@entrorove/skill 0.1.52 → 0.1.54

package/local-scope-require-resolution.mjs

@@ -0,0 +1,78 @@
+import path from 'node:path';
+import { builtinModules } from 'node:module';
+import ts from 'typescript';
+import { scopeFail, scopePath } from './local-scope-files.mjs';
+
+const virtualRoot = '/entrorove-repository/';
+const forbidden = new Set(['.git', '.entrorove', '.aimlock', '.archguard']);
+function relativeFile(filename) {
+  const normalized = path.posix.normalize(filename);
+  if (!normalized.startsWith(virtualRoot)) return null;
+  const relative = normalized.slice(virtualRoot.length);
+  if (!relative || relative.split('/').some(part => forbidden.has(part))) return null;
+  return scopePath(relative);
+}
+function checkedManifest(relative, content) {
+  let value;
+  try { value = JSON.parse(content); }
+  catch { scopeFail('ENTROROVE_PACKAGE_INVALID', `createRequire package metadata "${relative}" is invalid JSON`); }
+  const main = value?.main;
+  if (typeof main === 'string' && relativeFile(path.posix.resolve(virtualRoot, path.posix.dirname(relative), main)) === null) {
+    scopeFail('ENTROROVE_PATH_UNSAFE', `createRequire package main in "${relative}" resolves outside the authorized repository or into a reserved directory`);
+  }
+}
+/** Replay CJS package resolution over authorized metadata; neither source nor package entry points execute. */
+export async function resolveCreatedRequire(from, anchor, specifier, metadata) {
+  const observed = new Map(), sources = new Map(), pending = Symbol('authorized-require-read');
+  const read = async relative => {
+    if (sources.has(relative)) return sources.get(relative);
+    let file;
+    try { file = await metadata(relative); }
+    catch (error) { if (!['ENOENT', 'ENOTDIR'].includes(error.code)) throw error; }
+    const content = file ? Buffer.from(file.contentBase64, 'base64').toString('utf8') : null;
+    if (file) {
+      observed.set(relative, { path: relative, sha256: file.sha256 });
+      if (relative.endsWith('/package.json') || relative === 'package.json') checkedManifest(relative, content);
+    }
+    sources.set(relative, content); return content;
+  };
+  if (await read(anchor) === null) scopeFail('ENTROROVE_IMPORT_UNRESOLVED', `${from}: createRequire anchor "${anchor}" has no actual authorized source file`);
+  for (let directory = path.posix.dirname(anchor);; directory = path.posix.dirname(directory)) {
+    for (const name of ['package-lock.json', 'npm-shrinkwrap.json', 'pnpm-lock.yaml', 'yarn.lock']) {
+      await read(directory === '.' ? name : `${directory}/${name}`);
+    }
+    if (directory === '.') break;
+  }
+  if (builtinModules.includes(specifier) || specifier.startsWith('node:') && builtinModules.includes(specifier.slice(5))) {
+    return { target: null, external: true, metadata: [...observed.values()] };
+  }
+  if (specifier.startsWith('/') || /^[A-Za-z][A-Za-z0-9+.-]*:/.test(specifier) || specifier.includes('\\')) {
+    scopeFail('ENTROROVE_PATH_UNSAFE', `${from}: createRequire module must remain a repository-relative or installed package reference`);
+  }
+  const lookup = filename => {
+    const relative = relativeFile(filename);
+    // Require inspects runtime implementations, never TypeScript declarations or arbitrary TS fallbacks.
+    if (relative === null || /\.(?:[cm]?ts|tsx)$/.test(relative)) return null;
+    if (!sources.has(relative)) throw { pending, relative };
+    return sources.get(relative);
+  };
+  const host = { fileExists: filename => lookup(filename) !== null, readFile: filename => lookup(filename) ?? undefined,
+    getCurrentDirectory: () => virtualRoot.slice(0, -1), realpath: filename => filename,
+    useCaseSensitiveFileNames: true };
+  const options = { module: ts.ModuleKind.NodeNext, moduleResolution: ts.ModuleResolutionKind.NodeNext, allowJs: true,
+    noDtsResolution: true, resolvePackageJsonExports: true, resolvePackageJsonImports: true, customConditions: ['node-addons'] };
+  for (let probes = 0; probes < 1024; probes++) {
+    try {
+      const resolved = ts.resolveModuleName(specifier, virtualRoot + anchor, options, host, undefined, undefined, ts.ModuleKind.CommonJS).resolvedModule;
+      const target = resolved && relativeFile(resolved.resolvedFileName);
+      if (!target) scopeFail('ENTROROVE_IMPORT_UNRESOLVED', `${from}: createRequire(${JSON.stringify(anchor)}) cannot resolve ${JSON.stringify(specifier)} to an actual installed runtime file inside the authorized repository`);
+      await read(target);
+      const external = !specifier.startsWith('.') && !specifier.startsWith('#');
+      return { target, external, metadata: [...observed.values()].filter(file => file.path !== from && (external || file.path !== target)) };
+    } catch (error) {
+      if (error?.pending !== pending) throw error;
+      await read(error.relative);
+    }
+  }
+  scopeFail('ENTROROVE_SCOPE_LIMIT', `${from}: createRequire resolution exceeds the 1024-authorized-file-probe bound`);
+}

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.skill-manifest/1.0",
   "name": "entrorove",
-  "version": "0.1.52",
+  "version": "0.1.54",
   "endpoint": "https://entrorove.com",
   "requestSchemaVersion": "entrorove.skill.request/2.0",
   "supportedRequestSchemaVersions": [

package/mutation-client.mjs

@@ -0,0 +1,290 @@
+import path from 'node:path';
