@entrorove/skill 0.1.52 → 0.1.54

package/ide-hook.mjs

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
 import { realpathSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
-import { ideSession, ideRuntime, bindIdeAccount, ideContext, ideDigest, readBreakGlass } from './ide-session.mjs';
+import { ideSession, ideRuntime, bindIdeAccount, ideContext, ideDigest, readBreakGlass,
+  ideBlockIdentity, repeatedIdeBlock, observeIdeToolOutcome } from './ide-session.mjs';
 import { isStageTerminal, stageOf } from './local-stage-boundary.mjs';
-import { literalCommand, sdkCommand, readCommand, renderSdkCommand, installerCommand } from './ide-command.mjs';
-import { inspectIdeCodeMode } from './ide-code-mode.mjs';
+import { literalCommand, sdkCommand, readCommand, renderSdkCommand, installerCommand,
+  runtimeHashCommand, runtimeHashRead } from './ide-command.mjs';
+import { prepareIdeCodeMode } from './ide-code-mode.mjs';
 import { pathToFileURL } from 'node:url';
 import path from 'node:path';
 import { parseIdeResults, consumeIdeResults } from './ide-results.mjs';
@@ -25,7 +27,7 @@ function userPrompt(event) {
   }
   return prompt;
 }
-const managementOperations = new Set(['capabilities', 'help', 'start', 'continue', 'task-describe', 'flow-cancel', 'flow-abandon', 'scope-connect', 'status', 'feedback', 'cloud-status', 'cloud-watch', 'queue', 'unlock', 'usage', 'billing', 'recurring']);
+const managementOperations = new Set(['capabilities', 'help', 'start', 'continue', 'task-describe', 'flow-cancel', 'flow-abandon', 'scope-connect', 'mutation-connect', 'mutation-settle', 'mutation-consumption-attest', 'mutation-delegate-prepare', 'status', 'feedback', 'cloud-status', 'cloud-watch', 'queue', 'unlock', 'usage', 'billing', 'recurring']);
 function operationOf(call) {
   if (!call) return null;
   if (call.args[0] === 'invoke') return call.input?.operation ?? null;
@@ -33,17 +35,39 @@ function operationOf(call) {
   return call.args[0] ?? null;
 }
 function isManagementCall(call) { return managementOperations.has(operationOf(call)); }
-function resetBlockStreak(state) { state.blockStreak = 0; delete state.lastBlockKey; }
-function blockedReason(state, event, reason) {
-  const key = ideDigest({ tool: event.tool_name, phase: state.phase, reason });
+function resetBlockStreak(state) { state.blockStreak = 0; delete state.lastBlockKey; delete state.lastBlockIdentity; }
+function blockedReason(state, event, reason, detail = {}) {
+  const key = ideDigest({ identity: ideBlockIdentity(state), tool: event.tool_name, phase: state.phase, reason });
   const repeated = state.lastBlockKey === key;
   state.blockStreak = repeated ? (state.blockStreak ?? 0) + 1 : 1;
   state.lastBlockKey = key;
-  const mechanism = `机制：${state.stateFile ?? '会话状态文件'} 当前 phase=${state.phase}${state.pendingCall ? `，pendingCall=${state.pendingCall.toolUseId}` : ''}；该阶段只放行 Entrorove 管理调用，业务与写操作需先建立原 flow 并取得 nextStep。`;
+  state.lastBlockIdentity = ideBlockIdentity(state);
+  const mechanism = detail.mechanism ?? `机制：${state.stateFile ?? '会话状态文件'} 当前 phase=${state.phase}${state.pendingCall ? `，pendingCall=${state.pendingCall.toolUseId}` : ''}；该阶段只放行 Entrorove 管理调用，业务与写操作需先建立原 flow 并取得 nextStep。`;
   const repeat = repeated && state.blockStreak >= 2 ? `同一阻断已出现 ${state.blockStreak} 次，禁止再次检查：说明机制、给出绕过方案并执行绕过。` : '';
-  return `${reason} ${mechanism} ${repeat}\n绕过方案（离线、无网络、无协议、不经 hook，终端直接运行）：\n${unlockCommand}\n执行后重试原管理调用；项目写入仍需原任务授权。`;
+  const recovery = detail.recovery ?? `绕过方案（离线、无网络、无协议、不经 hook，终端直接运行）：\n${unlockCommand}\n执行后重试原管理调用；项目写入仍需原任务授权。`;
+  return `${reason} ${mechanism} ${repeat}\n${recovery}`;
+}
+const denyBlocked = (state, event, reason, detail) => deny(blockedReason(state, event, reason, detail));
+function runtimeHashAttempt(command, parsed) {
+  const name = parsed?.words[0];
+  return ['shasum', '/usr/bin/shasum', 'sha256sum', '/usr/bin/sha256sum'].includes(name)
+    || name === '/usr/bin/env' && parsed.words[1] === '-i' && parsed.words[2] === 'PATH=/usr/bin:/bin'
+      && ['/usr/bin/shasum', '/usr/bin/sha256sum'].includes(parsed.words[3])
+    || typeof command === 'string' && /^\s*(?:(?:\/usr\/bin\/)?(?:shasum|sha256sum)|\/usr\/bin\/env\s+-i\s+PATH=\/usr\/bin:\/bin\s+\/usr\/bin\/(?:shasum|sha256sum))(?:\s|$)/u.test(command);
+}
+function safeHashToolInput(input) {
+  return input && typeof input === 'object' && Object.keys(input).every(key =>
+    ['cmd', 'command', 'workdir', 'max_output_tokens', 'yield_time_ms', 'shell', 'login'].includes(key))
+    && (input.shell === undefined || input.shell === '/bin/sh')
+    && (input.login === undefined || input.login === false);
+}
+function denyRuntimeHash(state, event, runtime) {
+  const safe = runtimeHashCommand(runtime);
