)).filter(value => value.kind === 'remote' && value.requestId === pending.requestId);
+    return !records.length || records.at(-1).event === 'not-sent';
+  } catch (cause) { return cause.code === 'ENOENT'; }
+}
+async function remote(stage, operation, input, state, location, dependencies) {
+  const requestId = buildInvocation(operation, input).requestId;
+  let response, result;
+  if (state.pending) {
+    if (state.pending.stage !== stage || state.pending.operation !== operation || canonical(state.pending.input) !== canonical(input)) {
+      fail('Recover the original mutation request before another operation or input');
+    }
+    ({ response, result } = await recoverRemote(state.pending, dependencies));
+  } else {
+    state.pending = { stage, operation, input, requestId };
+    try { await save(location, state); } catch { throw notSent(requestId); }
+    try { ({ response, result } = await invokeRemoteResult({ operation, input }, dependencies)); }
+    catch (error) {
+      if (await knownNotSent(error, state.pending, dependencies.home)) {
+        delete state.pending;
+        try { await save(location, state); } catch { throw notSent(requestId); }
+        throw notSent(requestId);
+      }
+      throw unknown(requestId);
+    }
+  }
+  delete state.pending;
+  if (!response.ok || !['succeeded', 'reported'].includes(result?.output?.status)) {
+    try { await save(location, state); } catch { throw unknown(requestId); }
+    throw Object.assign(new Error(result?.output?.message ?? `Mutation connection blocked at ${operation}`),
+      { code: result?.output?.code ?? 'ENTROROVE_MUTATION_CONNECTION_BLOCKED', output: result?.output, requestId });
+  }
+  state[stage] = result.output;
+  if (result.feedback) state.feedback = result.feedback;
+  try { await save(location, state); } catch { throw unknown(requestId); }
+  return result.output;
+}
+function challengeBinding(challenge, identity, mutator, options) {
+  mutationChallenge14(challenge, options);
+  if ([...fields, 'previousPassId'].some(field => canonical(challenge[field]) !== canonical(identity[field])) || challenge.repositoryDigest !== sha256(identity.repositoryRoot).slice(0, 32)
+    || challenge.newFilePaths.length || !challenge.writeDelegation
+    || challenge.writeDelegation.mutationKeyId !== mutator.mutationKeyId || challenge.writeDelegation.mutationPublicKey !== mutator.mutationPublicKey) {
+    fail('Mutation challenge must retain the original task, lease, physical repository, paths and separate M signer');
+  }
+}
+function passBinding(pass, challenge, attestation, options) {
+  mutationPass14(pass, options);
+  if (pass.challengeId !== challenge.challengeId || pass.challengeDigest !== sha256(canonical(challenge))
+    || pass.attestationDigest !== sha256(canonical(attestation)) || pass.snapshotDigest !== attestation.manifest.snapshotDigest
+    || [...fields, 'previousPassId'].some(field => canonical(pass[field]) !== canonical(challenge[field]))
+    || canonical(pass.writeDelegation) !== canonical(challenge.writeDelegation)) fail('Mutation pass differs from its original signed challenge or actual M snapshot');
+}
+async function snapshot(input, challenge, state, location) {
+  if (!state.planned) {
+    if (state.planStarted) {
+      const recovered = await snapshotVerify14(input);
+      state.planned = { snapshotId: recovered.receipt.snapshotId, snapshotDigest: recovered.receipt.snapshotDigest };
+    } else {
+      state.planStarted = true; await save(location, state);
+      try { state.planned = await snapshotPlan14({ ...input, paths: challenge.paths, contractDigest: challenge.scopeContractDigest }); }
+      catch (error) { delete state.planStarted; await save(location, state); throw error; }
+    }
+    await save(location, state);
+  }
+  const verified = await snapshotVerify14(input);
+  if (verified.verified !== true || verified.receipt.snapshotDigest !== state.planned.snapshotDigest
+    || canonical(verified.receipt.paths) !== canonical(challenge.paths) || verified.receipt.contractDigest !== challenge.scopeContractDigest) {
+    fail('Original mutation snapshot copies or paths failed their actual verification');
+  }
+  return verified;
+}
+async function authorizeCachedConnection(identity, pass, dependencies) {
+  const token = await dependencies.readCredential(dependencies.home), origin = trustedOrigin(dependencies.apiOrigin());
+  let response, status;
+  try {
+    response = await requestTransport(origin, `/api/skill/flows/${identity.flowId}/status`, {
+      headers: { authorization: `Bearer ${token}`, ...ideClientHeaders() },
+    });
+    status = await parseTransportResponse(response, 'original mutation flow status');
+  } catch {
+    mutationFail14('ENTROROVE_MUTATION_CONNECTION_AUTHORIZATION', 'Current account could not confirm the original active mutation flow');