+import { canonical, sha256 } from './local-integrity.mjs';
+import { withStateLock } from './local-state-lock.mjs';
+import { mutationId14, mutationPaths14, mutationTarget14, mutationFail14, privateMutationDirectory14,
+  readMutationJson14, atomicMutationJson14 } from './local-mutation-files.mjs';
+import { preparePreservedMutationSigner, preservedMutationLocation } from './local-preserved-mutation-signer.mjs';
+import { snapshotPlan14, snapshotVerify14 } from './local-mutation-snapshot.mjs';
+import { attestMutationSnapshot14 } from './local-mutation-binding.mjs';
+import { issueMutationPass14 } from './local-mutation-authority.mjs';
+import { readStoredMutationPass14 } from './local-mutation-pass-store.mjs';
+import { mutationChallenge14, mutationPass14 } from './local-mutation-wire.mjs';
+import { buildInvocation, invokeRemoteResult } from './remote-client.mjs';
+import { parseTransportResponse, requestTransport, trustedOrigin } from './remote-transport.mjs';
+import { acknowledgeAutomaticFeedback, verifyAutomaticFeedback, queryAutomaticFeedback } from './automatic-feedback-client.mjs';
+import { ideClientHeaders } from './ide-presentation.mjs';
+import { appendInvocation, readInvocations } from './local-invocations.mjs';
+import { bootstrapCloudMutationAuthority } from './cloud-mutation-authority.mjs';
+import { attestMutationConsumption14, preservedMutationConsumptionState } from './local-mutation-consumption.mjs';
+
+const schema = 'entrorove.mutation-connection-state/1.0';
+const fields = ['taskId', 'flowId', 'stepId', 'leaseId', 'generation', 'runnerId', 'paths'];
+const fail = message => mutationFail14('ENTROROVE_MUTATION_CONNECTION_BINDING', message);
+const unknown = requestId => Object.assign(new Error(`Mutation connection outcome is unknown; recover original requestId=${requestId} without repeating its POST`),
+  { outcomeUnknown: true, requestId });
+const notSent = requestId => Object.assign(new Error('Mutation operation was not transmitted; repair its local or discovery prerequisite and reuse the original input'),
+  { code: 'ENTROROVE_MUTATION_CONNECTION_NOT_SENT', requestId, knownBeforeTransmission: true });
+const save = (location, value) => atomicMutationJson14(location.file, value, { privateFrom: location.stateRoot, replace: true });
+function inputIdentity(input) {
+  if (!input || typeof input !== 'object' || Array.isArray(input)
+    || canonical(Object.keys(input).sort()) !== canonical([...fields, ...['previousPassId'].filter(field => Object.hasOwn(input, field))].sort())
+    || !Number.isSafeInteger(input.generation) || input.generation < 1) {
+    mutationFail14('ENTROROVE_MUTATION_CONNECTION_INPUT', 'Mutation connection requires its exact original task, flow, step, lease, generation, runner and existing paths');
+  }
+  for (const field of fields.filter(field => !['generation', 'paths'].includes(field))) mutationId14(input[field], field);
+  if (Object.hasOwn(input, 'previousPassId')) mutationId14(input.previousPassId, 'previousPassId');
+  return { ...input, paths: mutationPaths14(input.paths) };
+}
+async function readConnection(location, identity) {
+  let value;
+  try { value = await readMutationJson14(location.file); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; }
+  if (!value) return { schemaVersion: schema, identity };
+  if (value.schemaVersion !== schema || canonical(value.identity) !== canonical(identity)
+    || value.pending && (value.pending.requestId !== buildInvocation(value.pending.operation, value.pending.input).requestId
+      || !['mutation-snapshot-challenge', 'mutation-pass-issue', 'mutation-pass-settle'].includes(value.pending.operation))) {
+    fail('Mutation connection journal differs from the original repository, request or physical key');
+  }
+  return value;
+}
+async function recoverRemote(pending, dependencies) {
+  try {
+    const token = await dependencies.readCredential(dependencies.home), origin = trustedOrigin(dependencies.apiOrigin());
+    const response = await requestTransport(origin, `/api/skill/status/${pending.requestId}`, { headers: { authorization: `Bearer ${token}`, ...ideClientHeaders() } });
+    const result = await parseTransportResponse(response, 'original mutation connection status');
+    if (!response.ok || result?.output?.requestId !== pending.requestId || ['running', 'pending'].includes(result.output.status)) throw unknown(pending.requestId);
+    result.feedback ??= await queryAutomaticFeedback(pending.requestId, dependencies);
+    verifyAutomaticFeedback(result.feedback, pending.requestId, pending.requestId);
+    result.feedback = await acknowledgeAutomaticFeedback(result.feedback, origin, token, ideClientHeaders());
+    await appendInvocation({ kind: 'remote', operation: 'status', requestId: pending.requestId, event: 'status', usage: result.usage ?? [] }, dependencies.home);
+    return { response, result };
+  } catch { throw unknown(pending.requestId); }
+}
+async function knownNotSent(error, pending, home) {
+  if (error?.requestId && error.requestId !== pending.requestId || error?.retryableBeforeTransmission === true) return true;
+  try {
+    const records = (await readInvocations(home)).filter(value => value.kind === 'remote' && value.requestId === pending.requestId);
+    return !records.length || records.at(-1).event === 'not-sent';
+  } catch (cause) { return cause.code === 'ENOENT'; }