+  return denyBlocked(state, event, 'ENTROROVE_IDE_RUNTIME_HASH_DENIED：仅允许读取本次安装所绑定的 Node 可执行文件 SHA-256。', {
+    mechanism: `机制：哈希路径必须精确等于受管 runtime.node；拒绝其他文件、额外参数、shell 展开和自定义执行器。当前 phase=${state.phase}。`,
+    recovery: `恢复：用固定只读命令重新取得该 Node 文件的哈希：\n${safe ?? '当前平台没有受支持的固定哈希命令；请使用受管安装所绑定的 Node 路径。'}${safe ? `\n代码模式请传静态 tools.exec_command({cmd:${JSON.stringify(safe)},shell:'/bin/sh',login:false})。` : ''}\n本次在 hook 本地预检中拒绝，未发起协议请求，因此没有 requestId。`,
+  });
 }
-const denyBlocked = (state, event, reason) => deny(blockedReason(state, event, reason));
 function lifecycleResult(value, depth = 0) {
   if (!value || typeof value !== 'object' || depth > 4) return null;
   if (value.operation === 'flow-cancel' || value.operation === 'flow-abandon') return value;
@@ -140,11 +164,11 @@ async function beforeTool(event, state, home) {
     const observer = discovery || ['status','feedback','cloud-status','configure','agreement','install','queue','flows','usage','billing','recurring'].includes(call.args[0]);
     if (unclassifiedIdeRequirements(state) && !observer && !(unlocked && isManagementCall(call))) return denyBlocked(state, event, 'Entrorove：新需求已保存，先用 queue status 读取并按轻重缓急 route 分类；禁止丢弃新需求或覆盖原任务。');
     if (newStart && !checkQueuedStart(state,call)) return denyBlocked(state, event, 'Entrorove：新任务目标必须与实际进入队列的用户原文一致。');
-    if (call.args[0] === 'local' && !discovery && !state.flowId) return denyBlocked(state, event, 'Entrorove：本地执行前必须先受理原任务并绑定账号、flowId 与仓库；不能直接使用其它流程的通行证。');
+    if (['local', 'mutation-connect', 'mutation-settle', 'workflow-observe-step'].includes(call.args[0]) && !discovery && !state.flowId) return denyBlocked(state, event, 'Entrorove：本地执行前必须先受理原任务并绑定账号、flowId 与仓库；不能直接使用其它流程的通行证。');
     if (state.pendingCall && !observer && !(unlocked && isManagementCall(call))) return denyBlocked(state, event, 'Entrorove：原调用尚未收到结束回执；先只读恢复其状态，禁止并发重发。');
     const input = call.args[0] === 'invoke' ? call.input?.input : call.input;
     if (input?.flowId && state.flowId && input.flowId !== state.flowId || input?.taskId && state.taskId && ['cloud-watch','cloud-status'].includes(call.args[0]) && input.taskId !== state.taskId) return denyBlocked(state, event, 'Entrorove：调用与本 IDE 任务的原编号不一致。');
-    if (call.args[0] === 'scope-connect' && call.args[1] !== state.repositoryRoot
+    if (['scope-connect', 'mutation-connect', 'mutation-settle', 'workflow-observe-step'].includes(call.args[0]) && call.args[1] !== state.repositoryRoot
       || call.args[0] === 'local' && (input?.repositoryRoot && input.repositoryRoot !== state.repositoryRoot || call.args[2] && call.args[2] !== state.repositoryRoot)) return denyBlocked(state, event, 'Entrorove：调用不能替换本任务的实际仓库。');
     let requestId;
     if (newStart) state.taskGoal = call.args[0] === 'cloud-task' ? call.input?.goal : call.input?.input?.task?.goal;
@@ -152,7 +176,10 @@ async function beforeTool(event, state, home) {
       const { buildInvocation } = await import(pathToFileURL(path.join(path.dirname(runtime.cli), 'remote-client.mjs')).href);
       requestId = buildInvocation(call.input.operation, call.input.input).requestId;
     }
-    const pending = { toolUseId: event.tool_use_id, inputDigest: ideDigest(call), command: call.args[0], ...(requestId ? { requestId } : {}) };
+    const pending = { toolUseId: event.tool_use_id, inputDigest: ideDigest(call), command: call.args[0],
+      operation: operationOf(call), observer, managementOnly: observer || isManagementCall(call)
+        && !['start', 'continue', 'cloud-task'].includes(operationOf(call)) || operationOf(call) === 'task-checkpoint',
+      ...(requestId ? { requestId } : {}) };
     if (observer) {
       state.readCalls ??= {};
       if (Object.keys(state.readCalls).length >= 32) return denyBlocked(state, event, 'Entrorove：只读恢复尚未返回，请等待原调用。');
@@ -160,16 +187,32 @@ async function beforeTool(event, state, home) {
     } else state.pendingCall = pending;
     const installation = call.args[0] === 'install' && parsed.words.some(word => ['npx','npx.cmd'].includes(word));
     const rewritten = renderSdkCommand(call, runtime, state.sessionId);
-    resetBlockStreak(state);
     return output('PreToolUse', { permissionDecision: 'allow', ...(installation ? {} : { updatedInput: { ...event.tool_input, command: rewritten,
       ...(Object.hasOwn(event.tool_input ?? {}, 'cmd') ? { cmd: rewritten } : {}) } }), additionalContext: ideContext(state) });
   }
   if (!state.active) return {};
   if (['exec','functions.exec'].includes(event.tool_name)) {
     const current = await ideRuntime(home), code = typeof event.tool_input === 'string' ? event.tool_input : event.tool_input?.code;
