@entrorove/skill 0.1.52 → 0.1.54

package/CAPABILITY-MAP.md

@@ -1,5 +1,17 @@
 # 能力对账图（WP-02 / AC-20）
 
+## 2026-10-17 增量：受限本地编辑与停止恢复
+
+| 能力 | 正常公开入口 | 验证与边界 |
+| --- | --- | --- |
+| 成员受限编辑 | `mutation-connect <repositoryRoot>`、`local mutation-delegate-prepare` | 原任务、冻结修改声明及租约绑定；观察、编辑、独立验证三把密钥分离。运行时依赖保持未知且只读，只允许现存文件的受限修改；不授予通用执行、合并或交付权限 |
+| 连续编辑结算 | `mutation-settle <repositoryRoot>`、`local mutation-consumption-attest`、服务端 `mutation-pass-settle` | 实际写后 M 回执与 fresh S 后验共同确认原 pass；下一轮使用 `previousPassId`，不伪造架构验证事件 |
+| 沙箱关闭后的本地测试 | `workflow-observe-step <repositoryRoot>`、`member-observation-admit/report/status` | 仅运行原冻结命令，对照已结算源文件和保护依赖；结果独立保存为 local / pending-independent，不升格为 V 验证或交付 |
+| 续跑入口 | 原 `execution-claim`、原 flow 恢复 | 成员受限范围返回原字段的 `localAction`，客户端串联真实快照、签名、云端通行证及本地安装；网络结果不明时恢复原请求 |
+| 同一阻断停止 | IDE `Stop` 回调 | 真实重复阻断可等待；状态查询及检查点不能重置阻断，宿主重复 Stop 不再生成无限续跑。原 flow、需求队列与恢复数据保留 |
+
+上述编辑授权与独立验证分别核验。实际写入成功不等于业务测试通过；缺少独立验证运行器时不能认证交付。以下历史能力数量保留原日期口径。
+
 ## 2026-10-14 接入：受控执行与复用一致性
 
 | 能力 | 正常公开入口 | 验证与边界 |
@@ -23,7 +35,7 @@
 | 网页与手机通知 | 登录后的任务通知按钮 | 同一加密 Web Push 协议，账号与设备隔离；真实任务事务队列、持久重试、失效注销与到期清理；手机可见投递仍需设备本人授权与验收 |
 | 失败后接续 | `scope-connect` 返回 `nextInput`；`feedback <requestId> [generation]` | 范围门禁使用同一排序路径集；新执行保存新一代回执，原失败回执不可改，默认只读最新一代 |
 
-本地公开 schema 已增加到 **107 项**（原 100 项加 `peer-status`，以及当前增量的 `discipline-check`、`discipline-review`、`flow-cancel`、`flow-abandon`、`guarded-delete`、`guarded-move`）。Aimlock 运行时由 7.0.44 更新为 **7.0.45**，公开操作由 20 项增加到 24 项；其余七域的运行时版本保持原值。下方历史表保留原对账日期与当时验收边界，不表示当前仍缺上述入口。发布件与生产部署需独立核验，不能从仓库测试推断。
+本地公开 schema 已增加到 **109 项**（原 100 项加 `peer-status`，以及当前增量的 `discipline-check`、`discipline-review`、`flow-cancel`、`flow-abandon`、`guarded-delete`、`guarded-move`、`mutation-delegate-prepare`、`mutation-consumption-attest`）。Aimlock 运行时由 7.0.44 更新为 **7.0.45**，公开操作由 20 项增加到 24 项；其余七域的运行时版本保持原值。下方历史表保留原对账日期与当时验收边界，不表示当前仍缺上述入口。发布件与生产部署需独立核验，不能从仓库测试推断。
 
 ## 2026-10-12 基线：八域 IDE 调用链
 
@@ -81,7 +93,7 @@ Entrorove 只治理通过技能入口执行的动作：路径、通行证、快
 
 `scope-connect <absolute repositoryRoot>` 是 CLI 编排入口，不改变这 100 项本地操作。它串联远端 `scope-runner-prepare/register/challenge/attest` 与已有真实快照、签名检查，为原账号与任务提交范围证据；不授予执行证据签名或写入权限。全部远端操作以实时 discovery 为准。
 
-当前增量操作（不改写上述历史分母）为：`peer-status`、`discipline-check`、`discipline-review`、`flow-cancel`、`flow-abandon`、`guarded-delete`、`guarded-move`。它们计入当前 107 项公开 schema。
+当前增量操作（不改写上述历史分母）为：`peer-status`、`discipline-check`、`discipline-review`、`flow-cancel`、`flow-abandon`、`guarded-delete`、`guarded-move`、`mutation-delegate-prepare`、`mutation-consumption-attest`。它们计入当前 109 项公开 schema。
 