+}
+async function remote(stage, operation, input, state, location, dependencies) {
+  const requestId = buildInvocation(operation, input).requestId;
+  let response, result;
+  if (state.pending) {
+    if (state.pending.stage !== stage || state.pending.operation !== operation || canonical(state.pending.input) !== canonical(input)) {
+      fail('Recover the original mutation request before another operation or input');
+    }
+    ({ response, result } = await recoverRemote(state.pending, dependencies));
+  } else {
+    state.pending = { stage, operation, input, requestId };
+    try { await save(location, state); } catch { throw notSent(requestId); }
+    try { ({ response, result } = await invokeRemoteResult({ operation, input }, dependencies)); }
+    catch (error) {
+      if (await knownNotSent(error, state.pending, dependencies.home)) {
+        delete state.pending;
+        try { await save(location, state); } catch { throw notSent(requestId); }
+        throw notSent(requestId);
+      }
+      throw unknown(requestId);
+    }
+  }
+  delete state.pending;
+  if (!response.ok || !['succeeded', 'reported'].includes(result?.output?.status)) {
+    try { await save(location, state); } catch { throw unknown(requestId); }
+    throw Object.assign(new Error(result?.output?.message ?? `Mutation connection blocked at ${operation}`),
+      { code: result?.output?.code ?? 'ENTROROVE_MUTATION_CONNECTION_BLOCKED', output: result?.output, requestId });
+  }
+  state[stage] = result.output;
+  if (result.feedback) state.feedback = result.feedback;
+  try { await save(location, state); } catch { throw unknown(requestId); }
+  return result.output;
+}
+function challengeBinding(challenge, identity, mutator, options) {
+  mutationChallenge14(challenge, options);
+  if ([...fields, 'previousPassId'].some(field => canonical(challenge[field]) !== canonical(identity[field])) || challenge.repositoryDigest !== sha256(identity.repositoryRoot).slice(0, 32)
+    || challenge.newFilePaths.length || !challenge.writeDelegation
+    || challenge.writeDelegation.mutationKeyId !== mutator.mutationKeyId || challenge.writeDelegation.mutationPublicKey !== mutator.mutationPublicKey) {
+    fail('Mutation challenge must retain the original task, lease, physical repository, paths and separate M signer');
+  }
+}
+function passBinding(pass, challenge, attestation, options) {
+  mutationPass14(pass, options);
+  if (pass.challengeId !== challenge.challengeId || pass.challengeDigest !== sha256(canonical(challenge))
+    || pass.attestationDigest !== sha256(canonical(attestation)) || pass.snapshotDigest !== attestation.manifest.snapshotDigest
+    || [...fields, 'previousPassId'].some(field => canonical(pass[field]) !== canonical(challenge[field]))
+    || canonical(pass.writeDelegation) !== canonical(challenge.writeDelegation)) fail('Mutation pass differs from its original signed challenge or actual M snapshot');
+}
+async function snapshot(input, challenge, state, location) {
+  if (!state.planned) {
+    if (state.planStarted) {
+      const recovered = await snapshotVerify14(input);
+      state.planned = { snapshotId: recovered.receipt.snapshotId, snapshotDigest: recovered.receipt.snapshotDigest };
+    } else {
+      state.planStarted = true; await save(location, state);
+      try { state.planned = await snapshotPlan14({ ...input, paths: challenge.paths, contractDigest: challenge.scopeContractDigest }); }
+      catch (error) { delete state.planStarted; await save(location, state); throw error; }
+    }
+    await save(location, state);
+  }
+  const verified = await snapshotVerify14(input);
+  if (verified.verified !== true || verified.receipt.snapshotDigest !== state.planned.snapshotDigest
+    || canonical(verified.receipt.paths) !== canonical(challenge.paths) || verified.receipt.contractDigest !== challenge.scopeContractDigest) {
+    fail('Original mutation snapshot copies or paths failed their actual verification');
+  }
+  return verified;
+}
+async function authorizeCachedConnection(identity, pass, dependencies) {
+  const token = await dependencies.readCredential(dependencies.home), origin = trustedOrigin(dependencies.apiOrigin());
+  let response, status;
+  try {
+    response = await requestTransport(origin, `/api/skill/flows/${identity.flowId}/status`, {
+      headers: { authorization: `Bearer ${token}`, ...ideClientHeaders() },
+    });
+    status = await parseTransportResponse(response, 'original mutation flow status');
+  } catch {
+    mutationFail14('ENTROROVE_MUTATION_CONNECTION_AUTHORIZATION', 'Current account could not confirm the original active mutation flow');
+  }
+  if (!response.ok || status?.schemaVersion !== 'entrorove.flow-status/1.0' || status.flow?.flowId !== identity.flowId
+    || status.flow.ownerId !== pass.ownerId || status.flow.stepId !== identity.stepId || status.flow.status !== 'running'
+    || !['execute', 'merge', 'deliver'].includes(status.workflow?.phase) || status.workflow.terminalAt
+    || ['pending', 'declined'].includes(status.workflow.authorization)) {
+    mutationFail14('ENTROROVE_MUTATION_CONNECTION_AUTHORIZATION', 'Current account must retain the original owned active flow and business step');
+  }
+}
+async function connect(identity, local, mutator, location, dependencies) {
+  const state = await readConnection(location, identity);
