@entrorove/skill 0.1.52 → 0.1.54

package/release.mjs

@@ -28,7 +28,26 @@ const coordination17SourceFiles = Object.freeze([
   'local-validator-isolation17.mjs',
   'local-calctool-composition17.mjs',
 ])
+const preservedMutationSourceFiles = Object.freeze([
+  'local-preserved-mutation-protection.mjs', 'local-preserved-mutation-signer.mjs',
+  'local-preserved-mutation-state.mjs', 'local-preserved-mutation-wire.mjs',
+  'local-delegated-modify-analysis.mjs', 'mutation-client.mjs', 'cloud-mutation-authority.mjs',
+])
+const memberContinuationSourceFiles = Object.freeze([
+  'connected-cli.mjs',
+  'local-approved-process.mjs',
+  'local-approved-supervisor.mjs',
+  'local-mutation-consumption.mjs',
+  'workflow-observation-client.mjs',
+  'workflow-observation-connection.mjs',
+  'workflow-observation-remote.mjs',
+  'workflow-observation-runner.mjs',
+  'workflow-observation-state.mjs',
+  'workflow-observation-wire.mjs',
+])
 const sourceFiles = [
+  ...memberContinuationSourceFiles,
+  ...preservedMutationSourceFiles,
   ...REUSE_DISCIPLINE_SOURCE_FILES,
   ...FINAL_GATE16_PACKAGE_FILES,
   'local-merge-archguard-verification.d.mts',
@@ -65,6 +84,8 @@ const sourceFiles = [
   'local-scope-context.mjs',
   'local-scope-files.mjs',
   'local-scope-repository.mjs',
+  'local-scope-create-require.mjs',
+  'local-scope-require-resolution.mjs',
   'local-scope-git.mjs',
   'local-scope-git-reads.mjs',
   'local-git-executable.mjs',
@@ -212,6 +233,12 @@ const calctoolReleaseLabels = Object.freeze({
 })
 
 const mutationReleaseLabels = Object.freeze({
+  ...Object.fromEntries(memberContinuationSourceFiles.map(file => [file, {
+    zh: '原任务连续编辑与本地测试观察', en: 'original-task continuation and local command observation',
+  }])),
+  ...Object.fromEntries(preservedMutationSourceFiles.map(file => [file, {
+    zh: '保留运行时依赖的受限本地编辑授权', en: 'restricted local editing with preserved runtime dependencies',
+  }])),
   'local-mutation-files.mjs': { zh: '原任务短时写入授权与文件快照隔离', en: 'Original task short-lived mutation authority and file snapshot isolation' },
   'local-mutation-snapshot.mjs': { zh: '原任务短时写入授权与文件快照隔离', en: 'Original task short-lived mutation authority and file snapshot isolation' },
   'local-mutation-audit.mjs': { zh: '原任务短时写入授权与文件快照隔离', en: 'Original task short-lived mutation authority and file snapshot isolation' },
@@ -340,6 +367,8 @@ function releaseLabels() {
     'local-scope-context.mjs': { zh: '精确符号范围绑定', en: 'exact symbol scope binding' },
     'local-scope-files.mjs': { zh: '范围文件与安全读取', en: 'scope files and guarded reads' },
     'local-scope-repository.mjs': { zh: '真实仓库范围事实', en: 'actual repository scope facts' },
+    'local-scope-create-require.mjs': { zh: '静态 createRequire 原目录绑定', en: 'static createRequire source-directory binding' },
+    'local-scope-require-resolution.mjs': { zh: '实际 CommonJS 依赖只读解析', en: 'read-only installed CommonJS dependency resolution' },
     'local-scope-config-imports.mjs': { zh: 'tsconfig 范围路径与依赖只读引用', en: 'tsconfig scope paths and read-only dependency references' },
     'local-scope-config-extends.mjs': { zh: 'tsconfig npm 配置继承解析', en: 'tsconfig npm configuration inheritance resolution' },
     'local-scope-git.mjs': { zh: '实际Git范围与变更事实', en: 'actual Git scope and change facts' },