 | 分区 | 精确操作名 | 证据位置 |
 | --- | --- | --- |

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.54 — 2026-10-17
+
+- 修复受管 Node 只读 SHA-256 命令在 Codex 工具门禁中的静态识别与安全改写；按已证明的 createRequire 原目录解析实际安装依赖并记录只读元数据，保留未知上下文和越界拒绝。
+- Fixed static recognition and safe rewriting of managed Node SHA-256 reads in Codex tool guards; resolved installed dependencies from proven createRequire anchors with read-only metadata while preserving unknown-context and path-boundary refusals.
+
+## 0.1.53 — 2026-10-17
+
+- 补齐原任务受限编辑、真实写后结算与连续修改，保留未知依赖和独立验证边界；沙箱关闭后可运行原批准命令并保存本地观察。修复前置条件、断线恢复和停止循环，独立监督器约束崩溃后的子进程。本地成功不代表独立验证或交付。
+- Added original-task restricted editing, real write settlement and subsequent modifications while preserving unknown dependencies and independent validation. With cloud sandbox disabled, retain actual observations of the approved command. Fixed prerequisite recovery, disconnections and Stop loops; an independent supervisor bounds child processes after CLI failure. Local success does not certify independent verification or delivery.
+- 补齐实际写入后的 M 消费结算与 fresh S 后验，按原租约和 `previousPassId` 连续编辑；关闭云端沙箱后可运行原批准命令并独立保存本地测试观察。修复前置条件恢复、客户端漏回结算编号和退出说明冲突；独立监督器在 CLI 崩溃后仍约束实际子进程。结果明确为主机权限执行、外部副作用未核实，不能替代独立验证。
+- Added real M write-consumption settlement, fresh S confirmation and subsequent edits bound to the original lease and previous pass. With cloud sandbox disabled, run the approved command and retain its local observation separately. Fixed prerequisite recovery, missing settlement IDs and conflicting Stop guidance. An independent supervisor enforces child deadlines after CLI failure. Results explicitly retain host permissions, unverified external effects and pending independent validation.
+
 ## 0.1.52 — 2026-10-17
 
 - 修复 Vue/TypeScript 的 Function 类型和真实 Vue 回调 prop 被误判为动态依赖；解析不可变 const 的有限语言模块导入，记录实际依赖与哈希。补齐 Vue 候选依赖检查；未知运行时导入报告文件、行列和原因。测试采用隔离用户目录，越界、动态执行、未知删除与原任务写入校验继续保留。

package/DELIVERY-BOUNDARIES.md

@@ -1,10 +1,12 @@
 # Delivery boundaries and cost visibility
 
-Contract for where a governed task may stop and which numbers the skill may display. Each section is marked **live** (implemented in this package) or **planned** (documented, not yet wired).
+Contract for claiming stage delivery and displaying measured consumption. Each section is marked **live** (implemented in this package) or **planned** (documented, not yet wired).
 
 ## Stop only at a boundary (live)
 
-A stopped task may only stop at a clean boundary: the work so far is runnable, demonstrable and roll-backable. Never stop in the middle of a stage. In this package the ordered verified stages of the accepted plan are the boundaries; `local-stage-boundary.mjs` decides and reports with them.
+A delivered stage requires a clean boundary: the work so far is runnable, demonstrable and roll-backable. Do not claim delivery in the middle of a stage. The ordered verified stages of the accepted plan are the boundaries; `local-stage-boundary.mjs` decides and reports with them.
+
+Blocked or unknown work may wait without a delivered stage. Preserve the original flow, queued requirements, request identity and recovery evidence. After the same real block occurs twice, diagnose and use the supported recovery; do not force a third execution or repeated automatic Stop continuation. Waiting does not grant a replacement executor or verified completion.
 
 ## `delivered-stage-N` is its own terminal (live)
 

package/IDE-EXECUTION.md

@@ -30,11 +30,11 @@ Set `ENTROROVE_IDE` to the actual host name (for example `Codex`, `Cursor` or `C
 
 ### Interrupting and resuming requirements
 
-User text received during an unfinished governed task is persisted as an exact, private queue entry. `queue status` reads it; `queue route` assigns the existing `background`, `normal`, `high` or `urgent` priority. `interrupt` only takes effect at a controlled-call checkpoint and keeps the parent flow, task ID, task number, request ID, repository and account binding. Once the inserted requirement has a verified completion and stored feedback acknowledgement, the parent is restored and its returned `nextStep` is the only continuation. The guard blocks Stop while an entry is unclassified, a call is unresolved or a runnable parent/child remains. The queue does not promise execution when the host is powered off or the IDE process is unavailable.
+User text received during an unfinished governed task is persisted as an exact, private queue entry. `queue status` reads it; `queue route` assigns the existing `background`, `normal`, `high` or `urgent` priority. `interrupt` only takes effect at a controlled-call checkpoint and keeps the parent flow, task ID, task number, request ID, repository and account binding. Once the inserted requirement has a verified completion and stored feedback acknowledgement, the parent is restored and its returned `nextStep` is the only continuation. Stop may request one bounded continuation to classify a queued requirement or recover an unresolved request read only. A persisted repeated blocker may wait without terminating or advancing the original queue; automatic continuation is limited to one attempt per user turn and respects the host's `stop_hook_active` signal. Status queries and checkpoints do not erase the blocker. The queue does not promise execution when the host is powered off or the IDE process is unavailable.
 