+  }
+  if (!response.ok || status?.schemaVersion !== 'entrorove.flow-status/1.0' || status.flow?.flowId !== identity.flowId
+    || status.flow.ownerId !== pass.ownerId || status.flow.stepId !== identity.stepId || status.flow.status !== 'running'
+    || !['execute', 'merge', 'deliver'].includes(status.workflow?.phase) || status.workflow.terminalAt
+    || ['pending', 'declined'].includes(status.workflow.authorization)) {
+    mutationFail14('ENTROROVE_MUTATION_CONNECTION_AUTHORIZATION', 'Current account must retain the original owned active flow and business step');
+  }
+}
+async function connect(identity, local, mutator, location, dependencies) {
+  const state = await readConnection(location, identity);
+  const challenged = state.challenged ?? await remote('challenged', 'mutation-snapshot-challenge',
+    { ...Object.fromEntries(fields.map(field => [field, identity[field]])),
+      ...(identity.previousPassId ? { previousPassId: identity.previousPassId } : {}), mutationPublicKey: mutator.mutationPublicKey }, state, location, dependencies);
+  const challenge = challenged.challenge;
+  challengeBinding(challenge, identity, mutator, { live: !state.gatePassPath });
+  const input = { ...local, snapshotId: challenge.snapshotId };
+  if (state.gatePassPath) {
+    passBinding(state.issued.pass, challenge, state.attestation, { live: false });
+    const stored = await readStoredMutationPass14({ ...input, gatePassPath: state.gatePassPath }, { live: false });
+    if (canonical(stored) !== canonical(state.issued.pass)) fail('Installed mutation pass differs from its original connection');
+    await authorizeCachedConnection(identity, stored, dependencies);
+    const consumption = await preservedMutationConsumptionState({ ...input, gatePassPath: state.gatePassPath });
+    if (consumption.complete) return { schemaVersion: 'entrorove.mutation-connection/1.0', status: 'blocked', flowId: identity.flowId,
+      code: 'ENTROROVE_MUTATION_SETTLEMENT_REQUIRED', gatePassPath: state.gatePassPath,
+      message: 'Original physical writes are consumed; settle their actual M receipt with fresh S evidence before requesting the next restricted pass',
+      localAction: { command: 'npx @entrorove/skill mutation-settle <absolute repositoryRoot>',
+        input: { taskId: stored.taskId, flowId: stored.flowId, stepId: stored.stepId, gatePassPath: state.gatePassPath } } };
+    passBinding(state.issued.pass, challenge, state.attestation);
+    return connected(identity, state);
+  }
+  await snapshot(input, challenge, state, location);
+  if (!state.attestation) {
+    const observed = await attestMutationSnapshot14({ ...input, challenge, signerConfigPath: mutator.signerConfigPath });
+    if (observed.verified !== true || observed.attestation.keyId !== mutator.mutationKeyId) fail('Actual mutation snapshot was not signed by its separate M key');
+    state.attestation = observed.attestation; await save(location, state);
+  }
+  const issued = state.issued ?? await remote('issued', 'mutation-pass-issue',
+    { challengeId: challenge.challengeId, attestation: state.attestation }, state, location, dependencies);
+  passBinding(issued.pass, challenge, state.attestation);
+  await authorizeCachedConnection(identity, issued.pass, dependencies);
+  const installed = await issueMutationPass14({ ...input, mutationPass: issued.pass });
+  if (canonical(installed.pass) !== canonical(issued.pass) || typeof installed.gatePassPath !== 'string') fail('Mutation gate did not install its exact original server pass');
+  state.gatePassPath = installed.gatePassPath; await save(location, state);
+  return connected(identity, state);
+}
+function connected(identity, state) {
+  return { schemaVersion: 'entrorove.mutation-connection/1.0', status: 'succeeded', taskId: identity.taskId,
+    flowId: identity.flowId, stepId: identity.stepId, gatePassPath: state.gatePassPath, pass: state.issued.pass,
+    purpose: 'preserved-existing-modify', grantsExecutionAuthority: false, grantsValidatorAuthority: false,
+    ...(state.feedback ? { feedback: state.feedback } : {}) };
+}
+export async function connectMutation(repositoryRoot, input, dependencies) {
+  const original = inputIdentity(input);
+  const local = { repositoryRoot, home: dependencies.home, taskId: original.taskId, flowId: original.flowId, stepId: original.stepId };
+  const location = await preservedMutationLocation(local);
+  local.repositoryRoot = location.root;
+  for (const relative of original.paths) {
+    const target = await mutationTarget14(location.root, relative, true);
+    if (!target.exists || !target.stat.isFile()) fail('Mutation connection permits only concrete existing files');
+  }