package/releases.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.1.54",
+    "date": "2026-10-17",
+    "zh": "修复受管 Node 只读 SHA-256 命令在 Codex 工具门禁中的静态识别与安全改写；按已证明的 createRequire 原目录解析实际安装依赖并记录只读元数据，保留未知上下文和越界拒绝。",
+    "en": "Fixed static recognition and safe rewriting of managed Node SHA-256 reads in Codex tool guards; resolved installed dependencies from proven createRequire anchors with read-only metadata while preserving unknown-context and path-boundary refusals."
+  },
+  {
+    "version": "0.1.53",
+    "date": "2026-10-17",
+    "zh": "补齐原任务受限编辑、真实写后结算与连续修改，保留未知依赖和独立验证边界；沙箱关闭后可运行原批准命令并保存本地观察。修复前置条件、断线恢复和停止循环，独立监督器约束崩溃后的子进程。本地成功不代表独立验证或交付。",
+    "en": "Added original-task restricted editing, real write settlement and subsequent modifications while preserving unknown dependencies and independent validation. With cloud sandbox disabled, retain actual observations of the approved command. Fixed prerequisite recovery, disconnections and Stop loops; an independent supervisor bounds child processes after CLI failure. Local success does not certify independent verification or delivery."
+  },
   {
     "version": "0.1.52",
     "date": "2026-10-17",

package/remote-client.mjs

@@ -37,7 +37,8 @@ function discoveredAjv() {
 export function buildInvocation(operation, input) {
   if (!['capabilities', 'task-describe', 'message-route', 'message-accept', 'task-resume', 'task-checkpoint', 'flow-cancel', 'flow-abandon',
     'message-status', 'message-delivery-start', 'message-delivery-report', 'message-resolve', 'message-complete',
-    'handoff-prepare', 'handoff-release', 'handoff-claim', 'handoff-status', 'handoff-resume', 'handoff-execution-authority', 'mutation-snapshot-challenge', 'mutation-pass-issue',
+    'handoff-prepare', 'handoff-release', 'handoff-claim', 'handoff-status', 'handoff-resume', 'handoff-execution-authority', 'mutation-snapshot-challenge', 'mutation-pass-issue', 'mutation-pass-settle',
+    'member-observation-admit', 'member-observation-report', 'member-observation-status',
     'scope-runner-prepare', 'scope-runner-register', 'scope-runner-challenge', 'scope-runner-attest',
     'start', 'continue'].includes(operation)) throw new Error('Invalid entrorove operation');
   if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('Input must be a JSON object');