 ### Delivery boundaries and stop-loss
 
-A stopped task may only stop at a clean boundary: one where the work so far is runnable, demonstrable and roll-backable. Never stop in the middle of a stage. Such a stop is its own terminal result `delivered-stage-N` (N = delivered stages); it is never `failed` or `blocked`, must not be shown as an error, and the IDE keeps phase `delivered` with Stop allowed. A new `start` for the same goal stays refused: continue the original bound flow instead.
+A delivered stage requires a clean boundary where the work so far is runnable, demonstrable and roll-backable. Its terminal result is `delivered-stage-N` (N = delivered stages); it is never `failed` or `blocked`, must not be shown as an error, and the IDE keeps phase `delivered` with Stop allowed. Blocked or unknown work can instead wait without a delivery claim and retain its original recovery data. A new `start` for the same goal stays refused: continue the original bound flow or use its explicit lifecycle termination operation.
 
 The close decision uses measured consumption only. Without an enforced budget there is no baseline, so the result is explicitly not-estimable and no remaining amount or duration may be displayed. When measured consumption reaches the configured share of the enforced budget, finish the current stage and close at that boundary. Resuming continues at the next boundary; delivered stages are never re-executed.
 
@@ -70,7 +70,29 @@ Scope inspection resolves aliases from actual `tsconfig.json` or `jsconfig.json`
 
 Keep snapshot before-images distinct from a frozen execution plan's expected final file hashes. Controlled writes consume the original approved authority; the runner then verifies the actual planned final bytes. Never edit a signed plan or silently substitute a newer snapshot after an unknown or failed gate. Existing changes outside that authority require explicit revalidation of the same original flow.
 
-Computed runtime imports remain explicitly unresolved with their actual source paths and hashes. A member's scope-only signer may submit these observations to enter restricted planning; the cloud returns `planningOnly: true` and `requires-complete-import-graph-before-mutation`. Do not treat this as full dependency verification, execution permission, or business completion. Resolve the dynamic dependency contract and obtain complete verified facts before mutation; never set `complete` manually or replace the original signer or paths to bypass the restriction.
+Computed runtime imports remain explicitly unresolved with their actual source paths and hashes. A member's scope-only signer may submit these observations to enter restricted planning; the cloud returns `planningOnly: true` and `requires-complete-import-graph-before-mutation`. Do not treat this as full dependency verification, execution permission, or business completion. Obtain the limited original-task editing delegation below when eligible, or resolve and verify the dependency contract. Never set `complete` manually or replace the original signer or paths.
+
+### Restricted member editing
+
+When the accepted plan returns a `localAction` for `mutation-connect`, run `npx @entrorove/skill mutation-connect <original repositoryRoot>` with that action's JSON `input` on stdin. The input contains the original `taskId`, `flowId`, `stepId`, `leaseId`, `generation`, scope `runnerId` and exact `paths`. Use the same local home, account and scope signer. This route requires an accepted frozen modify policy and a live original lease; it does not create a second task or invoke a generic execution authority.
+
+The connector discovers the public cloud verification key through the authenticated official HTTPS capability endpoint and fixes it in private local storage. An explicit operator pin must match, and a changed key or origin is rejected rather than silently replaced. Subsequent local mutation calls load this public pin offline; discovery and `unlock` do not depend on that cache.
+
+The connector creates a separate local editing key, requests the cloud's original signed snapshot challenge, copies and verifies the actual files, signs their fresh observation, obtains a limited cloud pass and installs it. The local editing key differs from both the scope observation key and the independent validator key. It is stored privately outside the repository; no manual key configuration is required. An uncertain network result returns a structured blocked result with the original request ID. Reusing the identical connector input restores its saved stage through the original status GET and keeps its existing challenge and attestation; it never replaces an uncertain mutation POST.
+
+Use the returned `gatePassPath` with the discovered `local guarded-write` contract and preserve its exact flow, step and repository. Only existing declared modify targets are eligible. Runtime loader sources and observed project configuration stay protected by their original hashes and physical file identity. The local preflight rejects changed imports, removed definitions, public contract changes, new unknown dependencies and unsupported source formats. Unknown dependency coverage remains unknown after an eligible edit.
+
+After the pass's actual writes finish, rerun the original `scope-connect` with its complete original input, including `importContexts`. Run `npx @entrorove/skill mutation-settle <original repositoryRoot>` with `{taskId,flowId,stepId,gatePassPath}`. The local M signer observes the real completed consumption, and the service requires a fresh S scan captured after those writes. This settlement preserves both before and after hashes, unchanged modes, pass nonces and the original lease. It never creates an architecture verification event. Further edits use the returned `localAction`, whose `previousPassId` identifies that exact settled pass; do not resend an already consumed write.
+
+If settlement reports `ENTROROVE_SCOPE_AFTER_WRITE_REQUIRED`, refresh only the original scope and retry the same consumption request and receipt. A lost network response is different: rerunning the identical connector restores its original GET result without a replacement POST or signature.
+
+With cloud sandbox disabled, the returned `observationAction` runs `npx @entrorove/skill workflow-observe-step <original repositoryRoot>` with `{taskId,flowId,stepId,leaseId,generation,settlementId}`. The service admits only the original frozen command, executable hash, environment and limits, with source hashes updated solely by accepted settlements. The local runner checks the actual source and protected dependencies before and after execution. No validator private key is needed. A real successful process remains `status: incomplete`, `runner: local`, `receipt: null`, `independentValidation: pending`; its result is stored separately and read with `member-observation-status`. It cannot advance formal verified dependencies or task delivery. Reentry preserves a completed process result; an unknown process outcome never authorizes an automatic second launch.
+
+This command runs with the host OS user's permissions, not inside an OS sandbox. Its repository checks do not prove that external files, networks or databases were unchanged: `executionIsolation` remains `host-permissions`, and `externalEffects` remains `unverified`. The independent supervisor enforces the admitted start deadline and command timeout and reclaims its own process group if the CLI disappears. Only the original approved command can be launched; these observations grant no general shell or project-write permission.
+
+For a lost `mutation-settle` response, rerun that exact command and input to restore its original HTTP request. For observation network recovery, rerun the identical `workflow-observe-step` input or invoke `member-observation-status` with `{observationId}` through the normal `invoke` entry; both preserve the original process identity. A feedback acknowledgement confirms receipt of a result, not independent verification of that result. Exact host approval means the existing guard callback for the tool call, not another request for human business approval.
+
+An editing pass does not certify test execution, independent validation, merge or delivery. Keep those existing verification requirements and distinguish an actual edited file from a verified business result. A missing independent runner is an explicit prerequisite; never substitute the editing key for that runner or describe a local edit as completed delivery.
 