-    return inspectIdeCodeMode(code, current) ? output('PreToolUse', { additionalContext: ideContext(state) }) : denyBlocked(state, event, 'Entrorove：代码模式含未批准的原生执行或动态工具输入；请使用原任务的受控入口。');
+    const prepared = prepareIdeCodeMode(code, current);
+    if (prepared.allowed) return output('PreToolUse', { additionalContext: ideContext(state),
+      ...(prepared.code === code ? {} : { updatedInput: typeof event.tool_input === 'string' ? prepared.code
+        : { ...event.tool_input, code: prepared.code } }) });
+    if (typeof code === 'string' && /\b(?:shasum|sha256sum)\b/u.test(code)) return denyRuntimeHash(state, event, current);
+    return denyBlocked(state, event, 'Entrorove：代码模式含未批准的原生执行或动态工具输入；请使用原任务的受控入口。');
   }
   if (event.tool_name === 'update_goal' && (state.phase === 'setup' || unlocked)) return output('PreToolUse', { additionalContext: ideContext(state) });
+  if (isShell) {
+    const fixedHash = runtimeHashRead(parsed, runtime);
+    if (fixedHash) {
+      if (!safeHashToolInput(event.tool_input)) return denyRuntimeHash(state, event, runtime);
+      resetBlockStreak(state);
+      return output('PreToolUse', { permissionDecision: 'allow', updatedInput: { ...event.tool_input, command: fixedHash,
+        ...(Object.hasOwn(event.tool_input ?? {}, 'cmd') ? { cmd: fixedHash } : {}),
+        ...(event.tool_name === 'exec_command' ? { shell: '/bin/sh', login: false } : {}) },
+      additionalContext: ideContext(state) });
+    }
+    if (runtimeHashAttempt(command, parsed)) return denyRuntimeHash(state, event, runtime ?? await ideRuntime(home));
+  }
   if (isShell && readCommand(parsed) || readTools.has(event.tool_name)) return output('PreToolUse', { additionalContext: ideContext(state) });
   return denyBlocked(state, event, `Entrorove：已阻止原生 ${event.tool_name ?? 'unknown'} 调用。当前阶段 ${state.phase}${state.taskNumber ? `，云端任务 ${state.taskNumber}` : ''}。写入、删除、移动及不确定的终端操作必须使用原任务的 guarded-write／guarded-delete／guarded-move 或已批准的执行计划。`);
 }
@@ -178,6 +221,10 @@ export async function runIdeHook(event, { home } = {}) {
     const name = event.hook_event_name;
     const selected = name === 'UserPromptSubmit' && selectPrompt.test(userPrompt(event));
     const newSelection = selected && !state.active;
+    if (name === 'UserPromptSubmit') {
+      state.turnSequence = (Number.isSafeInteger(state.turnSequence) ? state.turnSequence : 0) + 1;
+      delete state.stopNoticeTurn;
+    }
     if (name === 'PreToolUse') state.enforcement = 'enforced';
     if (name === 'UserPromptSubmit' && exitPrompt.test(userPrompt(event))) {
       if (state.phase !== 'user-exited') state.exitPhase = state.phase;
@@ -224,16 +271,22 @@ export async function runIdeHook(event, { home } = {}) {
       const recoveredOriginal = pendingRead && state.pendingCall?.requestId
         && values.some(result => (result.output ?? result).requestId === state.pendingCall.requestId);
       const messages = collectResult(state, bound, pending.command === 'local');
+      observeIdeToolOutcome(state, bound, pending);
       if (pendingRead) delete state.readCalls[event.tool_use_id];
       if (!pendingRead || recoveredOriginal) delete state.pendingCall;
-      const resumed = await advanceIdeQueue(state,home);
+      const resumed = state.phase === 'blocked' || repeatedIdeBlock(state) ? '' : await advanceIdeQueue(state,home);
       if (resumed) messages.push(resumed);
       return { ...output(name, { additionalContext: ideContext(state) }), ...(messages.length ? { systemMessage: messages.join('\n') } : {}) };
     }
     if (name==='Stop' && state.active && !(await readBreakGlass(home, state.sessionId))) {
+      const turn = state.turnSequence ?? 0;
+      if (repeatedIdeBlock(state) || event.stop_hook_active === true || state.stopNoticeTurn === turn) return {};
       const resumed = await advanceIdeQueue(state,home);
       if (resumed || unclassifiedIdeRequirements(state) || unfinishedIdeQueue(state) && !['blocked','needs-input','delivered'].includes(state.phase)
-        || !['ended','blocked','needs-input','setup','delivered'].includes(state.phase)) return {decision:'block',reason:blockedReason(state, event, `${ideContext(state)}${ideQueueContext(state)}${resumed}原任务或队列尚未取得结束回执；继续可运行工作，真实阻断必须明确报告。`)};
+        || !['ended','blocked','needs-input','setup','delivered'].includes(state.phase)) {
+        state.stopNoticeTurn = turn;
+        return {decision:'block',reason:`${ideContext(state)}${ideQueueContext(state)}${resumed}原任务或队列尚未取得结束回执；本轮仅提醒一次继续可运行工作。真实阻断应明确报告并等待修复，目标与队列保持不变。`};
+      }
     }
     return state.active && ['SessionStart','UserPromptSubmit','PostCompact','PreCompact'].includes(name) ? output(name, { additionalContext: `${ideContext(state)}${ideQueueContext(state)}` }) : {};
   }, home);