+  const challenged = state.challenged ?? await remote('challenged', 'mutation-snapshot-challenge',
+    { ...Object.fromEntries(fields.map(field => [field, identity[field]])),
+      ...(identity.previousPassId ? { previousPassId: identity.previousPassId } : {}), mutationPublicKey: mutator.mutationPublicKey }, state, location, dependencies);
+  const challenge = challenged.challenge;
+  challengeBinding(challenge, identity, mutator, { live: !state.gatePassPath });
+  const input = { ...local, snapshotId: challenge.snapshotId };
+  if (state.gatePassPath) {
+    passBinding(state.issued.pass, challenge, state.attestation, { live: false });
+    const stored = await readStoredMutationPass14({ ...input, gatePassPath: state.gatePassPath }, { live: false });
+    if (canonical(stored) !== canonical(state.issued.pass)) fail('Installed mutation pass differs from its original connection');
+    await authorizeCachedConnection(identity, stored, dependencies);
+    const consumption = await preservedMutationConsumptionState({ ...input, gatePassPath: state.gatePassPath });
+    if (consumption.complete) return { schemaVersion: 'entrorove.mutation-connection/1.0', status: 'blocked', flowId: identity.flowId,
+      code: 'ENTROROVE_MUTATION_SETTLEMENT_REQUIRED', gatePassPath: state.gatePassPath,
+      message: 'Original physical writes are consumed; settle their actual M receipt with fresh S evidence before requesting the next restricted pass',
+      localAction: { command: 'npx @entrorove/skill mutation-settle <absolute repositoryRoot>',
+        input: { taskId: stored.taskId, flowId: stored.flowId, stepId: stored.stepId, gatePassPath: state.gatePassPath } } };
+    passBinding(state.issued.pass, challenge, state.attestation);
+    return connected(identity, state);
+  }
+  await snapshot(input, challenge, state, location);
+  if (!state.attestation) {
+    const observed = await attestMutationSnapshot14({ ...input, challenge, signerConfigPath: mutator.signerConfigPath });
+    if (observed.verified !== true || observed.attestation.keyId !== mutator.mutationKeyId) fail('Actual mutation snapshot was not signed by its separate M key');
+    state.attestation = observed.attestation; await save(location, state);
+  }
+  const issued = state.issued ?? await remote('issued', 'mutation-pass-issue',
+    { challengeId: challenge.challengeId, attestation: state.attestation }, state, location, dependencies);
+  passBinding(issued.pass, challenge, state.attestation);
+  await authorizeCachedConnection(identity, issued.pass, dependencies);
+  const installed = await issueMutationPass14({ ...input, mutationPass: issued.pass });
+  if (canonical(installed.pass) !== canonical(issued.pass) || typeof installed.gatePassPath !== 'string') fail('Mutation gate did not install its exact original server pass');
+  state.gatePassPath = installed.gatePassPath; await save(location, state);
+  return connected(identity, state);
+}
+function connected(identity, state) {
+  return { schemaVersion: 'entrorove.mutation-connection/1.0', status: 'succeeded', taskId: identity.taskId,
+    flowId: identity.flowId, stepId: identity.stepId, gatePassPath: state.gatePassPath, pass: state.issued.pass,
+    purpose: 'preserved-existing-modify', grantsExecutionAuthority: false, grantsValidatorAuthority: false,
+    ...(state.feedback ? { feedback: state.feedback } : {}) };
+}
+export async function connectMutation(repositoryRoot, input, dependencies) {
+  const original = inputIdentity(input);
+  const local = { repositoryRoot, home: dependencies.home, taskId: original.taskId, flowId: original.flowId, stepId: original.stepId };
+  const location = await preservedMutationLocation(local);
+  local.repositoryRoot = location.root;
+  for (const relative of original.paths) {
+    const target = await mutationTarget14(location.root, relative, true);
+    if (!target.exists || !target.stat.isFile()) fail('Mutation connection permits only concrete existing files');
+  }
+  await bootstrapCloudMutationAuthority(dependencies);
+  const mutator = await preparePreservedMutationSigner(local);
+  const identity = { ...original, repositoryRoot: location.root, apiOrigin: trustedOrigin(dependencies.apiOrigin()), mutationKeyId: mutator.mutationKeyId };
+  const directory = path.join(location.directory, 'connections'); await privateMutationDirectory14(directory, { privateFrom: location.stateRoot });
+  const file = path.join(directory, `${sha256(canonical(identity))}.json`), journal = { ...location, file };
+  return withStateLock(file, () => connect(identity, local, mutator, journal, dependencies));
+}
+function settlementBinding(output, pass, receipt, expectedSettlementId) {
+  if (output?.settled !== true || typeof output.settlementId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(output.settlementId)
+    || expectedSettlementId !== undefined && output.settlementId !== expectedSettlementId
+    || output.passId !== pass.passId || output.consumptionReceiptDigest !== sha256(canonical(receipt))
+    || output.claimsVerifiedExecution !== false || output.claimsCompletion !== false) fail('Mutation settlement must preserve its original actual M receipt without claiming independent validation or completion');
+}
+async function settleMutation(repositoryRoot, input, dependencies) {