 For a decision, include `input.task.interaction` with `type` (`confirm`, `choice`, `multi` or `input`), a `question`, `options` (two or more with unique `id` and `label`, or an empty array for input), and a `callback` containing its `operation` and `payload`. Medium- and high-risk decisions also need a `riskDescription`. The decision waits for an explicit answer; it never chooses a default on timeout.
 

package/SKILL.md

@@ -5,7 +5,7 @@ description: Execute an engineering task through Entrorove, preserving its origi
 
 # entrorove · 熵巡
 
-Version: 0.1.52.
+Version: 0.1.54.
 
 Entrorove applies to the whole task once selected. Reading this document or calling an entry once does not execute the task. On every later turn, including after compaction, continue the original task and its required next operation before dependent work. Keep the original goal, scope, account, flow, cloud task and failure records. Never describe planning, a reported step or model output as verified delivery.
 
@@ -16,19 +16,23 @@ Entrorove applies to the whole task once selected. Reading this document or call
    To remove this skill and its host hooks, run `entrorove uninstall` directly. It works offline and preserves unrelated host settings, credentials and task records. If a managed file was edited, it reports the preserved path instead of deleting it.
 2. Read [IDE-EXECUTION.md](IDE-EXECUTION.md) for the exact entry, cloud callbacks, account agreement and operation contracts. Use the stored account credential; never put it in arguments, URLs, project files, output or fixtures. Entrorove is independent of other systems.
 3. Discover `capabilities`, then invoke `start` with the actual goal, task type, risk and scope facts. An enabled account returns a cloud choice before charging a model. Show that choice visibly using the host question tool. Confirmation calls its original callback; exit adopts the local route for this task. Never treat silence as permission, invent acceptance, or create both routes. Existing explicit authorization for this task persists.
+   With cloud sandbox disabled, the IDE performs its own planning and continues the original API flow. Do not require a cloud model call or create a sandbox task to perform local work.
    When the model produces a task contract, preserve its `workType`, `risk`, `difficulty`, `crossModule`, `parallel`, `unclear`, `architectureContract`, optional `baselineRef`, and optional `interaction` as returned. Valid work types are `implementation`, `documentation`, `calculation`, `merge`, `review`, `decision`, and `diagnosis`. A `merge` requires a concrete `baselineRef` identifying the branch, tag, commit, or review baseline; keep that baseline unchanged through independent verification. A `decision` requires `interaction`, including a risk description for medium or high risk. Do not fill missing required fields by guessing.
 4. After real cloud acceptance, immediately display **云端任务 <taskNumber> · 已进入**. Preserve `taskNumber` verbatim: it is the homepage sandbox tab number. Keep its UUID `taskId` separately. Run the returned `cloud-watch`, show each real public event and its cursor, and continue the original accepted flow from status. A command log alone is insufficient. No accepted cloud task means no cloud ID or model-execution claim.
 5. For an accepted `flowId`, execute the returned `nextStep` with its required payload. Discover the schema before constructing input. An empty payload is valid only when that operation's schema allows it. Reconnect and refresh only the original flow. A changed snapshot is a binding failure to investigate; do not invent a fresh successful baseline, rebuild a flow to evade it, or erase the old failure. If the terminal flow truly owns a stale task slot, use the explicit `flow-abandon` lifecycle operation described below before routing the original task again.
 6. All governed mutations use the original authority: `local guarded-write`, `local guarded-delete`, `local guarded-move`, or the original frozen approved runner plan. Native patches, scripts, terminal writes, database mutations and unknown MCP operations must not substitute for the controlled entry. **A failed gate or unknown outcome must never be replaced with another executor or reported as local success.** Query the original request read-only, repair the cause, and obtain the original flow's valid authority before proceeding.
+   For a restricted member scope, follow a returned `localAction` before submitting execution evidence. `mutation-connect` obtains only the original task's limited editing pass; it keeps unresolved loader files and project configuration read only. After actual writes, refresh the original scope and run `mutation-settle`. Use the returned `previousPassId` for further edits. With sandbox disabled, `workflow-observe-step` runs the original approved command and preserves its real local result without a validator private key; independent verification remains pending. See [IDE-EXECUTION.md](IDE-EXECUTION.md#restricted-member-editing).
 7. Read [REUSE-DISCIPLINE.md](REUSE-DISCIPLINE.md) when modifying an existing system. The comparison baseline is the existing implementation in that same repository. It never means another project, another account, or copying external systems.
-8. Read [DELIVERY-BOUNDARIES.md](DELIVERY-BOUNDARIES.md) before stopping a task or showing any consumption number. A task may only stop at a clean boundary, such a stop is `delivered-stage-N` and never `failed` or `blocked`, and a number without a measured baseline is never displayed.
-9. Before finishing, submit actual independent execution evidence, run the server's verification and verdict, and display the confirmed evaluation acknowledgement. Preserve `receiptId`, `requestId`, execution generation and evaluation digest. “已回传” requires `acknowledgement.stored: true`. Missing or failed feedback remains visible. Completed verified tasks automatically release superseded Entrorove snapshot copies, preserving origin and final rollback images; active, waiting and unknown tasks retain recovery data.
+8. Read [DELIVERY-BOUNDARIES.md](DELIVERY-BOUNDARIES.md) before claiming a delivered stage or showing consumption. A delivered stage requires a clean boundary and uses `delivered-stage-N`. Blocked or unknown work can wait with recovery data intact; it is not a delivered stage. Display consumption only with a measured baseline.
+9. Before claiming verified completion, submit actual independent execution evidence, run the server's verification and verdict, and display the confirmed evaluation acknowledgement. Preserve `receiptId`, `requestId`, execution generation and evaluation digest. “已回传” requires `acknowledgement.stored: true`. Missing or failed feedback remains visible. Completed verified tasks automatically release superseded Entrorove snapshot copies, preserving origin and final rollback images; active, waiting and unknown tasks retain recovery data.
 