+  await bootstrapCloudMutationAuthority(dependencies);
+  const mutator = await preparePreservedMutationSigner(local);
+  const identity = { ...original, repositoryRoot: location.root, apiOrigin: trustedOrigin(dependencies.apiOrigin()), mutationKeyId: mutator.mutationKeyId };
+  const directory = path.join(location.directory, 'connections'); await privateMutationDirectory14(directory, { privateFrom: location.stateRoot });
+  const file = path.join(directory, `${sha256(canonical(identity))}.json`), journal = { ...location, file };
+  return withStateLock(file, () => connect(identity, local, mutator, journal, dependencies));
+}
+function settlementBinding(output, pass, receipt, expectedSettlementId) {
+  if (output?.settled !== true || typeof output.settlementId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(output.settlementId)
+    || expectedSettlementId !== undefined && output.settlementId !== expectedSettlementId
+    || output.passId !== pass.passId || output.consumptionReceiptDigest !== sha256(canonical(receipt))
+    || output.claimsVerifiedExecution !== false || output.claimsCompletion !== false) fail('Mutation settlement must preserve its original actual M receipt without claiming independent validation or completion');
+}
+async function settleMutation(repositoryRoot, input, dependencies) {
+  const required = ['flowId', 'stepId', 'gatePassPath'], optional = ['taskId'].filter(field => Object.hasOwn(input ?? {}, field));
+  if (!input || canonical(Object.keys(input).sort()) !== canonical([...required, ...optional].sort())
+    || !path.isAbsolute(input.gatePassPath ?? '')) fail('Mutation settlement requires the exact original stored pass and task step');
+  for (const field of ['flowId', 'stepId', ...optional]) mutationId14(input[field], field);
+  await bootstrapCloudMutationAuthority(dependencies);
+  const local = { ...input, repositoryRoot, home: dependencies.home }, original = await preservedMutationConsumptionState(local);
+  const { pass, binding } = original;
+  await authorizeCachedConnection({ flowId: pass.flowId, stepId: pass.stepId }, pass, dependencies);
+  const directory = path.join(binding.directory, 'settlements'); await privateMutationDirectory14(directory, { privateFrom: binding.stateRoot });
+  const location = { ...binding, file: path.join(directory, `${pass.passId}.json`) };
+  const identity = { flowId: pass.flowId, stepId: pass.stepId, passDigest: sha256(canonical(pass)),
+    repositoryRoot: binding.root, apiOrigin: trustedOrigin(dependencies.apiOrigin()), mutationKeyId: binding.binding.keyId };
+  return withStateLock(location.file, async () => {
+    const state = await readConnection(location, identity);
+    if (!state.settled && !state.pending && (!state.consumptionReceipt || state.rejection?.effects === 'none'
+      && state.rejection.code === 'ENTROROVE_MUTATION_CONSUMPTION_EXPIRED')) {
+      const observed = await attestMutationConsumption14(local, { allowExpiredReplay: true, renewExpired: state.rejection?.effects === 'none'
+        && state.rejection.code === 'ENTROROVE_MUTATION_CONSUMPTION_EXPIRED' });
+      state.consumptionReceipt = observed.consumptionReceipt; delete state.rejection; await save(location, state);
+    }
+    if (!state.consumptionReceipt) fail('Original mutation settlement receipt is missing; recover its original request without signing another');
+    let output = state.settled;
+    if (!output) {
+      try { output = await remote('settled', 'mutation-pass-settle', { passId: pass.passId, consumptionReceipt: state.consumptionReceipt }, state, location, dependencies); }
+      catch (error) {
+        if (error.output?.effects === 'none') { state.rejection = { effects: 'none', code: error.output.code }; await save(location, state); }
+        throw error;
+      }
+    }
+    settlementBinding(output, pass, state.consumptionReceipt, state.settlementId);
+    if (state.settlementId === undefined) { state.settlementId = output.settlementId; await save(location, state); }
+    return { schemaVersion: 'entrorove.mutation-settlement/1.0', status: 'reported', settled: true,
+      flowId: pass.flowId, taskId: pass.taskId, passId: pass.passId, settlementId: output.settlementId,
+      consumptionReceiptDigest: output.consumptionReceiptDigest,
+      claimsVerifiedExecution: false, claimsCompletion: false, ...(state.feedback ? { feedback: state.feedback } : {}),
+      observationAction: { command: 'npx @entrorove/skill workflow-observe-step <absolute repositoryRoot>', independentValidation: 'pending',
+        input: { taskId: pass.taskId, flowId: pass.flowId, stepId: pass.stepId, leaseId: pass.leaseId,
+          generation: pass.generation, settlementId: output.settlementId } },
+      localAction: { command: 'npx @entrorove/skill mutation-connect <absolute repositoryRoot>',