+  const required = ['flowId', 'stepId', 'gatePassPath'], optional = ['taskId'].filter(field => Object.hasOwn(input ?? {}, field));
+  if (!input || canonical(Object.keys(input).sort()) !== canonical([...required, ...optional].sort())
+    || !path.isAbsolute(input.gatePassPath ?? '')) fail('Mutation settlement requires the exact original stored pass and task step');
+  for (const field of ['flowId', 'stepId', ...optional]) mutationId14(input[field], field);
+  await bootstrapCloudMutationAuthority(dependencies);
+  const local = { ...input, repositoryRoot, home: dependencies.home }, original = await preservedMutationConsumptionState(local);
+  const { pass, binding } = original;
+  await authorizeCachedConnection({ flowId: pass.flowId, stepId: pass.stepId }, pass, dependencies);
+  const directory = path.join(binding.directory, 'settlements'); await privateMutationDirectory14(directory, { privateFrom: binding.stateRoot });
+  const location = { ...binding, file: path.join(directory, `${pass.passId}.json`) };
+  const identity = { flowId: pass.flowId, stepId: pass.stepId, passDigest: sha256(canonical(pass)),
+    repositoryRoot: binding.root, apiOrigin: trustedOrigin(dependencies.apiOrigin()), mutationKeyId: binding.binding.keyId };
+  return withStateLock(location.file, async () => {
+    const state = await readConnection(location, identity);
+    if (!state.settled && !state.pending && (!state.consumptionReceipt || state.rejection?.effects === 'none'
+      && state.rejection.code === 'ENTROROVE_MUTATION_CONSUMPTION_EXPIRED')) {
+      const observed = await attestMutationConsumption14(local, { allowExpiredReplay: true, renewExpired: state.rejection?.effects === 'none'
+        && state.rejection.code === 'ENTROROVE_MUTATION_CONSUMPTION_EXPIRED' });
+      state.consumptionReceipt = observed.consumptionReceipt; delete state.rejection; await save(location, state);
+    }
+    if (!state.consumptionReceipt) fail('Original mutation settlement receipt is missing; recover its original request without signing another');
+    let output = state.settled;
+    if (!output) {
+      try { output = await remote('settled', 'mutation-pass-settle', { passId: pass.passId, consumptionReceipt: state.consumptionReceipt }, state, location, dependencies); }
+      catch (error) {
+        if (error.output?.effects === 'none') { state.rejection = { effects: 'none', code: error.output.code }; await save(location, state); }
+        throw error;
+      }
+    }
+    settlementBinding(output, pass, state.consumptionReceipt, state.settlementId);
+    if (state.settlementId === undefined) { state.settlementId = output.settlementId; await save(location, state); }
+    return { schemaVersion: 'entrorove.mutation-settlement/1.0', status: 'reported', settled: true,
+      flowId: pass.flowId, taskId: pass.taskId, passId: pass.passId, settlementId: output.settlementId,
+      consumptionReceiptDigest: output.consumptionReceiptDigest,
+      claimsVerifiedExecution: false, claimsCompletion: false, ...(state.feedback ? { feedback: state.feedback } : {}),
+      observationAction: { command: 'npx @entrorove/skill workflow-observe-step <absolute repositoryRoot>', independentValidation: 'pending',
+        input: { taskId: pass.taskId, flowId: pass.flowId, stepId: pass.stepId, leaseId: pass.leaseId,
+          generation: pass.generation, settlementId: output.settlementId } },
+      localAction: { command: 'npx @entrorove/skill mutation-connect <absolute repositoryRoot>',
+        input: { ...Object.fromEntries(fields.map(field => [field, pass[field]])), previousPassId: pass.passId } } };
+  });
+}
+async function runMutationClient(operation, repositoryRoot, input, dependencies, work) {
+  let preflight = true;
+  try {
+    await dependencies.install();
+    if (!await dependencies.agreementAccepted(dependencies.home)) return dependencies.agreementRequired(dependencies.home);
+    preflight = false;
+    return await work(repositoryRoot, input, dependencies);
+  }
+  catch (error) {
+    const requestId = /^[a-f0-9]{64}$/.test(error?.requestId ?? '') ? error.requestId : undefined;
+    if (error?.outcomeUnknown === true && requestId) return {
+      schemaVersion: 'entrorove.mutation-connection/1.0', status: 'blocked', flowId: input?.flowId, requestId,
+      code: 'ENTROROVE_MUTATION_CONNECTION_OUTCOME_UNKNOWN', outcomeUnknown: true, recoverable: true,
+      message: `Original mutation request outcome is unknown; rerun ${operation} with the same input to recover only its original GET, without repeating its POST`,
+      nextAction: { operation, requestId, method: 'GET', reuseOriginalInput: true, repeatPost: false },
+    };
+    const typed = typeof error?.code === 'string' && error.code.startsWith('ENTROROVE_');
+    const knownBeforeTransmission = preflight || error?.knownBeforeTransmission === true;
+    return { schemaVersion: 'entrorove.mutation-connection/1.0', status: 'blocked', flowId: input?.flowId,
+      code: typed ? error.code : 'ENTROROVE_MUTATION_CONNECTION_LOCAL_PREREQUISITE',
+      message: typed ? error.message : 'Mutation connection stopped at a local prerequisite; preserve its journal and repair before reusing the original input',
+      ...(requestId ? { requestId } : {}), ...(knownBeforeTransmission ? { knownBeforeTransmission: true } : {}),
+      recovery: { operation, reuseOriginalInput: true, preserveJournal: true,