 The Codex guard preserves this binding over subsequent prompts and compaction and denies unsupported native mutations before execution. Hooks are host guardrails, not an operating-system security boundary; unsupported tool paths or a disabled/untrusted hook cannot be described as enforced. An explicit user decision to stop using the skill ends its governance and never becomes verified Entrorove delivery. Do not infer such a decision from quoted screenshots or a service failure.
 
+After the same real blocked result occurs twice, diagnose it and use its supported recovery path. Do not send a third identical execution call. Read-only status and checkpoint acknowledgements do not count as execution progress. A blocked task may wait with its original flow, queue and recovery data intact; Stop must not force repeated automatic continuation of the same blocked turn.
+
 If the original flow is terminal and must release its task slot, invoke the discovered `flow-cancel` or `flow-abandon` operation with that same `flowId`. `flow-cancel` records an owner cancellation and keeps the task bound for read-only recovery. `flow-abandon` records the termination, clears acceptance and checkpoint state, unbinds the task and returns `nextStep.operation: "start"` so the original task can be routed again. These operations are available through the server and `local flow-cancel` / `local flow-abandon`; they never reopen the old flow.
 
-When a new user requirement arrives while the original task is unfinished, store its exact text in the private IDE queue. Use `queue` with `{"action":"status"}` to inspect it, then `{"action":"route","messageId":"...","mode":"queued"|"interrupt","priority":"background"|"normal"|"high"|"urgent"}`. An urgent interrupt is admitted only at a completed controlled-call checkpoint; it saves the original flow, task UUID, homepage number and request ID. After the inserted task reaches a verified end acknowledgement, the queue restores that exact parent context and its next operation. Unclassified text, unresolved calls and unknown outcomes block ending the turn. Queue state is bounded, account/session/repository-bound and survives compaction and process restart; it cannot wake a powered-off host.
+When a new user requirement arrives while the original task is unfinished, store its exact text in the private IDE queue. Use `queue` with `{"action":"status"}` to inspect it, then `{"action":"route","messageId":"...","mode":"queued"|"interrupt","priority":"background"|"normal"|"high"|"urgent"}`. An urgent interrupt is admitted only at a completed controlled-call checkpoint; it saves the original flow, task UUID, homepage number and request ID. After the inserted task reaches a verified end acknowledgement, the queue restores that exact parent context and its next operation. Unclassified text and unresolved calls block dependent execution, not waiting for recovery. Unknown outcomes permit only the original read-only recovery. Queue state is bounded, account/session/repository-bound and survives compaction and process restart; it cannot wake a powered-off host.
 