+        input: { ...Object.fromEntries(fields.map(field => [field, pass[field]])), previousPassId: pass.passId } } };
+  });
+}
+async function runMutationClient(operation, repositoryRoot, input, dependencies, work) {
+  let preflight = true;
+  try {
+    await dependencies.install();
+    if (!await dependencies.agreementAccepted(dependencies.home)) return dependencies.agreementRequired(dependencies.home);
+    preflight = false;
+    return await work(repositoryRoot, input, dependencies);
+  }
+  catch (error) {
+    const requestId = /^[a-f0-9]{64}$/.test(error?.requestId ?? '') ? error.requestId : undefined;
+    if (error?.outcomeUnknown === true && requestId) return {
+      schemaVersion: 'entrorove.mutation-connection/1.0', status: 'blocked', flowId: input?.flowId, requestId,
+      code: 'ENTROROVE_MUTATION_CONNECTION_OUTCOME_UNKNOWN', outcomeUnknown: true, recoverable: true,
+      message: `Original mutation request outcome is unknown; rerun ${operation} with the same input to recover only its original GET, without repeating its POST`,
+      nextAction: { operation, requestId, method: 'GET', reuseOriginalInput: true, repeatPost: false },
+    };
+    const typed = typeof error?.code === 'string' && error.code.startsWith('ENTROROVE_');
+    const knownBeforeTransmission = preflight || error?.knownBeforeTransmission === true;
+    return { schemaVersion: 'entrorove.mutation-connection/1.0', status: 'blocked', flowId: input?.flowId,
+      code: typed ? error.code : 'ENTROROVE_MUTATION_CONNECTION_LOCAL_PREREQUISITE',
+      message: typed ? error.message : 'Mutation connection stopped at a local prerequisite; preserve its journal and repair before reusing the original input',
+      ...(requestId ? { requestId } : {}), ...(knownBeforeTransmission ? { knownBeforeTransmission: true } : {}),
+      recovery: { operation, reuseOriginalInput: true, preserveJournal: true,
+        ...(knownBeforeTransmission ? { remoteAttemptedThisRun: false } : {}) },
+      ...(error?.output ? { output: error.output } : {}) };
+  }
+}
+export const runMutationConnect = (repositoryRoot, input, dependencies) => runMutationClient('mutation-connect', repositoryRoot, input, dependencies, connectMutation);
+export const runMutationSettle = (repositoryRoot, input, dependencies) => runMutationClient('mutation-settle', repositoryRoot, input, dependencies, settleMutation);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.52",
+  "version": "0.1.53",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"
@@ -38,6 +38,13 @@
     "local-mutation-snapshot.mjs",
     "local-mutation-audit.mjs",
     "local-mutation-wire.mjs",
+    "local-preserved-mutation-protection.mjs",
+    "local-preserved-mutation-signer.mjs",
+    "local-preserved-mutation-state.mjs",
+    "local-preserved-mutation-wire.mjs",
+    "local-delegated-modify-analysis.mjs",
+    "mutation-client.mjs",
+    "cloud-mutation-authority.mjs",
     "local-mutation-binding.mjs",
     "local-mutation-pass-store.mjs",
     "local-mutation-authority.mjs",
@@ -232,7 +239,17 @@
     "IDE-EXECUTION.md",
     "REUSE-DISCIPLINE.md",
     "DELIVERY-BOUNDARIES.md",
-    "reuse-discipline-release.mjs"
+    "reuse-discipline-release.mjs",
+    "connected-cli.mjs",
+    "local-approved-process.mjs",
+    "local-approved-supervisor.mjs",
+    "local-mutation-consumption.mjs",
+    "workflow-observation-client.mjs",
+    "workflow-observation-connection.mjs",
+    "workflow-observation-remote.mjs",
+    "workflow-observation-runner.mjs",
+    "workflow-observation-state.mjs",
+    "workflow-observation-wire.mjs"
   ],
   "scripts": {
     "test": "node test/run.mjs",

package/release-state.json

@@ -1,24 +1,41 @@
 {
   "schemaVersion": "entrorove.release-state/1.0",
-  "version": "0.1.52",
-  "digest": "81fb53f113036a9ffdaa64ac99f3f9c0cc4180c623997ee009d4bc63e58a9ab8",
+  "version": "0.1.53",
+  "digest": "3508e9d78536c07403711408fe6dc6d71d137820f34d3d164c4b5898be923df5",
   "files": {
+    "connected-cli.mjs": "260c0fc99586c24bd4d0351a14e0744849a612ebe6f1bd7951e4fce200daf920",
+    "local-approved-process.mjs": "442856df788e63f38757439ba0657d1c689aaf797631a955fae3dd639e844e6d",
+    "local-approved-supervisor.mjs": "87142a4c13d27c8265cc1fd7fc9088988da9bbb02134164e1a7c5417da926ac7",
+    "local-mutation-consumption.mjs": "cd8650b9be894639ceb35af88d23c8002b4acff27afad2e64174eb21a9424cfb",
+    "workflow-observation-client.mjs": "5e67bc32a8625de9523498f694655c378ae34af59c4aa2f0e07efcd72347dbc0",
+    "workflow-observation-connection.mjs": "9235e9247b11e1d51628c1784eb1cb1e8e4b79d25ff791883722592dcf8583c0",
+    "workflow-observation-remote.mjs": "1e5a8b9c2b9b095242ad28a1d5ebce5944efdae74383fb20d6676b93b240c5a7",