+        ...(knownBeforeTransmission ? { remoteAttemptedThisRun: false } : {}) },
+      ...(error?.output ? { output: error.output } : {}) };
+  }
+}
+export const runMutationConnect = (repositoryRoot, input, dependencies) => runMutationClient('mutation-connect', repositoryRoot, input, dependencies, connectMutation);
+export const runMutationSettle = (repositoryRoot, input, dependencies) => runMutationClient('mutation-settle', repositoryRoot, input, dependencies, settleMutation);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.52",
+  "version": "0.1.54",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"
@@ -38,6 +38,13 @@
     "local-mutation-snapshot.mjs",
     "local-mutation-audit.mjs",
     "local-mutation-wire.mjs",
+    "local-preserved-mutation-protection.mjs",
+    "local-preserved-mutation-signer.mjs",
+    "local-preserved-mutation-state.mjs",
+    "local-preserved-mutation-wire.mjs",
+    "local-delegated-modify-analysis.mjs",
+    "mutation-client.mjs",
+    "cloud-mutation-authority.mjs",
     "local-mutation-binding.mjs",
     "local-mutation-pass-store.mjs",
     "local-mutation-authority.mjs",
@@ -133,6 +140,8 @@
     "local-scope-context.mjs",
     "local-scope-files.mjs",
     "local-scope-import-expressions.mjs",
+    "local-scope-create-require.mjs",
+    "local-scope-require-resolution.mjs",
     "local-scope-repository.mjs",
     "local-scope-signature.mjs",
     "local-scope-config-imports.mjs",
@@ -232,7 +241,17 @@
     "IDE-EXECUTION.md",
     "REUSE-DISCIPLINE.md",
     "DELIVERY-BOUNDARIES.md",
-    "reuse-discipline-release.mjs"
+    "reuse-discipline-release.mjs",
+    "connected-cli.mjs",
+    "local-approved-process.mjs",
+    "local-approved-supervisor.mjs",
+    "local-mutation-consumption.mjs",
+    "workflow-observation-client.mjs",
+    "workflow-observation-connection.mjs",
+    "workflow-observation-remote.mjs",
+    "workflow-observation-runner.mjs",
+    "workflow-observation-state.mjs",
+    "workflow-observation-wire.mjs"
   ],
   "scripts": {
     "test": "node test/run.mjs",

package/release-state.json

@@ -1,24 +1,41 @@
 {
   "schemaVersion": "entrorove.release-state/1.0",
-  "version": "0.1.52",
-  "digest": "81fb53f113036a9ffdaa64ac99f3f9c0cc4180c623997ee009d4bc63e58a9ab8",
+  "version": "0.1.54",
+  "digest": "36f6f70b3b71f839d5e616e729c998e58232c94f8a3977216820f8fef6b470bf",
   "files": {
-    "ide-code-mode.mjs": "f3f53357ba09727b3b597851976a24de93287c0faca5052448277d0904bb61f7",
-    "ide-command.mjs": "86472c2f89c17e13a6fb0e41794add983400aac3e626891dbb3812e34320e229",
-    "ide-hook.mjs": "2f00e56de1e1149f117714d5dd334196f1a3f206c3bfab541393bc0f625e0108",
+    "connected-cli.mjs": "260c0fc99586c24bd4d0351a14e0744849a612ebe6f1bd7951e4fce200daf920",
+    "local-approved-process.mjs": "442856df788e63f38757439ba0657d1c689aaf797631a955fae3dd639e844e6d",
+    "local-approved-supervisor.mjs": "87142a4c13d27c8265cc1fd7fc9088988da9bbb02134164e1a7c5417da926ac7",
+    "local-mutation-consumption.mjs": "cd8650b9be894639ceb35af88d23c8002b4acff27afad2e64174eb21a9424cfb",
+    "workflow-observation-client.mjs": "5e67bc32a8625de9523498f694655c378ae34af59c4aa2f0e07efcd72347dbc0",
+    "workflow-observation-connection.mjs": "9235e9247b11e1d51628c1784eb1cb1e8e4b79d25ff791883722592dcf8583c0",
+    "workflow-observation-remote.mjs": "1e5a8b9c2b9b095242ad28a1d5ebce5944efdae74383fb20d6676b93b240c5a7",
+    "workflow-observation-runner.mjs": "3eb8280ec7abffcb30398e3f4e5f7d0ec3df4385fa720f188ed83757b87cd977",
+    "workflow-observation-state.mjs": "a525046df9b3de75b10d2bf35c2b6d7719f12a647e4aee1f1e85dbdbfb167321",
+    "workflow-observation-wire.mjs": "846d0b48b7799bfca227e30faea025a5a919896538f963ce886cbdb4c75c0253",
+    "local-preserved-mutation-protection.mjs": "95041d4f75253a153c7fd85573ba0457513ffe47a6a6bd00c4f59379b81ce580",
+    "local-preserved-mutation-signer.mjs": "2b0771cbdd18ba00267aa441b7892cd04feab9f8543ae5e2703430b1e580747f",
+    "local-preserved-mutation-state.mjs": "1ff7939d668e39ec641a7cf46a4ce3014c63f3898207cc874f21170376479671",
+    "local-preserved-mutation-wire.mjs": "d302bd4b115338c0d1bf69718ce2596dbceb595431ff3f57b998ea67d94cb34c",
+    "local-delegated-modify-analysis.mjs": "f87148ddb023b79e241ca97db582991da8d0e1a51b26b1d9bc2799a76efd7297",
+    "mutation-client.mjs": "8d27b267dc660510aa1406c44d4005e44b972a1260f90657de4fa0e75b7b6c3e",
+    "cloud-mutation-authority.mjs": "c7226e882a4f3be4d2f55728f515d5a815c0aa1f21aa5e4689314e6e6a8c66a2",
+    "ide-code-mode.mjs": "ca667a00d9f2be82e46f3d7720c6a2bfae437c2a3f26b935075554f989ac2d73",
+    "ide-command.mjs": "5a4aeae387122682caa4dd6383f43cefccbe93d3fa891cec427103e3fcfe9542",
+    "ide-hook.mjs": "190cfa0cd391e60bfe9056a53c2d8c8d0b956089912935c870f99041a11b473e",
     "ide-install.mjs": "10247efadcfeef5da001022d12080bd0f789e67fdf7862bcc65db73dda3bbe57",
-    "ide-session.mjs": "dc256e77b03303932d354768c0e79384340a3137e7421b4ae9c869f7e58e1a3a",
+    "ide-session.mjs": "453b9510ab825c2927a4fae8250ee8a8eb5ac10b23cf024af84a7c5916ba53dd",
     "break-glass.mjs": "6ec9f97c5d68bb33121b2374c06b9d4c8eb3419b52d00849fec7124bc63e4582",
-    "ide-results.mjs": "dfe0d3f773c65a9fc21056538d7005012c982ed4509bc0410d7f62813d0863fd",
+    "ide-results.mjs": "7ed5caf8e77cf42ae6d62cc1ed42b1639bca6069d809b90a399bec5192fb903e",
     "ide-queue.mjs": "806e716c775fd0079417027b135977c8516f47dddb0bc5ca19e32a355dab0e9e",