 ## Operations and visible progress
 

package/cli.mjs

@@ -10,7 +10,7 @@ import { runLocal } from './local-cli.mjs';
 import { runNative } from './native-client.mjs';
 import { configureNativeNotifications, notificationSettings, sendNativeNotification } from './native-notification.mjs';
 import { runTaskMessageCli } from './task-message-cli.mjs';
-import { runScopeConnect } from './scope-runner-client.mjs';
+import { isConnectedCommand, runConnectedCommand } from './connected-cli.mjs';
 import { apiUrl, buildInvocation, claimRecurring, finishRecurring, invokeRemote, listRecurring, queryBillingExport, queryFlows, queryStatus, queryUsageSummary, readRecurringRuns } from './remote-client.mjs';
 const packageDir = path.dirname(fileURLToPath(import.meta.url));
 import { buildReview, submitSkillFeedback, feedbackNoticeVersion } from './review-client.mjs';
@@ -456,10 +456,8 @@ async function main() {
         : args[0] === 'test' && (await notificationSettings()).enabled ? await sendNativeNotification('test') : null;
     if (!result) throw new Error('Use notifications configure|status|test; enable this account before sending a test');
     process.stdout.write(`${JSON.stringify(result)}\n`);
-  } else if (command === 'scope-connect' && args.length === 1) {
-    const result = await runScopeConnect(args[0], await stdinJson(), remoteDependencies());
-    process.stdout.write(`${JSON.stringify(result)}\n`);
-    if (result.status !== 'succeeded') process.exitCode = 2;
+  } else if (isConnectedCommand(command) && args.length === 1) {
+    await runConnectedCommand(command, args[0], await stdinJson(), remoteDependencies());
   } else if (command === 'host-message') {
     await runTaskMessageCli(args, await stdinJson(), remoteDependencies());
   } else if (command === 'cloud-task' && args.length === 0) {
@@ -479,7 +477,7 @@ async function main() {
   } else if (command === 'local') {
     await runLocal(args);
   } else {
-    throw new Error('Usage: entrorove unlock | uninstall | install [--host codex] | configure | agreement | invoke | queue | native <domain> <operation> | notifications configure|status|test | scope-connect <repositoryRoot> | host-message [adapterModulePath] | cloud-task | cloud-watch | cloud-status | feedback <requestId> [generation] | status <requestId> | flows | usage [flowId] | billing | recurring list|claim|finish|runs | review | local (JSON on stdin)');
+    throw new Error('Usage: entrorove unlock | uninstall | install [--host codex] | configure | agreement | invoke | queue | native <domain> <operation> | notifications configure|status|test | scope-connect <repositoryRoot> | mutation-connect <repositoryRoot> | mutation-settle <repositoryRoot> | workflow-observe-step <repositoryRoot> | host-message [adapterModulePath] | cloud-task | cloud-watch | cloud-status | feedback <requestId> [generation] | status <requestId> | flows | usage [flowId] | billing | recurring list|claim|finish|runs | review | local (JSON on stdin)');
   }
 }
 if (process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) { const { captureIdeResults } = await import('./ide-results.mjs');

package/cloud-mutation-authority.mjs

@@ -0,0 +1,96 @@
+import path from 'node:path';
+import { createPublicKey } from 'node:crypto';
+import { sha256 } from './local-integrity.mjs';
+import { withStateLock } from './local-state-lock.mjs';
+import { mutationStateRoot14, mutationFile14, mutationFail14, privateMutationDirectory14,
+  readMutationJson14, atomicMutationJson14 } from './local-mutation-files.mjs';
+import { invokeRemoteResult } from './remote-client.mjs';
+import { trustedOrigin } from './remote-transport.mjs';
+
+const pinSchema = 'entrorove.cloud-mutation-authority-pin/1.0';
+const keySchema = 'entrorove.mutation-authority-key/1.0';
+const keyEnvironment = 'ENTROROVE_WORKFLOW_PLAN_PUBLIC_KEY';
+const fail = () => mutationFail14('ENTROROVE_MUTATION_AUTHORITY_PIN', 'Cloud mutation public authority must retain its trusted origin, canonical Ed25519 key and original private local pin');
+function exact(value, fields) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || Object.keys(value).sort().join('\0') !== [...fields].sort().join('\0')) fail();
+}
+function authorityOrigin(value) {
+  let origin;
+  try { origin = trustedOrigin(value); } catch { fail(); }
+  if (origin !== value) fail();
+  const url = new URL(origin), ownedTest = process.env.NODE_ENV === 'test' && url.protocol === 'http:'
+    && ['127.0.0.1', 'localhost', '[::1]'].includes(url.hostname);
+  if (origin !== 'https://entrorove.com' && !ownedTest) fail();
+  return origin;
+}
+function publicIdentity(encoded) {
+  try {
+    if (typeof encoded !== 'string' || encoded.length > 4096 || !/^[A-Za-z0-9+/]+={0,2}$/.test(encoded)) fail();
+    const der = Buffer.from(encoded, 'base64'), key = createPublicKey({ key: der, type: 'spki', format: 'der' });
+    if (key.asymmetricKeyType !== 'ed25519' || der.toString('base64') !== encoded
+      || key.export({ type: 'spki', format: 'der' }).toString('base64') !== encoded) fail();
+    return { publicKey: encoded, keyId: sha256(der) };
+  } catch { fail(); }
+}
+function authorityKey(value) {
+  if (value?.status === 'unavailable') {
+    exact(value, ['schemaVersion', 'purpose', 'status', 'code']);
+    if (value.schemaVersion !== keySchema || value.purpose !== 'mutation-pass-verification'
+      || value.code !== 'ENTROROVE_MUTATION_AUTHORITY_UNAVAILABLE') fail();
+    mutationFail14('ENTROROVE_MUTATION_AUTHORITY_UNAVAILABLE', 'The authenticated server has no available public cloud mutation authority');
+  }
+  exact(value, ['schemaVersion', 'purpose', 'algorithm', 'keyId', 'publicKey']);
+  if (value.schemaVersion !== keySchema || value.purpose !== 'mutation-pass-verification' || value.algorithm !== 'Ed25519'
+    || !/^[a-f0-9]{64}$/.test(value.keyId) || publicIdentity(value.publicKey).keyId !== value.keyId) fail();
+  return value;
+}
+function matchEnvironment(authority) {
+  if (process.env[keyEnvironment] !== undefined && publicIdentity(process.env[keyEnvironment]).publicKey !== authority.publicKey) fail();
+}
+async function pinLocation(home) {
+  const stateRoot = await mutationStateRoot14({ home });
+  return { stateRoot, file: path.join(stateRoot, 'cloud-mutation-authority.json') };
+}
+async function readPin(location, origin) {
+  const parent = await mutationFile14(location.stateRoot, { allowMissing: true, final: 'directory' });
+  if (!parent.exists) return null;
+  if (process.platform !== 'win32' && (parent.stat.mode & 0o077) || process.getuid && parent.stat.uid !== process.getuid()) fail();
+  const file = await mutationFile14(location.file, { allowMissing: true });
+  if (!file.exists) return null;
+  if (file.stat.nlink !== 1 || file.stat.size > 8192) fail();
+  const pin = await readMutationJson14(location.file);
+  exact(pin, ['schemaVersion', 'apiOrigin', 'authority']);
+  if (pin.schemaVersion !== pinSchema || authorityOrigin(pin.apiOrigin) !== origin) fail();
+  authorityKey(pin.authority); matchEnvironment(pin.authority);
+  return pin;
+}
+export async function hydrateCloudMutationAuthority(home, apiOrigin) {
+  const origin = authorityOrigin(apiOrigin), pin = await readPin(await pinLocation(home), origin);
+  if (!pin) return false;
+  process.env[keyEnvironment] = pin.authority.publicKey;
+  return true;
+}
+export async function bootstrapCloudMutationAuthority(dependencies) {
+  const origin = authorityOrigin(dependencies.apiOrigin()), location = await pinLocation(dependencies.home);
+  const previous = await readPin(location, origin);
+  if (process.env[keyEnvironment] !== undefined) publicIdentity(process.env[keyEnvironment]);
+  let result, response;
+  try { ({ result, response } = await invokeRemoteResult({ operation: 'capabilities', input: {} }, dependencies)); }
+  catch {
+    throw Object.assign(new Error('Authenticated cloud mutation authority discovery is unavailable; no mutation operation was transmitted'),
+      { code: 'ENTROROVE_MUTATION_AUTHORITY_DISCOVERY', knownBeforeTransmission: true });
+  }
+  if (!response.ok || result?.output?.status !== 'succeeded') fail();
+  const authority = authorityKey(result.output.capabilities?.mutationAuthority);
+  matchEnvironment(authority);
+  if (previous && previous.authority.publicKey !== authority.publicKey) fail();
+  await privateMutationDirectory14(location.stateRoot, { privateFrom: location.stateRoot });
+  return withStateLock(location.file, async () => {
+    const current = await readPin(location, origin);
+    if (current && current.authority.publicKey !== authority.publicKey) fail();
+    if (!current) await atomicMutationJson14(location.file, { schemaVersion: pinSchema, apiOrigin: origin, authority }, { privateFrom: location.stateRoot });
+    process.env[keyEnvironment] = authority.publicKey;
+    return { keyId: authority.keyId, apiOrigin: origin };
+  });
+}