+    "workflow-observation-runner.mjs": "3eb8280ec7abffcb30398e3f4e5f7d0ec3df4385fa720f188ed83757b87cd977",
+    "workflow-observation-state.mjs": "a525046df9b3de75b10d2bf35c2b6d7719f12a647e4aee1f1e85dbdbfb167321",
+    "workflow-observation-wire.mjs": "846d0b48b7799bfca227e30faea025a5a919896538f963ce886cbdb4c75c0253",
+    "local-preserved-mutation-protection.mjs": "95041d4f75253a153c7fd85573ba0457513ffe47a6a6bd00c4f59379b81ce580",
+    "local-preserved-mutation-signer.mjs": "2b0771cbdd18ba00267aa441b7892cd04feab9f8543ae5e2703430b1e580747f",
+    "local-preserved-mutation-state.mjs": "1ff7939d668e39ec641a7cf46a4ce3014c63f3898207cc874f21170376479671",
+    "local-preserved-mutation-wire.mjs": "d302bd4b115338c0d1bf69718ce2596dbceb595431ff3f57b998ea67d94cb34c",
+    "local-delegated-modify-analysis.mjs": "f87148ddb023b79e241ca97db582991da8d0e1a51b26b1d9bc2799a76efd7297",
+    "mutation-client.mjs": "8d27b267dc660510aa1406c44d4005e44b972a1260f90657de4fa0e75b7b6c3e",
+    "cloud-mutation-authority.mjs": "c7226e882a4f3be4d2f55728f515d5a815c0aa1f21aa5e4689314e6e6a8c66a2",
     "ide-code-mode.mjs": "f3f53357ba09727b3b597851976a24de93287c0faca5052448277d0904bb61f7",
-    "ide-command.mjs": "86472c2f89c17e13a6fb0e41794add983400aac3e626891dbb3812e34320e229",
-    "ide-hook.mjs": "2f00e56de1e1149f117714d5dd334196f1a3f206c3bfab541393bc0f625e0108",
+    "ide-command.mjs": "f2fe57312f83a11b318f1c98db51a6a47a7ff45b53f392acce32e458976bd06c",
+    "ide-hook.mjs": "be328cc646ea6ec5dc18e5458dd1f829897cc386d74bda0b56cbd14f53c98827",
     "ide-install.mjs": "10247efadcfeef5da001022d12080bd0f789e67fdf7862bcc65db73dda3bbe57",
-    "ide-session.mjs": "dc256e77b03303932d354768c0e79384340a3137e7421b4ae9c869f7e58e1a3a",
+    "ide-session.mjs": "453b9510ab825c2927a4fae8250ee8a8eb5ac10b23cf024af84a7c5916ba53dd",
     "break-glass.mjs": "6ec9f97c5d68bb33121b2374c06b9d4c8eb3419b52d00849fec7124bc63e4582",
-    "ide-results.mjs": "dfe0d3f773c65a9fc21056538d7005012c982ed4509bc0410d7f62813d0863fd",
+    "ide-results.mjs": "7ed5caf8e77cf42ae6d62cc1ed42b1639bca6069d809b90a399bec5192fb903e",
     "ide-queue.mjs": "806e716c775fd0079417027b135977c8516f47dddb0bc5ca19e32a355dab0e9e",
-    "local-discipline-actions.mjs": "2379c08d0f49c44068f8239db7e514d75885f4606b1b88a7a36e4ff19167caca",
+    "local-discipline-actions.mjs": "418c220b8c8ef59cb8092b6eb680bb75a93b9fad1a09412b1efa98a78afff11b",
     "local-discipline-analysis.mjs": "e887abdd1c6d6ba59ef7323e9035528f0491e5458ca8159985ec26e1ca67a4af",
     "local-discipline-batch.mjs": "2cc90dbae55efdee0c445da399c0a9acafa92e915344c25208ebca554fc4c9e9",
     "local-typescript-function-reference.mjs": "af682b479fe0d69a5ecd62232406bb8078408ec8710733cfed9ae6b059762ba5",
     "local-scope-import-expressions.mjs": "6623dea5501c4dc24e12c99e0776d65650bbe752c85c9509d022ba1f61bd5111",
     "local-discipline-contracts.mjs": "6cf8a3d132fdb9074eb1441600afe7aa199df33e88a71a660d9db534c14f19e4",
     "local-discipline-contracts.d.mts": "defc684c78dc88afa1c54340ab4a01ae36db7aa11257cbe1f5cd323f608c78c4",
-    "local-discipline-gate.mjs": "04b1ba092d7f4342a0e77cfbeb44d9634dbce9fec0c79e6a1e4b11a662d904ac",
+    "local-discipline-gate.mjs": "e3851157bf1d8bc86eb44212a88acd20acfc2d1152e7d87af6dc2a37afffcd6f",
     "local-discipline-native.mjs": "8b99b5ce951cab3c1426428ad807650c61c0ffb2c346d747b73b99057b382049",
     "local-discipline-operations.mjs": "9fcb7b8889b7718d42e1d37936485d8198d5017d405e0cdbbabdbbd12fcc9d48",
     "local-discipline-repository.mjs": "b6392e02ecae333dfdc8df41f203fd69bed035d88b15b16d112ab1897b3c297c",
@@ -31,7 +48,7 @@
     "runtime/validator-runtime-v7.0.44.d.mts": "7797edbfe2f7de24da370204dce4dfd22822a1bd80df93514fff900b98afe36f",
     "snapshot-retention.mjs": "4f8919fe8ec49fb4c23e080a8ad2fa3a9282bca3fffe7cf55c64e89ef316697e",
     "snapshot-cleanup-journal.mjs": "76a9684cc95b4eb076e1298d78a9dff37948b00d9607b8f546c599072d3ed331",
-    "IDE-EXECUTION.md": "2cb952bb919261e9e420c9d83659eba013e5b1b175d80da03b50b660edfe4f31",
+    "IDE-EXECUTION.md": "fe8ff87dde885832b34a369985f02b567efa096ed1c1e79a0e490280c8540bf5",
     "REUSE-DISCIPLINE.md": "5b214cf313e7f715f52d54e28093a2d038f0f196ca64b15d1c49587b9d8eecf8",
     "reuse-discipline-release.mjs": "2935898d1aa807fb982a78d7ab5cb1abe05e3c8fc945dc0909da8098872aa1ac",
     "local-final-gate16.mjs": "083aec470670e6cdb7ad2ab27b7a51b53a9ec3a8b4121cb9cbfa17d9940892c2",
@@ -75,25 +92,25 @@
     "local-autocoord17-waits.mjs": "2b0a713987822548a94e1ed3a9a891532db45383797dfc5d5bc8d1e35593cf25",
     "local-validator-isolation17.mjs": "48e94604e28b8fddd567dfb35ff60b73fd094a5803bd49f076388b7f310f92aa",
     "local-calctool-composition17.mjs": "ac89fcb41ab0d0d9b47c1b5696945281b0894eb064820775e36a011c76314e6a",
-    "cli.mjs": "2f1fa353a80000ed26061feeb44a6a4ad12e32a2f49c84bfbb6c54f89f519b7b",