-    "local-discipline-actions.mjs": "2379c08d0f49c44068f8239db7e514d75885f4606b1b88a7a36e4ff19167caca",
+    "local-discipline-actions.mjs": "418c220b8c8ef59cb8092b6eb680bb75a93b9fad1a09412b1efa98a78afff11b",
     "local-discipline-analysis.mjs": "e887abdd1c6d6ba59ef7323e9035528f0491e5458ca8159985ec26e1ca67a4af",
     "local-discipline-batch.mjs": "2cc90dbae55efdee0c445da399c0a9acafa92e915344c25208ebca554fc4c9e9",
     "local-typescript-function-reference.mjs": "af682b479fe0d69a5ecd62232406bb8078408ec8710733cfed9ae6b059762ba5",
-    "local-scope-import-expressions.mjs": "6623dea5501c4dc24e12c99e0776d65650bbe752c85c9509d022ba1f61bd5111",
+    "local-scope-import-expressions.mjs": "20f1e065582c68d2334e0dfaa130a559ff19886a57f9038dc569f65993bb06c8",
     "local-discipline-contracts.mjs": "6cf8a3d132fdb9074eb1441600afe7aa199df33e88a71a660d9db534c14f19e4",
     "local-discipline-contracts.d.mts": "defc684c78dc88afa1c54340ab4a01ae36db7aa11257cbe1f5cd323f608c78c4",
-    "local-discipline-gate.mjs": "04b1ba092d7f4342a0e77cfbeb44d9634dbce9fec0c79e6a1e4b11a662d904ac",
+    "local-discipline-gate.mjs": "e3851157bf1d8bc86eb44212a88acd20acfc2d1152e7d87af6dc2a37afffcd6f",
     "local-discipline-native.mjs": "8b99b5ce951cab3c1426428ad807650c61c0ffb2c346d747b73b99057b382049",
     "local-discipline-operations.mjs": "9fcb7b8889b7718d42e1d37936485d8198d5017d405e0cdbbabdbbd12fcc9d48",
     "local-discipline-repository.mjs": "b6392e02ecae333dfdc8df41f203fd69bed035d88b15b16d112ab1897b3c297c",
@@ -31,7 +48,7 @@
     "runtime/validator-runtime-v7.0.44.d.mts": "7797edbfe2f7de24da370204dce4dfd22822a1bd80df93514fff900b98afe36f",
     "snapshot-retention.mjs": "4f8919fe8ec49fb4c23e080a8ad2fa3a9282bca3fffe7cf55c64e89ef316697e",
     "snapshot-cleanup-journal.mjs": "76a9684cc95b4eb076e1298d78a9dff37948b00d9607b8f546c599072d3ed331",
-    "IDE-EXECUTION.md": "2cb952bb919261e9e420c9d83659eba013e5b1b175d80da03b50b660edfe4f31",
+    "IDE-EXECUTION.md": "fe8ff87dde885832b34a369985f02b567efa096ed1c1e79a0e490280c8540bf5",
     "REUSE-DISCIPLINE.md": "5b214cf313e7f715f52d54e28093a2d038f0f196ca64b15d1c49587b9d8eecf8",
     "reuse-discipline-release.mjs": "2935898d1aa807fb982a78d7ab5cb1abe05e3c8fc945dc0909da8098872aa1ac",
     "local-final-gate16.mjs": "083aec470670e6cdb7ad2ab27b7a51b53a9ec3a8b4121cb9cbfa17d9940892c2",
@@ -75,25 +92,25 @@
     "local-autocoord17-waits.mjs": "2b0a713987822548a94e1ed3a9a891532db45383797dfc5d5bc8d1e35593cf25",
     "local-validator-isolation17.mjs": "48e94604e28b8fddd567dfb35ff60b73fd094a5803bd49f076388b7f310f92aa",
     "local-calctool-composition17.mjs": "ac89fcb41ab0d0d9b47c1b5696945281b0894eb064820775e36a011c76314e6a",
-    "cli.mjs": "2f1fa353a80000ed26061feeb44a6a4ad12e32a2f49c84bfbb6c54f89f519b7b",
+    "cli.mjs": "74b72be1190c4ff79279a8b911a85cc654ea860574691eb79eefb5fbab4a6fbe",
     "install-cleanup.mjs": "8a8e1a7dfe37427f86cd4d6e317890d0829894a9949d4216674a716b36edbc54",
     "review-client.mjs": "3491eef68ed533174b31db3c53febb6519b8f088f71a9964644714a9a4c03c77",
     "version.mjs": "1f392147d72c40af4b03b307ea607075fb815af5174fa07e254b95fe12dbf3e7",
-    "SKILL.md": "0d581e76d8c959ae04e091e24df5580e56d9ec9b6c1c6fa25a531a21e8b88ea4",
-    "CAPABILITY-MAP.md": "a0f0468a098725ced52a96dd8e22bfc7d1ce7681a8446ebf7dae3696c76c3385",
+    "SKILL.md": "d21f5085c0a5f830d5fd8b65e3a9da1e6d15512db69a4a8daab3e94fb8738f0b",
+    "CAPABILITY-MAP.md": "69b2c49b111d651969dea7430f4df7950d8fdf2f0f151d8386fa04968b872ac0",
     "AGREEMENT.md": "f93a68e92c457200dd024610e65f74e478b8f60860f951da818b70561f1b9bf8",
-    "DELIVERY-BOUNDARIES.md": "d1bb2895e23fc14bf1c76707bd1f6f03b39695501a78a0b7289dc37b099889dc",
-    "package.json": "d385aa543bff1f373a1fb8464c712c4ea04e1b2938a8603ddecca903161cbac3",
+    "DELIVERY-BOUNDARIES.md": "9b9db50ed1bcce9e77ff6527b6bb7eaf12f3b913162ea9cb7fe90db06b393a4f",
+    "package.json": "e910dc5cf0db61b1fcb9feffa21a8f8d3c2a244b7d858e8af72202f5b91d403b",
     "manifest.json": "ab06e307795bc9da5add926752b6c4dbdaf18625090261a035aa356a679c504f",
-    "release.mjs": "e206cb6cabbb02542317bce283f7ba674621e67765a3eacef5741f2d6b1c58b2",
-    "local-cli.mjs": "11461e4cf4f6a8612ff275bf8296ec57ff22281156cb2c72834d3c764ba422a1",
+    "release.mjs": "8b0dc36c47aec72cf9952c9ac1ce5fe27da5ae6829f50cd2339fa101b2eda93c",
+    "local-cli.mjs": "41e2a737c8587cb5ce469a7661f6d14b5ea4cd073f8286822fc4dc96b67f56a1",
     "local-state-lock.mjs": "1dbf64264642a0851faf043e07ee9f66d2ad0508e9f799b0626246e42fae893e",
-    "local-execution.mjs": "46fddd78cd954fb080c660affe90cdaa716695580427336acb820089441a8025",
+    "local-execution.mjs": "185f34e917440a360b3c4bafd3af245243807d964ae3820b3cffaaa2e6348cc6",
     "local-integrity.mjs": "e6d6eace80c610f3c7299d4f8644b0dc023aa9e3d8d64b26535ea7fbced248f1",
     "local-evidence-verification.mjs": "9b7dea31777505272f63616fd62af7603338f703bb1285fc565d6451715c7ce0",
     "local-formula.mjs": "706d5ec0cb2caf95a547531a81ca746fe246d4c53d902e03595a3b360e8c85af",
     "local-ledger.mjs": "2009fb68aadcd7292b72f1d0d99f378d03644be1c5b4b4150d9f6a0b3f7c15ce",
-    "local-error.mjs": "12a4aa19fe5d57218d78c8fecb0685dd02f99155999cbbfba8da8950047638f9",
+    "local-error.mjs": "f01213b21d84402dc5257aaa3ae4a5fa78931a956e9b8526b1e7dbf1b20b6b5d",
     "blueprint-criterion-wire.mjs": "fb6b7dcce0b97a699e3e8968372767a3fddd83fedc750998573f789177243072",