package/connected-cli.mjs

@@ -0,0 +1,20 @@
+import { runScopeConnect } from './scope-runner-client.mjs';
+import { runMutationConnect, runMutationSettle } from './mutation-client.mjs';
+import { runWorkflowObserveStep } from './workflow-observation-client.mjs';
+
+const commands = Object.freeze({
+  'scope-connect': runScopeConnect,
+  'mutation-connect': runMutationConnect,
+  'mutation-settle': runMutationSettle,
+  'workflow-observe-step': runWorkflowObserveStep,
+});
+export const isConnectedCommand = command => Object.hasOwn(commands, command);
+
+export async function runConnectedCommand(command, root, input, dependencies) {
+  if (!isConnectedCommand(command)) throw new Error('Unsupported connected command');
+  const result = await commands[command](root, input, dependencies);
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+  const expected = command === 'mutation-settle' ? ['reported', 'succeeded'] : ['succeeded'];
+  if (!expected.includes(result.status)) process.exitCode = 2;
+  return result;
+}

package/ide-code-mode.mjs

@@ -1,12 +1,12 @@
 import { createRequire } from 'node:module';
-import { literalCommand, sdkCommand, readCommand } from './ide-command.mjs';
+import { literalCommand, sdkCommand, readCommand, runtimeHashRead } from './ide-command.mjs';
 