+    "cli.mjs": "74b72be1190c4ff79279a8b911a85cc654ea860574691eb79eefb5fbab4a6fbe",
     "install-cleanup.mjs": "8a8e1a7dfe37427f86cd4d6e317890d0829894a9949d4216674a716b36edbc54",
     "review-client.mjs": "3491eef68ed533174b31db3c53febb6519b8f088f71a9964644714a9a4c03c77",
     "version.mjs": "1f392147d72c40af4b03b307ea607075fb815af5174fa07e254b95fe12dbf3e7",
-    "SKILL.md": "0d581e76d8c959ae04e091e24df5580e56d9ec9b6c1c6fa25a531a21e8b88ea4",
-    "CAPABILITY-MAP.md": "a0f0468a098725ced52a96dd8e22bfc7d1ce7681a8446ebf7dae3696c76c3385",
+    "SKILL.md": "d21f5085c0a5f830d5fd8b65e3a9da1e6d15512db69a4a8daab3e94fb8738f0b",
+    "CAPABILITY-MAP.md": "69b2c49b111d651969dea7430f4df7950d8fdf2f0f151d8386fa04968b872ac0",
     "AGREEMENT.md": "f93a68e92c457200dd024610e65f74e478b8f60860f951da818b70561f1b9bf8",
-    "DELIVERY-BOUNDARIES.md": "d1bb2895e23fc14bf1c76707bd1f6f03b39695501a78a0b7289dc37b099889dc",
-    "package.json": "d385aa543bff1f373a1fb8464c712c4ea04e1b2938a8603ddecca903161cbac3",
+    "DELIVERY-BOUNDARIES.md": "9b9db50ed1bcce9e77ff6527b6bb7eaf12f3b913162ea9cb7fe90db06b393a4f",
+    "package.json": "6a0566be47288eba3fb8b327e19d50df62f47a90e101ff952b49cedd951c04b7",
     "manifest.json": "ab06e307795bc9da5add926752b6c4dbdaf18625090261a035aa356a679c504f",
-    "release.mjs": "e206cb6cabbb02542317bce283f7ba674621e67765a3eacef5741f2d6b1c58b2",
-    "local-cli.mjs": "11461e4cf4f6a8612ff275bf8296ec57ff22281156cb2c72834d3c764ba422a1",
+    "release.mjs": "6292dd8a4ef82c5674f4aa80a8e70059f378162162b83aae750fa55697ba90d3",
+    "local-cli.mjs": "41e2a737c8587cb5ce469a7661f6d14b5ea4cd073f8286822fc4dc96b67f56a1",
     "local-state-lock.mjs": "1dbf64264642a0851faf043e07ee9f66d2ad0508e9f799b0626246e42fae893e",
-    "local-execution.mjs": "46fddd78cd954fb080c660affe90cdaa716695580427336acb820089441a8025",
+    "local-execution.mjs": "185f34e917440a360b3c4bafd3af245243807d964ae3820b3cffaaa2e6348cc6",
     "local-integrity.mjs": "e6d6eace80c610f3c7299d4f8644b0dc023aa9e3d8d64b26535ea7fbced248f1",
     "local-evidence-verification.mjs": "9b7dea31777505272f63616fd62af7603338f703bb1285fc565d6451715c7ce0",
     "local-formula.mjs": "706d5ec0cb2caf95a547531a81ca746fe246d4c53d902e03595a3b360e8c85af",
     "local-ledger.mjs": "2009fb68aadcd7292b72f1d0d99f378d03644be1c5b4b4150d9f6a0b3f7c15ce",
-    "local-error.mjs": "12a4aa19fe5d57218d78c8fecb0685dd02f99155999cbbfba8da8950047638f9",
+    "local-error.mjs": "f01213b21d84402dc5257aaa3ae4a5fa78931a956e9b8526b1e7dbf1b20b6b5d",
     "blueprint-criterion-wire.mjs": "fb6b7dcce0b97a699e3e8968372767a3fddd83fedc750998573f789177243072",
     "blueprint-criterion-runner.mjs": "761c0e670b4b20c6bed53e5ca5d0178759505c3977ea2ed1b7223383c534bc4c",
     "local-chain-bindings.mjs": "b8eff999ccd17b53c614a3c9f5376da78fcaa8632bb3e07bc1adcceda2e75f6c",
@@ -106,7 +123,7 @@
     "local-chain-plan.mjs": "e45a9170f569c80f7e5532bbc109dbae3c24b696815316e503cb3779135be648",
     "local-chain-release-labels.mjs": "7ce5350d1062d5236f57f10e7e81713c1101463d5e7f252604ef0c2a30840bfe",
     "local-chain-results.mjs": "0455f72cad574cfef87c2c6c0928d6432bba7e5dbaff521a2b62a9575299ca10",
-    "local-approved-plan.mjs": "825059864d4ca1e5a85d1a715ad68c3923350e1be233d4f3bb09d6f31b0143af",
+    "local-approved-plan.mjs": "26731b534f4c276c6235cb73bf6950943061947967a93f477f4bcd64acde72a6",
     "local-budget-renewal.mjs": "6b436358066fe33b2f6d871fc90d8e7c551edd6255efd73c0d255d0fd35d5ef8",
     "local-probe.mjs": "9b948db1de1e34c7605c4c454cd4aced66d2b57d2cf4471adbb80bcc76dee635",
     "local-budget-grants.mjs": "c5f6542f5d2c3bfe07f3ca5b5bc849bf05d886b06014f720322d530510775d3d",
@@ -155,7 +172,7 @@
     "local-scope-state.mjs": "8b600a91fc0068d7a8c0bb752ddba7ed30ada93daafb118d6cba2368fd94cb27",
     "local-scope-workspaces.mjs": "a44c34537e5ed2dcaf193a985e5bc05957989fbb160a650f9e37ba7d66eb2de8",
     "local-task-routing.mjs": "6e2e506b2fb0e2e8d8c5147d7df32849b57a4e94a23634f01a355d45735858e4",
-    "remote-client.mjs": "bfb58132759a4312adc8ab33115d807c5a8d90c955aca3678e361ab9cefa84bd",
+    "remote-client.mjs": "0d1ec6506fe53a1e33c31c5ba19d14e30e00e85e11eaf7ff8277ea798b9f36c9",
     "cloud-task-client.mjs": "11acb1a033c94cdfbdfb177a3402ad97f6a5226f577138c8cf6395dc3ebb1a39",
     "scope-runner-client.mjs": "646ab4f80d4a8209e922fd45f40efd968f0744d9dfc03188b222c1a2e11e83b8",
     "native-client.mjs": "6f5575909bae9daba643287f876ffa0f9ff1c53a367b32a40145d740456d6605",
@@ -188,7 +205,7 @@
     "workflow-local-request.mjs": "4e24c543ce386292a87dc9cd41f90d23375f12079cacffc515c8cd01fd571780",
     "task-message-entry.mjs": "31d10056cb905237cd5649e8eb067009ff1612ec5dc1061e0373209fbc0b646a",
     "task-message-cli.mjs": "3ca65e96c28129b3bd5cac962d106e0859a1f17df1f6a66ee543c6efc22f918d",
-    "local-contracts.mjs": "bb1df682f06782f1c8814d50fe1c455153b29f3a1a093e87dd4ab2ed5ae16e1a",