package/ide-results.mjs

@@ -46,15 +46,17 @@ export async function consumeIdeResults(event, state, pending, home) {
   return proof.values;
 }
 export function captureIdeResults() {
-  const original = process.stdout.write, chunks = [];
+  const original = process.stdout.write, originalError = process.stderr.write, chunks = [], errors = [];
   let size = 0;
-  process.stdout.write = function(chunk, ...rest) {
+  const capture = (writer, target) => function(chunk, ...rest) {
     size += Buffer.byteLength(chunk);
-    if (size <= 8_000_000) chunks.push(Buffer.isBuffer(chunk) ? chunk.toString('utf8') : chunk);
-    return original.call(this, chunk, ...rest);
+    if (size <= 8_000_000) target.push(Buffer.isBuffer(chunk) ? chunk.toString('utf8') : chunk);
+    return writer.call(this, chunk, ...rest);
   };
+  process.stdout.write = capture(original, chunks);
+  process.stderr.write = capture(originalError, errors);
   return async () => {
-    process.stdout.write = original;
-    if (size <= 8_000_000) await persistIdeResults(ideResultContext(), parseIdeResults(chunks.join('')));
+    process.stdout.write = original; process.stderr.write = originalError;
+    if (size <= 8_000_000) await persistIdeResults(ideResultContext(), [...parseIdeResults(chunks.join('')), ...parseIdeResults(errors.join(''))]);
   };
 }

package/ide-session.mjs

@@ -83,10 +83,53 @@ export async function ideRuntime(home = os.homedir()) {
   if (ideDigest(cli.toString('utf8')) !== runtime.cliDigest) throw ideError('ENTROROVE_IDE_RUNTIME', 'Installed CLI changed; reinstall the managed runtime');
   return runtime;
 }
+export const ideBlockIdentity = state => ideDigest({ repositoryRoot: state.repositoryRoot, flowId: state.flowId, taskId: state.taskId });
+export function repeatedIdeBlock(state) {
+  const identity = ideBlockIdentity(state);
+  return state.executionBlock?.identity === identity && state.executionBlock.count >= 2
+    || state.lastBlockIdentity === identity && state.blockStreak >= 2;
+}
+function outcomeNodes(values) {
+  const pending = values.map(value => ({ value, depth: 0 })), nodes = [];
+  while (pending.length && nodes.length < 64) {
+    const { value, depth } = pending.shift();
+    if (!value || typeof value !== 'object' || depth > 4) continue;
+    nodes.push(value);
+    for (const key of ['output', 'result']) if (value[key]) pending.push({ value: value[key], depth: depth + 1 });
+  }
+  return nodes;
+}
+export function observeIdeToolOutcome(state, values, pending) {
+  if (state.phase === 'ended' || !state.flowId && !state.taskId) { delete state.executionBlock; return; }
+  const nodes = outcomeNodes(values), identity = ideBlockIdentity(state);
+  const failure = nodes.findLast(value => ['blocked', 'failed', 'incomplete'].includes(value.status)
+    || ['blocked', 'failed'].includes(value.taskStatus));
+  const previous = state.executionBlock?.identity === identity ? state.executionBlock : null;
+  const management = pending.observer || pending.managementOnly;
+  if (failure) {
+    const key = ideDigest({ identity, inputDigest: pending.inputDigest });
+    // Management observations cannot replace a failed execution's identity or
+    // clear its streak. One consumed call counts once, even with two copies.
+    if (!management || !previous || previous.key === key) {
+      state.executionBlock = { identity, key, operation: pending.operation ?? pending.command,
+        count: previous?.key === key ? previous.count + Number(previous.toolUseId !== pending.toolUseId) : 1,
+        toolUseId: pending.toolUseId, observedAt: new Date().toISOString() };
+    }
+    state.phase = 'blocked';
+    return;
+  }
+  if (management && previous) { state.phase = 'blocked'; return; }
+  if (!management && nodes.some(value => ['verified', 'succeeded', 'started', 'reported'].includes(value.status) || value.nextStep)) {
+    delete state.executionBlock; state.blockStreak = 0; delete state.lastBlockKey; delete state.lastBlockIdentity;
+  }
+}
 export function ideContext(state) {
   const delivered = state.phase === 'delivered' && Number.isSafeInteger(state.deliveredStage)
     ? `阶段 ${state.deliveredStage} 已按边界独立交付（终态，不等于失败或阻塞）；续跑从下一个边界继续，不重新执行已交付阶段。` : '';
-  return `Entrorove 已强制接管本任务。${state.taskNumber ? `云端任务 ${state.taskNumber}。` : '尚未获得云端任务编号，不得声称已进入云端。'}${state.flowId ? `继续原 flowId=${state.flowId}，` : ''}${state.requestId ? `原 requestId=${state.requestId}。` : ''}当前阶段 ${state.phase}。${delivered}必须读 SKILL.md 并执行返回的 nextStep；禁止在失败后替换执行器。源文件、数据及终端写入必须走原任务的受控入口。`;
+  const waiting = repeatedIdeBlock(state);
+  const action = waiting ? '同一真实阻断已达到两次；本轮允许结束并等待修复，禁止原样第三次重试。原目标、flow 与队列均保留。'
+    : '必须读 SKILL.md 并执行返回的 nextStep；禁止在失败后替换执行器。';
+  return `${waiting ? 'Entrorove 原任务绑定已保留。' : 'Entrorove 已强制接管本任务。'}${state.taskNumber ? `云端任务 ${state.taskNumber}。` : '尚未获得云端任务编号，不得声称已进入云端。'}${state.flowId ? `继续原 flowId=${state.flowId}，` : ''}${state.requestId ? `原 requestId=${state.requestId}。` : ''}当前阶段 ${state.phase}。${delivered}${action}源文件、数据及终端写入必须走原任务的受控入口。`;
 }
 // Verified hosts only: the guard is universal in shape (host label + session
 // id), and each host proves itself through its own adapter callback.