-export function inspectIdeCodeMode(code, runtime) {
-  if (typeof code !== 'string' || code.length > 1_000_000) return false;
+export function prepareIdeCodeMode(code, runtime) {
+  if (typeof code !== 'string' || code.length > 1_000_000) return { allowed: false };
   const ts = createRequire(runtime.cli)('typescript');
   const source = ts.createSourceFile('host-call.js', code, ts.ScriptTarget.Latest, true, ts.ScriptKind.JS);
-  if (source.parseDiagnostics.length) return false;
-  let allowed = true;
+  if (source.parseDiagnostics.length) return { allowed: false };
+  let allowed = true; const replacements = [];
   const literal = node => {
     if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) return node.text;
     if (ts.isNumericLiteral(node)) return Number(node.text);
@@ -26,8 +26,22 @@ export function inspectIdeCodeMode(code, runtime) {
       const name = node.expression.getText(source);
       if (name === 'tools.exec_command') {
         try {
-          const args = literal(node.arguments[0]), command = literalCommand(args.cmd ?? args.command);
-          if (!(readCommand(command) || sdkCommand(command, runtime))) allowed = false;
+          const argument = node.arguments[0], args = literal(argument), command = literalCommand(args.cmd ?? args.command);
+          const hash = runtimeHashRead(command, runtime);
+          if (hash) {
+            const safe = node.arguments.length === 1 && typeof args.cmd === 'string' && !Object.hasOwn(args, 'command')
+              && Object.keys(args).every(key => ['cmd', 'workdir', 'max_output_tokens', 'yield_time_ms', 'login', 'shell'].includes(key))
+              && (args.shell === undefined || args.shell === '/bin/sh')
+              && (args.login === undefined || args.login === false)
+              && (args.workdir === undefined || typeof args.workdir === 'string')
+              && (args.max_output_tokens === undefined || Number.isSafeInteger(args.max_output_tokens) && args.max_output_tokens > 0)
+              && (args.yield_time_ms === undefined || Number.isSafeInteger(args.yield_time_ms) && args.yield_time_ms >= 0);
+            if (!safe) allowed = false;
+            else {
+              const fixed = { ...args, cmd: hash, shell: '/bin/sh', login: false };
+              replacements.push({ start: argument.getStart(source), end: argument.getEnd(), text: JSON.stringify(fixed) });
+            }
+          } else if (!(readCommand(command) || sdkCommand(command, runtime))) allowed = false;
         } catch { allowed = false; }
       } else if (name === 'tools.update_goal' || name === 'tools.get_goal') {
         try {
@@ -40,5 +54,13 @@ export function inspectIdeCodeMode(code, runtime) {
     }
     ts.forEachChild(node, visit);
   };
-  visit(source); return allowed;
+  visit(source);
+  if (!allowed) return { allowed: false };
+  let prepared = code;
+  for (const item of replacements.sort((a, b) => b.start - a.start)) {
+    prepared = `${prepared.slice(0, item.start)}${item.text}${prepared.slice(item.end)}`;
+  }
+  return { allowed: true, code: prepared };
 }
+
+export function inspectIdeCodeMode(code, runtime) { return prepareIdeCodeMode(code, runtime).allowed; }

package/ide-command.mjs

@@ -86,7 +86,7 @@ export function sdkCommand(parsed, runtime) {
   if (args[0] === 'usage' && args.length <= 2 && !parsed.input
     && (args[1] === undefined || /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(args[1]))) return { args };
   if (args[0] === 'local' && /^[a-z][a-z0-9-]+$/u.test(args[1] ?? '') && [2,3].includes(args.length) && parsed.input) return { args, input: parsed.input };
-  if (args[0] === 'scope-connect' && args.length === 2 && parsed.input) return { args, input: parsed.input };
+  if (['scope-connect', 'mutation-connect', 'mutation-settle', 'workflow-observe-step'].includes(args[0]) && args.length === 2 && parsed.input) return { args, input: parsed.input };
   if (args[0] === 'native' && args.length === 3 && parsed.input) return { args, input: parsed.input };
   return null;
 }
@@ -113,6 +113,32 @@ export function readCommand(parsed) {
   return false;
 }
 
+const runtimeHashTool = process.platform === 'darwin'
+  ? { name: 'shasum', executable: '/usr/bin/shasum', flags: ['-a', '256'] }
+  : process.platform === 'linux'
+    ? { name: 'sha256sum', executable: '/usr/bin/sha256sum', flags: [] } : null;
+
+export function runtimeHashCommand(runtime) {
+  const node = runtime?.node;
+  if (!runtimeHashTool || typeof node !== 'string' || node.length > 4096 || !path.isAbsolute(node)
+    || path.basename(node) !== 'node' || path.normalize(node) !== node
+    || !/^[A-Za-z0-9/._+@ -]+$/u.test(node)) return null;
+  return `/usr/bin/env -i PATH=/usr/bin:/bin ${runtimeHashTool.executable} ${[...runtimeHashTool.flags, '--'].join(' ')} '${node}'`;
+}
+
+export function runtimeHashRead(parsed, runtime) {
+  const canonical = runtimeHashCommand(runtime);
+  if (!canonical || !parsed || parsed.input) return null;
+  const words = parsed.words, { name, executable, flags } = runtimeHashTool;
+  const normal = [name, ...flags, runtime.node];
+  const absolute = [executable, ...flags, runtime.node];
+  const withSeparator = [executable, ...flags, '--', runtime.node];
+  const protectedCommand = ['/usr/bin/env', '-i', 'PATH=/usr/bin:/bin', ...withSeparator];
+  if ([normal, absolute, withSeparator, protectedCommand].some(expected =>
+    words.length === expected.length && words.every((word, index) => word === expected[index]))) return canonical;
+  return null;
+}
+
 export function renderSdkCommand(call, runtime, sessionId, host = process.env.ENTROROVE_IDE ?? 'Codex') {
   const quote = value => `'${String(value).replace(/'/gu, "'\\''")}'`;
   const header = `ENTROROVE_IDE=${quote(host)} ENTROROVE_SESSION=${quote(sessionId)} CODEX_THREAD_ID=${quote(sessionId)} ${[runtime.node, runtime.cli, ...call.args].map(quote).join(' ')}`;