+    "local-contracts.mjs": "b59fcdace17b0b56117c564f8c15322465243e69adede182c5dde9204836c99c",
     "local-contract-types.mjs": "85e71fa4dd67e351a4b67573c740bcdb1661cede53f097189f11837771e75e91",
     "local-archguard-ast.mjs": "7ff7df9dab0d98ed62983add751c80edea598bc94ef4f38ede0ebd4d41226c87",
     "local-archguard-checkpoint.mjs": "37896902520cc995720c96288e4a5ed3585952b55c9c35be281f91fa754c71ec",
@@ -218,11 +235,11 @@
     "local-mutation-files.mjs": "087b00e8424a135e783eb432271012a71e55eeb4a5e30119490d1bc0b2160320",
     "local-mutation-snapshot.mjs": "f9077539680fb8d3ff33a962657756a8fe6afa8409b6191334509534216ebfe8",
     "local-mutation-audit.mjs": "5a30ee3446f632e032ffcfe46bcd97d6dfc0f099a76ea5185c3f9a9118c4f6cb",
-    "local-mutation-wire.mjs": "465463712f638f40c87fd885932f6a9a8c1db64489bb7ca6614fb643d7a36624",
-    "local-mutation-binding.mjs": "a1756642dd758701b476d332a48799b4af56fdd8f67aba6d46ca9bb2341b6327",
-    "local-mutation-pass-store.mjs": "8d6b57c6d1ea3df15a794e6a4cd39497f4412a5f911b9a30b0437498f51f92c0",
-    "local-mutation-authority.mjs": "1af7e04f545bb82df4ee91c256009d5f8d5ee71aab5a734c80d911dce6a646bb",
-    "local-mutation-batch.mjs": "a4e9d879172e0acf79a194707ae152b4428d6fc67a837171ff115dbc00e4d6e4",
+    "local-mutation-wire.mjs": "7af0c585e8dd6936c0ff17f491c64a198744629f063279c31589d887ec83ae9c",
+    "local-mutation-binding.mjs": "4440d792453a07a375b635fa5a91db607e58162824baced5c79a9a513f4ec918",
+    "local-mutation-pass-store.mjs": "1edc5fcc537dfa04b8ae8b07af554d61ea5911a5da281423ad57214ccf753ad4",
+    "local-mutation-authority.mjs": "ebac0cc8126969bafb0aaaeacf71e05124997d5c3214f8ec32b7a4fa14569bcf",
+    "local-mutation-batch.mjs": "de27686b5f99a99b02f0218a3fa159e9469d6b19c595117287d6dd37a6efcb3b",
     "local-mutation-batch-receipt.mjs": "b0e6a8522867255d899e60b66677885933f6a1c4c771cbb52f84dbbbdcf5e5c2",
     "calctool-runtime-entry.mjs": "98d2bc8df38d16131fc56db0a3d4d260531ba4df412baa5ddc4b8b5c5ca99fe9",
     "calctool-runtime-build.mjs": "3c5a9bd40bc1abe02e3b6e307809eea4eaaf198e8f0db6f5d6b2583dd68a59d2",

package/release.mjs

@@ -28,7 +28,26 @@ const coordination17SourceFiles = Object.freeze([
   'local-validator-isolation17.mjs',
   'local-calctool-composition17.mjs',
 ])
+const preservedMutationSourceFiles = Object.freeze([
+  'local-preserved-mutation-protection.mjs', 'local-preserved-mutation-signer.mjs',
+  'local-preserved-mutation-state.mjs', 'local-preserved-mutation-wire.mjs',
+  'local-delegated-modify-analysis.mjs', 'mutation-client.mjs', 'cloud-mutation-authority.mjs',
+])
+const memberContinuationSourceFiles = Object.freeze([
+  'connected-cli.mjs',
+  'local-approved-process.mjs',
+  'local-approved-supervisor.mjs',
+  'local-mutation-consumption.mjs',
+  'workflow-observation-client.mjs',
+  'workflow-observation-connection.mjs',
+  'workflow-observation-remote.mjs',
+  'workflow-observation-runner.mjs',
+  'workflow-observation-state.mjs',
+  'workflow-observation-wire.mjs',
+])
 const sourceFiles = [
+  ...memberContinuationSourceFiles,
+  ...preservedMutationSourceFiles,
   ...REUSE_DISCIPLINE_SOURCE_FILES,
   ...FINAL_GATE16_PACKAGE_FILES,
   'local-merge-archguard-verification.d.mts',
@@ -212,6 +231,12 @@ const calctoolReleaseLabels = Object.freeze({
 })
 
 const mutationReleaseLabels = Object.freeze({
+  ...Object.fromEntries(memberContinuationSourceFiles.map(file => [file, {
+    zh: '原任务连续编辑与本地测试观察', en: 'original-task continuation and local command observation',
+  }])),
+  ...Object.fromEntries(preservedMutationSourceFiles.map(file => [file, {
+    zh: '保留运行时依赖的受限本地编辑授权', en: 'restricted local editing with preserved runtime dependencies',
+  }])),
   'local-mutation-files.mjs': { zh: '原任务短时写入授权与文件快照隔离', en: 'Original task short-lived mutation authority and file snapshot isolation' },
   'local-mutation-snapshot.mjs': { zh: '原任务短时写入授权与文件快照隔离', en: 'Original task short-lived mutation authority and file snapshot isolation' },
   'local-mutation-audit.mjs': { zh: '原任务短时写入授权与文件快照隔离', en: 'Original task short-lived mutation authority and file snapshot isolation' },

package/releases.json

@@ -1,4 +1,10 @@
 [
+  {
+    "version": "0.1.53",
+    "date": "2026-10-17",
+    "zh": "补齐原任务受限编辑、真实写后结算与连续修改，保留未知依赖和独立验证边界；沙箱关闭后可运行原批准命令并保存本地观察。修复前置条件、断线恢复和停止循环，独立监督器约束崩溃后的子进程。本地成功不代表独立验证或交付。",
+    "en": "Added original-task restricted editing, real write settlement and subsequent modifications while preserving unknown dependencies and independent validation. With cloud sandbox disabled, retain actual observations of the approved command. Fixed prerequisite recovery, disconnections and Stop loops; an independent supervisor bounds child processes after CLI failure. Local success does not certify independent verification or delivery."