     "blueprint-criterion-runner.mjs": "761c0e670b4b20c6bed53e5ca5d0178759505c3977ea2ed1b7223383c534bc4c",
     "local-chain-bindings.mjs": "b8eff999ccd17b53c614a3c9f5376da78fcaa8632bb3e07bc1adcceda2e75f6c",
@@ -106,7 +123,7 @@
     "local-chain-plan.mjs": "e45a9170f569c80f7e5532bbc109dbae3c24b696815316e503cb3779135be648",
     "local-chain-release-labels.mjs": "7ce5350d1062d5236f57f10e7e81713c1101463d5e7f252604ef0c2a30840bfe",
     "local-chain-results.mjs": "0455f72cad574cfef87c2c6c0928d6432bba7e5dbaff521a2b62a9575299ca10",
-    "local-approved-plan.mjs": "825059864d4ca1e5a85d1a715ad68c3923350e1be233d4f3bb09d6f31b0143af",
+    "local-approved-plan.mjs": "26731b534f4c276c6235cb73bf6950943061947967a93f477f4bcd64acde72a6",
     "local-budget-renewal.mjs": "6b436358066fe33b2f6d871fc90d8e7c551edd6255efd73c0d255d0fd35d5ef8",
     "local-probe.mjs": "9b948db1de1e34c7605c4c454cd4aced66d2b57d2cf4471adbb80bcc76dee635",
     "local-budget-grants.mjs": "c5f6542f5d2c3bfe07f3ca5b5bc849bf05d886b06014f720322d530510775d3d",
@@ -124,7 +141,9 @@
     "local-scope-candidate.mjs": "8f0bd9606e70d4a0ebacdd3cd600ec3afed85e2bb3e1760aa1144cf55d4e028a",
     "local-scope-context.mjs": "79753abfc6c76089d17f003a1be537dfaea10d6731c542f7fc53f2a9996ed164",
     "local-scope-files.mjs": "4c14a5e226dd5518aeb37f199b1aa896943a66d41e5a1757a3b3fd8a79446d76",
-    "local-scope-repository.mjs": "d9d4c81c3f401c38c33b8dd7bdf8ebaf4658d1afd1cce408a7acd37f8836a6df",
+    "local-scope-repository.mjs": "941eb895c8210da1ca90e8b3d1d6936c24408d10139fe6c3eba2761329248392",
+    "local-scope-create-require.mjs": "6b6a209bfcad8fe1398e99c5c8cc3af189c120b9c38e244a73dd1a99c3d91295",
+    "local-scope-require-resolution.mjs": "b24596462c8776cbefa6f0a74749d665aa928d1643c68d44798eb93e2dd5ad42",
     "local-scope-git.mjs": "53bbbb6c4795db711b5bc164591a6ad79a561427da046d6bbe997dae6eb82829",
     "local-scope-git-reads.mjs": "5d8a2636bab955cb325cb693db7423e69512355887ae5b5af3b8cb615f5ddad0",
     "local-git-executable.mjs": "9391d716529025b1de3ee006df658a9d765b6ef29ad24ef9b7436829318e651e",
@@ -155,7 +174,7 @@
     "local-scope-state.mjs": "8b600a91fc0068d7a8c0bb752ddba7ed30ada93daafb118d6cba2368fd94cb27",
     "local-scope-workspaces.mjs": "a44c34537e5ed2dcaf193a985e5bc05957989fbb160a650f9e37ba7d66eb2de8",
     "local-task-routing.mjs": "6e2e506b2fb0e2e8d8c5147d7df32849b57a4e94a23634f01a355d45735858e4",
-    "remote-client.mjs": "bfb58132759a4312adc8ab33115d807c5a8d90c955aca3678e361ab9cefa84bd",
+    "remote-client.mjs": "0d1ec6506fe53a1e33c31c5ba19d14e30e00e85e11eaf7ff8277ea798b9f36c9",
     "cloud-task-client.mjs": "11acb1a033c94cdfbdfb177a3402ad97f6a5226f577138c8cf6395dc3ebb1a39",
     "scope-runner-client.mjs": "646ab4f80d4a8209e922fd45f40efd968f0744d9dfc03188b222c1a2e11e83b8",
     "native-client.mjs": "6f5575909bae9daba643287f876ffa0f9ff1c53a367b32a40145d740456d6605",
@@ -188,7 +207,7 @@
     "workflow-local-request.mjs": "4e24c543ce386292a87dc9cd41f90d23375f12079cacffc515c8cd01fd571780",
     "task-message-entry.mjs": "31d10056cb905237cd5649e8eb067009ff1612ec5dc1061e0373209fbc0b646a",
     "task-message-cli.mjs": "3ca65e96c28129b3bd5cac962d106e0859a1f17df1f6a66ee543c6efc22f918d",
-    "local-contracts.mjs": "bb1df682f06782f1c8814d50fe1c455153b29f3a1a093e87dd4ab2ed5ae16e1a",
+    "local-contracts.mjs": "b59fcdace17b0b56117c564f8c15322465243e69adede182c5dde9204836c99c",
     "local-contract-types.mjs": "85e71fa4dd67e351a4b67573c740bcdb1661cede53f097189f11837771e75e91",
     "local-archguard-ast.mjs": "7ff7df9dab0d98ed62983add751c80edea598bc94ef4f38ede0ebd4d41226c87",
     "local-archguard-checkpoint.mjs": "37896902520cc995720c96288e4a5ed3585952b55c9c35be281f91fa754c71ec",
@@ -218,11 +237,11 @@
     "local-mutation-files.mjs": "087b00e8424a135e783eb432271012a71e55eeb4a5e30119490d1bc0b2160320",
     "local-mutation-snapshot.mjs": "f9077539680fb8d3ff33a962657756a8fe6afa8409b6191334509534216ebfe8",
     "local-mutation-audit.mjs": "5a30ee3446f632e032ffcfe46bcd97d6dfc0f099a76ea5185c3f9a9118c4f6cb",
-    "local-mutation-wire.mjs": "465463712f638f40c87fd885932f6a9a8c1db64489bb7ca6614fb643d7a36624",
-    "local-mutation-binding.mjs": "a1756642dd758701b476d332a48799b4af56fdd8f67aba6d46ca9bb2341b6327",
-    "local-mutation-pass-store.mjs": "8d6b57c6d1ea3df15a794e6a4cd39497f4412a5f911b9a30b0437498f51f92c0",
-    "local-mutation-authority.mjs": "1af7e04f545bb82df4ee91c256009d5f8d5ee71aab5a734c80d911dce6a646bb",
-    "local-mutation-batch.mjs": "a4e9d879172e0acf79a194707ae152b4428d6fc67a837171ff115dbc00e4d6e4",
+    "local-mutation-wire.mjs": "7af0c585e8dd6936c0ff17f491c64a198744629f063279c31589d887ec83ae9c",
+    "local-mutation-binding.mjs": "4440d792453a07a375b635fa5a91db607e58162824baced5c79a9a513f4ec918",
+    "local-mutation-pass-store.mjs": "1edc5fcc537dfa04b8ae8b07af554d61ea5911a5da281423ad57214ccf753ad4",
+    "local-mutation-authority.mjs": "ebac0cc8126969bafb0aaaeacf71e05124997d5c3214f8ec32b7a4fa14569bcf",
+    "local-mutation-batch.mjs": "de27686b5f99a99b02f0218a3fa159e9469d6b19c595117287d6dd37a6efcb3b",
     "local-mutation-batch-receipt.mjs": "b0e6a8522867255d899e60b66677885933f6a1c4c771cbb52f84dbbbdcf5e5c2",
     "calctool-runtime-entry.mjs": "98d2bc8df38d16131fc56db0a3d4d260531ba4df412baa5ddc4b8b5c5ca99fe9",
     "calctool-runtime-build.mjs": "3c5a9bd40bc1abe02e3b6e307809eea4eaaf198e8f0db6f5d6b2583dd68a59d2",