package/local-approved-plan.mjs

@@ -1,10 +1,9 @@
 import { LOCAL_OPERATION_SCHEMAS } from './local-contracts.mjs';
 import { createHash, createPrivateKey, createPublicKey, randomUUID, sign } from 'node:crypto';
-import { spawn } from 'node:child_process';
+import { runApprovedProcess } from './local-approved-process.mjs';
 import { promises as fs, constants } from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { performance } from 'node:perf_hooks';
 import { assertBudgetRunnerAllowed } from './local-budget-reads.mjs';
 import { validateRunnerParallelPaths, captureRunnerEquivalence } from './local-equivalence-runner.mjs';
 import { disciplineApprovedPolicy, disciplineDataSnapshotsBound } from './local-discipline-contracts.mjs';
@@ -87,25 +86,8 @@ async function authority(input) {
   return { root, plan, planFile, approval, signing };
 }
 
-function runCommand(authority) {
-  return new Promise((resolve, reject) => {
-    const started = performance.now(); const { policy } = authority.plan; const remaining = authority.executionDeadlineAt ? Date.parse(authority.executionDeadlineAt) - Date.now() : policy.timeoutMs;
-    if (remaining <= 0) { reject(Object.assign(new Error('workflow execution lease expired before process launch'), { code: 'ENTROROVE_WORKFLOW_EXPIRED' })); return; }
-    const child = spawn(policy.executable, policy.args, { cwd: authority.root, env: { ...policy.environment }, shell: false, detached: true, stdio: ['ignore', 'pipe', 'pipe'] });
-    const stdout = []; const stderr = []; let bytes = 0; let dropped = 0; let timedOut = false; let terminating = false; let spawned = false; let processStartedAt = null; let spawnError = null; let timer; let killTimer; const stdoutHash = createHash('sha256'); const stderrHash = createHash('sha256');
-    const terminate = () => { if (terminating) return; terminating = true; try { process.kill(-child.pid, 'SIGTERM'); } catch {} killTimer = setTimeout(() => { try { process.kill(-child.pid, 'SIGKILL'); } catch {} }, 250); killTimer.unref(); };
-    const consume = (target, hash, chunk) => { const data = Buffer.from(chunk); hash.update(data); const keep = Math.max(0, Math.min(data.length, policy.maxOutputBytes - bytes)); if (keep) target.push(data.subarray(0, keep)); bytes += keep; dropped += data.length - keep; if (dropped) terminate(); };
-    child.stdout.on('data', chunk => consume(stdout, stdoutHash, chunk)); child.stderr.on('data', chunk => consume(stderr, stderrHash, chunk));
-    child.once('spawn', () => { spawned = true; processStartedAt = new Date().toISOString(); }); child.once('error', error => { spawnError = error; terminate(); }); timer = setTimeout(() => { timedOut = true; terminate(); }, Math.min(policy.timeoutMs, remaining));
-    child.once('close', (exitCode, signal) => {
-      clearTimeout(timer); clearTimeout(killTimer);
-      const processResult = { schemaVersion: RUNNER_SCHEMA, status: exitCode === 0 && signal === null && !timedOut && !dropped && !spawnError ? 'succeeded' : 'failed', exitCode, signal, timedOut, outputLimitExceeded: dropped > 0, durationMs: Math.max(0, Math.round(performance.now() - started)), stdout: Buffer.concat(stdout).toString('utf8'), stderr: Buffer.concat(stderr).toString('utf8'), stdoutSha256: stdoutHash.digest('hex'), stderrSha256: stderrHash.digest('hex'), capturedBytes: bytes, droppedBytes: dropped,
-        ...(authority.objectPlan ? { started: spawned, startedAt: processStartedAt, finishedAt: new Date().toISOString(), executionDeadlineExceeded: timedOut && remaining <= policy.timeoutMs } : {}) };
-      if (spawnError) { spawnError.execution = { schemaVersion: RUNNER_SCHEMA, status: 'failed', process: processResult, evidence: [], effects: spawned ? 'unknown' : 'none' }; reject(spawnError); return; }
-      resolve(processResult);
-    });
-  });
-}
+const runCommand = authority => runApprovedProcess({ ...authority, policy: authority.plan.policy });
+
 async function subject(authority, result) {
   const equivalence = await captureRunnerEquivalence(authority, result, projectFile);
   return { schemaVersion: 'validator.validation-subject/1.0', artifactSha256: authority.plan.artifactSha256, memberId: authority.plan.memberId, chainId: authority.plan.chainId, executedAt: new Date().toISOString(), files: authority.plan.files, validationRunId: authority.plan.validationRunId, planId: authority.plan.planId, tests: authority.plan.tests, policy: { command: [authority.plan.policy.executable, ...authority.plan.policy.args].map(value => JSON.stringify(value)).join(' '), requiredExitCode: 0, executionPlanSha256: authority.planFile.sha256, ...(authority.plan.policy.parallelPaths ? { parallelPaths: authority.plan.policy.parallelPaths } : {}), ...(authority.plan.policy.discipline ? { disciplineReviewRequired: true } : {}), ...(authority.plan.evidencePolicy ? { evidenceKind: authority.plan.evidencePolicy.kind, evidenceRunner: authority.plan.evidencePolicy.runner, workflowBinding: { flowId: authority.plan.evidencePolicy.flowId, stepId: authority.plan.evidencePolicy.stepId }, ...(authority.plan.evidencePolicy.localVerification ? { localVerification: authority.plan.evidencePolicy.localVerification } : {}) } : {}) }, ...(equivalence === undefined ? {} : { equivalence }), ...(authority.disciplineComparison ? { disciplineComparison: authority.disciplineComparison } : {}), goldenBaseline: authority.plan.goldenBaseline, contracts: authority.plan.contracts, execution: { exitCode: result.exitCode, signal: result.signal, timedOut: result.timedOut, outputLimitExceeded: result.outputLimitExceeded } }; }