+  },
   {
     "version": "0.1.52",
     "date": "2026-10-17",

package/remote-client.mjs

@@ -37,7 +37,8 @@ function discoveredAjv() {
 export function buildInvocation(operation, input) {
   if (!['capabilities', 'task-describe', 'message-route', 'message-accept', 'task-resume', 'task-checkpoint', 'flow-cancel', 'flow-abandon',
     'message-status', 'message-delivery-start', 'message-delivery-report', 'message-resolve', 'message-complete',
-    'handoff-prepare', 'handoff-release', 'handoff-claim', 'handoff-status', 'handoff-resume', 'handoff-execution-authority', 'mutation-snapshot-challenge', 'mutation-pass-issue',
+    'handoff-prepare', 'handoff-release', 'handoff-claim', 'handoff-status', 'handoff-resume', 'handoff-execution-authority', 'mutation-snapshot-challenge', 'mutation-pass-issue', 'mutation-pass-settle',
+    'member-observation-admit', 'member-observation-report', 'member-observation-status',
     'scope-runner-prepare', 'scope-runner-register', 'scope-runner-challenge', 'scope-runner-attest',
     'start', 'continue'].includes(operation)) throw new Error('Invalid entrorove operation');
   if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('Input must be a JSON object');

package/workflow-observation-client.mjs

@@ -0,0 +1,44 @@
+import { bootstrapCloudMutationAuthority } from './cloud-mutation-authority.mjs';
+import { observationInput } from './workflow-observation-wire.mjs';
+
+const safeId = value => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value);
+const safeRequest = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+const messages = {
+  ENTROROVE_LOCAL_OBSERVATION_UNKNOWN: 'Original observation outcome is unknown; recover its original GET without repeating execution',
+  ENTROROVE_LOCAL_OBSERVATION_NOT_SENT: 'Observation was not transmitted; repair its local or discovery prerequisite and reuse the original input',
+  ENTROROVE_LOCAL_OBSERVATION_PREREQUISITE: 'Local observation requires cloud sandbox disabled and its original live execution lease',
+  ENTROROVE_SCOPE_RECEIPT_EXPIRED: 'Refresh the original scope evidence and reuse the original observation input',
+  ENTROROVE_SCOPE_AFTER_WRITE_REQUIRED: 'Observe the settled modifications in fresh scope evidence before local testing',
+};
+function blocked(error, input) {
+  const cause = error && typeof error === 'object' ? error : {};
+  const code = typeof cause.code === 'string' && /^ENTROROVE_[A-Z0-9_]{1,100}$/.test(cause.code)
+    ? cause.code : 'ENTROROVE_LOCAL_OBSERVATION';
+  const output = cause.output, requestId = safeRequest(cause.requestId) ? cause.requestId : undefined;
+  const recoverable = output?.status === 'blocked' && output.recoverable === true
+    && (output.observationPrerequisite?.effect === 'none' || ['ENTROROVE_SCOPE_RECEIPT_EXPIRED',
+      'ENTROROVE_SCOPE_RUNNER_REQUIRED', 'ENTROROVE_SCOPE_SNAPSHOT_REQUIRED', 'ENTROROVE_SCOPE_AFTER_WRITE_REQUIRED'].includes(code));
+  const reason = ['sandbox-enabled', 'lease-expired', 'receipt-expired', 'after-write-observation-required'].includes(output?.reason)
+    ? output.reason : undefined;
+  return { schemaVersion: 'entrorove.local-observation-connection/1.0', status: 'blocked',
+    ...(safeId(input?.flowId) ? { flowId: input.flowId } : {}), independentValidation: 'pending', code,
+    message: messages[code] ?? 'Local observation could not continue; its original command and result remain preserved',
+    ...(recoverable ? { prerequisite: { status: 'blocked', code, recoverable: true, ...(reason ? { reason } : {}),
+      nextAction: { operation: 'workflow-observe-step', reuseOriginalInput: true,
+        ...(safeRequest(output.requestId) ? { resumeRequestId: output.requestId } : {}) } } } : {}),
+    ...(cause.outcomeUnknown === true && requestId ? { outcomeUnknown: true, requestId, repeatPost: false,
+      nextAction: { operation: 'workflow-observe-step', reuseOriginalInput: true, method: 'GET' } } : {}),
+    ...(cause.knownBeforeTransmission === true && requestId ? { requestId, knownBeforeTransmission: true } : {}) };
+}
+export async function runWorkflowObserveStep(repositoryRoot, input, dependencies) {
+  try {
+    observationInput(input);
+    await dependencies.install();
+    if (!await dependencies.agreementAccepted(dependencies.home)) return dependencies.agreementRequired(dependencies.home);
+    await bootstrapCloudMutationAuthority(dependencies);
+    const { connectWorkflowObservation } = await import('./workflow-observation-connection.mjs');
+    return await connectWorkflowObservation(repositoryRoot, input, dependencies);
+  } catch (error) {
+    return blocked(error, input);
+  }
+}

package/workflow-observation-connection.mjs

@@ -0,0 +1,35 @@
+import { canonical, sha256 } from './local-integrity.mjs';
+import { withStateLock } from './local-state-lock.mjs';
+import { trustedOrigin } from './remote-transport.mjs';
+import { observationAdmission, observationFail } from './workflow-observation-wire.mjs';
+import { observationLocation, readObservationState } from './workflow-observation-state.mjs';
+import { runWorkflowObservation } from './workflow-observation-runner.mjs';
+import { observationRemote, authorizeObservation } from './workflow-observation-remote.mjs';
+
+async function connect(input, state, location, dependencies) {
+  const original = Object.fromEntries(['taskId', 'flowId', 'stepId', 'leaseId', 'generation', 'settlementId'].map(key => [key, input[key]]));
+  const admitted = state.admitted ?? await observationRemote('admitted', 'member-observation-admit', original, state, location, dependencies);
+  const admission = observationAdmission(admitted.admission, input, { allowExpired: Boolean(state.result) });
+  await authorizeObservation(admission, dependencies, !state.result);
+  const cached = Boolean(state.result), result = await runWorkflowObservation(input, admission, state, location,
+    { authorize: () => authorizeObservation(admission, dependencies, true) });
+  if (result.runner !== 'local' || result.receipt !== null || result.independentValidation !== 'pending'
+    || result.executionIsolation !== 'host-permissions' || result.externalEffects !== 'unverified'
+    || !['incomplete', 'failed'].includes(result.status) || result.admissionDigest !== sha256(canonical(admission))) {
+    observationFail('Local observation cannot replace independent validation or its original admitted result');
+  }
+  const reported = state.reported ?? await observationRemote('reported', 'member-observation-report', {
+    observationId: admission.observationId, admissionDigest: sha256(canonical(admission)), result,
+  }, state, location, dependencies);
+  if (reported.observationId !== admission.observationId || reported.observationStatus !== 'pending-independent'
+    || reported.resultDigest !== sha256(canonical(result)) || canonical(reported.result) !== canonical(result)) {
+    observationFail('Stored local observation differs from its actual original result');
+  }
+  return { ...result, taskId: input.taskId, flowId: input.flowId, stepId: input.stepId, cached, stored: true,
+    resultDigest: sha256(canonical(result)), grantsExecutionAuthority: false, grantsValidatorAuthority: false };
+}
+export async function connectWorkflowObservation(repositoryRoot, original, dependencies) {
+  const location = await observationLocation(repositoryRoot, original, dependencies.home, trustedOrigin(dependencies.apiOrigin()));
+  const input = { ...original, repositoryRoot: location.root, home: location.home };
+  return withStateLock(location.file, async () => connect(input, await readObservationState(location), location, dependencies));
+}