package/local-approved-process.mjs

@@ -0,0 +1,54 @@
+import { fork } from 'node:child_process';
+import { performance } from 'node:perf_hooks';
+
+const SUPERVISOR = new URL('./local-approved-supervisor.mjs', import.meta.url);
+const MESSAGE_SCHEMA = 'entrorove.approved-process-supervision/1.0';
+const RUNNER_SCHEMA = 'entrorove.validator-local-runner/1.0';
+
+function launchInput(authority) {
+  const now = Date.now(), policy = authority.policy;
+  const leaseDeadline = authority.executionDeadlineAt === undefined ? Infinity : Date.parse(authority.executionDeadlineAt);
+  const startDeadlineAt = authority.startDeadlineAt === undefined ? null : Date.parse(authority.startDeadlineAt);
+  if ((!Number.isFinite(leaseDeadline) && leaseDeadline !== Infinity) || leaseDeadline <= now
+    || (startDeadlineAt !== null && (!Number.isFinite(startDeadlineAt) || startDeadlineAt <= now))) {
+    throw Object.assign(new Error('workflow execution lease expired before process launch'), { code: 'ENTROROVE_WORKFLOW_EXPIRED' });
+  }
+  return { schemaVersion: MESSAGE_SCHEMA, root: authority.root, executable: policy.executable, args: policy.args,
+    environment: policy.environment, timeoutMs: policy.timeoutMs, maxOutputBytes: policy.maxOutputBytes,
+    objectPlan: Boolean(authority.objectPlan), deadlineAt: Math.min(now + policy.timeoutMs, leaseDeadline), startDeadlineAt,
+    leaseDeadline: leaseDeadline <= now + policy.timeoutMs };
+}
+
+function supervisionError(code, message, effects = 'unknown') {
+  return Object.assign(new Error(message), { code,
+    execution: { schemaVersion: RUNNER_SCHEMA, status: 'failed', evidence: [], effects } });
+}
+
+export async function runApprovedProcess(authority) {
+  const started = performance.now(), input = launchInput(authority);
+  return new Promise((resolve, reject) => {
+    let finished = false;
+    const supervisor = fork(SUPERVISOR, [], { execPath: process.execPath, execArgv: [], env: {}, detached: true,
+      stdio: ['ignore', 'ignore', 'ignore', 'ipc'], serialization: 'json' });
+    const finish = (error, result) => {
+      if (finished) return; finished = true;
+      if (supervisor.connected) supervisor.disconnect();
+      if (error) reject(error); else resolve({ ...result, durationMs: Math.max(0, Math.round(performance.now() - started)) });
+    };
+    supervisor.on('message', message => {
+      if (message?.schemaVersion !== MESSAGE_SCHEMA || message.type !== 'result') return;
+      if (message.error) {
+        const error = Object.assign(new Error(message.error.message), { code: message.error.code });
+        if (message.process) error.execution = { schemaVersion: RUNNER_SCHEMA, status: 'failed', process: message.process,
+          evidence: [], effects: message.process.started === true ? 'unknown' : 'none' };
+        finish(error); return;
+      }
+      finish(null, message.process);
+    });
+    supervisor.once('error', () => finish(supervisionError('ENTROROVE_PROCESS_SUPERVISOR', 'Approved process supervision could not start', 'none')));
+    supervisor.once('close', () => { if (!finished) finish(supervisionError('ENTROROVE_PROCESS_SUPERVISOR', 'Approved process supervision ended without a result')); });
+    supervisor.send(input, error => {
+      if (error) finish(supervisionError('ENTROROVE_PROCESS_SUPERVISOR', 'Approved process supervision could not receive its frozen command', 'none'));
+    });
+  });
+}

package/local-approved-supervisor.mjs

@@ -0,0 +1,99 @@
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import { performance } from 'node:perf_hooks';
+
+const MESSAGE_SCHEMA = 'entrorove.approved-process-supervision/1.0';
+const RUNNER_SCHEMA = 'entrorove.validator-local-runner/1.0';
+const FIELDS = ['schemaVersion', 'root', 'executable', 'args', 'environment', 'timeoutMs', 'maxOutputBytes', 'objectPlan', 'deadlineAt', 'startDeadlineAt', 'leaseDeadline'];
+const ENV = /^[A-Za-z_][A-Za-z0-9_]*$/;
+
+function validInput(value) {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    && Object.keys(value).sort().join('|') === [...FIELDS].sort().join('|') && value.schemaVersion === MESSAGE_SCHEMA
+    && typeof value.root === 'string' && path.isAbsolute(value.root) && !value.root.includes('\0')
+    && typeof value.executable === 'string' && path.isAbsolute(value.executable) && !value.executable.includes('\0')
+    && Array.isArray(value.args) && value.args.length <= 128
+    && value.args.every(item => typeof item === 'string' && !item.includes('\0') && item.length <= 4096)
+    && value.environment && typeof value.environment === 'object' && !Array.isArray(value.environment)
+    && Object.keys(value.environment).length <= 64
+    && Object.entries(value.environment).every(([key, item]) => ENV.test(key) && typeof item === 'string' && !item.includes('\0') && item.length <= 16_384)
+    && Number.isSafeInteger(value.timeoutMs) && value.timeoutMs > 0 && value.timeoutMs <= 300_000
+    && Number.isSafeInteger(value.maxOutputBytes) && value.maxOutputBytes > 0 && value.maxOutputBytes <= 1_048_576
+    && typeof value.objectPlan === 'boolean' && typeof value.leaseDeadline === 'boolean'
+    && (value.startDeadlineAt === null || Number.isSafeInteger(value.startDeadlineAt))
+    && Number.isSafeInteger(value.deadlineAt) && value.deadlineAt <= Date.now() + value.timeoutMs;
+}
+
+function resultMessage(processResult, error) {
+  return { schemaVersion: MESSAGE_SCHEMA, type: 'result', process: processResult,
+    ...(error ? { error: { code: error.code ?? 'ENTROROVE_PROCESS_SUPERVISOR', message: String(error.message).slice(0, 1024) } } : {}) };
+}
+
+function deliver(value) {
+  if (!process.connected) return;
+  process.send(value, () => { if (process.connected) process.disconnect(); });
+}
+
+function assertLaunchable(input) {
+  if (!process.connected || input.deadlineAt <= Date.now() || input.startDeadlineAt !== null && input.startDeadlineAt <= Date.now()) {
+    throw Object.assign(new Error('workflow execution lease expired before process launch'), { code: 'ENTROROVE_WORKFLOW_EXPIRED' });
+  }
+}
+
+function supervise(input) {
+  const started = performance.now(), stdout = [], stderr = [], stdoutHash = createHash('sha256'), stderrHash = createHash('sha256');
+  let bytes = 0, dropped = 0, timedOut = false, terminating = false, spawned = false, closed = false;
+  let processStartedAt = null, spawnError = null, killTimer;
+  assertLaunchable(input);
+  const child = spawn(input.executable, input.args, { cwd: input.root, env: { ...input.environment },
+    shell: false, detached: true, stdio: ['ignore', 'pipe', 'pipe'] });
+  const signalGroup = signal => { if (!closed && child.pid) { try { process.kill(-child.pid, signal); } catch {} } };
+  const terminate = () => {
+    if (terminating || closed) return; terminating = true; signalGroup('SIGTERM');
+    killTimer = setTimeout(() => signalGroup('SIGKILL'), 250);
+  };
+  const consume = (target, hash, chunk) => {
+    const data = Buffer.from(chunk); hash.update(data);
+    const keep = Math.max(0, Math.min(data.length, input.maxOutputBytes - bytes));
+    if (keep) target.push(data.subarray(0, keep)); bytes += keep; dropped += data.length - keep;
+    if (dropped) terminate();
+  };
+  const timer = setTimeout(() => { timedOut = true; terminate(); }, Math.max(1, input.deadlineAt - Date.now()));
+  process.once('disconnect', terminate); process.once('SIGTERM', terminate); process.once('SIGINT', terminate);
+  child.stdout.on('data', chunk => consume(stdout, stdoutHash, chunk)); child.stderr.on('data', chunk => consume(stderr, stderrHash, chunk));
+  child.once('spawn', () => { spawned = true; processStartedAt = new Date().toISOString(); });
+  child.once('error', error => { spawnError = error; terminate(); });
+  child.once('exit', () => signalGroup('SIGKILL'));
+  child.once('close', (exitCode, signal) => {
+    closed = true; clearTimeout(timer); clearTimeout(killTimer);
+    process.removeListener('disconnect', terminate); process.removeListener('SIGTERM', terminate); process.removeListener('SIGINT', terminate);
+    const processResult = { schemaVersion: RUNNER_SCHEMA,
+      status: exitCode === 0 && signal === null && !timedOut && !dropped && !spawnError ? 'succeeded' : 'failed',
+      exitCode, signal, timedOut, outputLimitExceeded: dropped > 0, durationMs: Math.max(0, Math.round(performance.now() - started)),
+      stdout: Buffer.concat(stdout).toString('utf8'), stderr: Buffer.concat(stderr).toString('utf8'),
+      stdoutSha256: stdoutHash.digest('hex'), stderrSha256: stderrHash.digest('hex'), capturedBytes: bytes, droppedBytes: dropped,
+      ...(input.objectPlan ? { started: spawned, startedAt: processStartedAt, finishedAt: new Date().toISOString(),
+        executionDeadlineExceeded: timedOut && input.leaseDeadline } : {}) };
+    deliver(resultMessage(processResult, spawnError));
+  });
+  if (!process.connected) terminate();
+}
+
+function main() {
+  if (process.argv.length !== 2 || typeof process.send !== 'function' || !process.connected) { process.exitCode = 2; return; }
+  const startup = setTimeout(() => { if (process.connected) process.disconnect(); }, 5_000);
+  const disconnect = () => clearTimeout(startup); process.once('disconnect', disconnect);
+  process.once('message', input => {
+    clearTimeout(startup); process.removeListener('disconnect', disconnect);
+    if (!process.connected) return;
+    if (!validInput(input)) {
+      deliver(resultMessage(null, { code: 'ENTROROVE_PROCESS_SUPERVISOR', message: 'Approved process supervision requires one bounded frozen command' })); return;
+    }
+    try { supervise(input); }
+    catch (error) { deliver(resultMessage(null, error.code === 'ENTROROVE_WORKFLOW_EXPIRED' ? error
+      : { code: 'ENTROROVE_PROCESS_SUPERVISOR', message: 'Approved process supervision could not launch its frozen command' })); }
+  });
+}
+
+main();

package/local-cli.mjs

@@ -28,6 +28,10 @@ import { DISCIPLINE_LOCAL_OPERATIONS } from './local-discipline-operations.mjs';
 import { assertIdeExecution, settleBreakGlassSession } from './ide-session.mjs';
 import { runManagedWorkflowLocalStep } from './workflow-local-client.mjs';
 import { localErrorEnvelope } from './local-error.mjs';
+import { preparePreservedMutationSigner } from './local-preserved-mutation-signer.mjs';
+import { hydrateCloudMutationAuthority } from './cloud-mutation-authority.mjs';
+import { attestMutationConsumption14 } from './local-mutation-consumption.mjs';
+import { apiUrl } from './remote-client.mjs';
 
 async function stdinJson() {
   let raw = '';
@@ -40,6 +44,8 @@ async function stdinJson() {
 }
 
 const operations = {
+  'mutation-consumption-attest': attestMutationConsumption14,
+  'mutation-delegate-prepare': preparePreservedMutationSigner,
   ...DISCIPLINE_LOCAL_OPERATIONS,
   'snapshot-plan': snapshotPlan, 'snapshot-verify': snapshotVerify, 'mutation-snapshot-attest': attestMutationSnapshot14, 'mutate-gate': mutateGate,
   'gate-issue': issueMutationPass, 'gate-verify': verifyMutationPass, 'guarded-write': guardedWrite,
@@ -79,7 +85,11 @@ function capabilitiesFor(group) {
 }
 
 async function checkedLocalInput(operation, input) {
-  try { return validateLocalInput(operation, input); }
+  try {
+    const validated = validateLocalInput(operation, input);
+    if (['mutation-snapshot-attest', 'mutation-consumption-attest', 'workflow-run-step', 'mutate-gate', 'gate-issue', 'gate-verify', 'guarded-write', 'guarded-delete', 'guarded-move', 'discipline-review', 'discipline-check'].includes(operation)) await hydrateCloudMutationAuthority(input.home, new URL(apiUrl).origin);
+    return validated;
+  }
   catch (cause) {
     if (['guarded-write', 'guarded-delete', 'guarded-move', 'gate-issue', 'mutate-gate', 'mutation-snapshot-attest'].includes(operation)) await recordMutationDenied14(input, cause, operation);
     throw cause;
@@ -94,9 +104,10 @@ export async function runLocal(args = [], dependencies) {
       process.stdout.write(`${JSON.stringify(capabilitiesFor(args[1]))}\n`); return;
     }
     const handler = operations[operation];
-    if (!handler) throw new Error(`Usage: entrorove local <${['capabilities', ...Object.keys(operations)].join('|')}> [repositoryRoot]`);
+    if (!handler && process.stdin.isTTY) throw new Error(`Unsupported local operation: ${operation}`);
     const input = await stdinJson();
     await assertIdeExecution(['local', ...args], input);
+    if (!handler) throw new Error(`Usage: entrorove local <${['capabilities', ...Object.keys(operations)].join('|')}> [repositoryRoot]`);
     if (args[1] && input.repositoryRoot === undefined) input.repositoryRoot = args[1];
     const validated = await checkedLocalInput(operation, input);
     const supplied = operation === 'workflow-run-step' || Object.hasOwn(LOCAL_CHAIN_OPERATIONS, operation) ? dependencies : undefined;

package/local-contracts.mjs

@@ -29,6 +29,8 @@ add('flow-cancel|flow-abandon', flowLifecycle, ['repositoryRoot', 'flowId']);
 add('snapshot-plan', { ...step, paths, snapshotId: identifier, contractDigest: nullable(sha256), handoffCandidate: HANDOFF_SNAPSHOT_CANDIDATE_SCHEMA }, ['repositoryRoot', 'flowId', 'stepId', 'paths']);
 add('snapshot-verify', { ...step, snapshotId: identifier }, ['repositoryRoot', 'flowId', 'stepId', 'snapshotId']);
 const gate = { ...step, taskId: identifier, mutationPass: record };
+add('mutation-delegate-prepare', { ...step, taskId: identifier }, ['repositoryRoot', 'home', 'flowId']);
+add('mutation-consumption-attest', { ...step, taskId: identifier, gatePassPath: text }, ['repositoryRoot', 'flowId', 'stepId', 'gatePassPath']);
 add('mutate-gate|gate-issue', gate, ['repositoryRoot', 'flowId', 'stepId', 'mutationPass']);
 add('mutation-snapshot-attest', { ...step, taskId: identifier, snapshotId: identifier, challenge: record, signerConfigPath: text },
   ['repositoryRoot', 'flowId', 'stepId', 'snapshotId', 'challenge', 'signerConfigPath']);