package/workflow-observation-client.mjs

@@ -0,0 +1,44 @@
+import { bootstrapCloudMutationAuthority } from './cloud-mutation-authority.mjs';
+import { observationInput } from './workflow-observation-wire.mjs';
+
+const safeId = value => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value);
+const safeRequest = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
+const messages = {
+  ENTROROVE_LOCAL_OBSERVATION_UNKNOWN: 'Original observation outcome is unknown; recover its original GET without repeating execution',
+  ENTROROVE_LOCAL_OBSERVATION_NOT_SENT: 'Observation was not transmitted; repair its local or discovery prerequisite and reuse the original input',
+  ENTROROVE_LOCAL_OBSERVATION_PREREQUISITE: 'Local observation requires cloud sandbox disabled and its original live execution lease',
+  ENTROROVE_SCOPE_RECEIPT_EXPIRED: 'Refresh the original scope evidence and reuse the original observation input',
+  ENTROROVE_SCOPE_AFTER_WRITE_REQUIRED: 'Observe the settled modifications in fresh scope evidence before local testing',
+};
+function blocked(error, input) {
+  const cause = error && typeof error === 'object' ? error : {};
+  const code = typeof cause.code === 'string' && /^ENTROROVE_[A-Z0-9_]{1,100}$/.test(cause.code)
+    ? cause.code : 'ENTROROVE_LOCAL_OBSERVATION';
+  const output = cause.output, requestId = safeRequest(cause.requestId) ? cause.requestId : undefined;
+  const recoverable = output?.status === 'blocked' && output.recoverable === true
+    && (output.observationPrerequisite?.effect === 'none' || ['ENTROROVE_SCOPE_RECEIPT_EXPIRED',
+      'ENTROROVE_SCOPE_RUNNER_REQUIRED', 'ENTROROVE_SCOPE_SNAPSHOT_REQUIRED', 'ENTROROVE_SCOPE_AFTER_WRITE_REQUIRED'].includes(code));
+  const reason = ['sandbox-enabled', 'lease-expired', 'receipt-expired', 'after-write-observation-required'].includes(output?.reason)
+    ? output.reason : undefined;
+  return { schemaVersion: 'entrorove.local-observation-connection/1.0', status: 'blocked',
+    ...(safeId(input?.flowId) ? { flowId: input.flowId } : {}), independentValidation: 'pending', code,
+    message: messages[code] ?? 'Local observation could not continue; its original command and result remain preserved',
+    ...(recoverable ? { prerequisite: { status: 'blocked', code, recoverable: true, ...(reason ? { reason } : {}),
+      nextAction: { operation: 'workflow-observe-step', reuseOriginalInput: true,
+        ...(safeRequest(output.requestId) ? { resumeRequestId: output.requestId } : {}) } } } : {}),
+    ...(cause.outcomeUnknown === true && requestId ? { outcomeUnknown: true, requestId, repeatPost: false,
+      nextAction: { operation: 'workflow-observe-step', reuseOriginalInput: true, method: 'GET' } } : {}),
+    ...(cause.knownBeforeTransmission === true && requestId ? { requestId, knownBeforeTransmission: true } : {}) };
+}
+export async function runWorkflowObserveStep(repositoryRoot, input, dependencies) {
+  try {
+    observationInput(input);
+    await dependencies.install();
+    if (!await dependencies.agreementAccepted(dependencies.home)) return dependencies.agreementRequired(dependencies.home);
+    await bootstrapCloudMutationAuthority(dependencies);
+    const { connectWorkflowObservation } = await import('./workflow-observation-connection.mjs');
+    return await connectWorkflowObservation(repositoryRoot, input, dependencies);
+  } catch (error) {
+    return blocked(error, input);
+  }
+}

package/workflow-observation-connection.mjs

@@ -0,0 +1,35 @@
+import { canonical, sha256 } from './local-integrity.mjs';
+import { withStateLock } from './local-state-lock.mjs';
+import { trustedOrigin } from './remote-transport.mjs';
+import { observationAdmission, observationFail } from './workflow-observation-wire.mjs';
+import { observationLocation, readObservationState } from './workflow-observation-state.mjs';
+import { runWorkflowObservation } from './workflow-observation-runner.mjs';
+import { observationRemote, authorizeObservation } from './workflow-observation-remote.mjs';
+
+async function connect(input, state, location, dependencies) {
+  const original = Object.fromEntries(['taskId', 'flowId', 'stepId', 'leaseId', 'generation', 'settlementId'].map(key => [key, input[key]]));
+  const admitted = state.admitted ?? await observationRemote('admitted', 'member-observation-admit', original, state, location, dependencies);
+  const admission = observationAdmission(admitted.admission, input, { allowExpired: Boolean(state.result) });
+  await authorizeObservation(admission, dependencies, !state.result);
+  const cached = Boolean(state.result), result = await runWorkflowObservation(input, admission, state, location,
+    { authorize: () => authorizeObservation(admission, dependencies, true) });
+  if (result.runner !== 'local' || result.receipt !== null || result.independentValidation !== 'pending'
+    || result.executionIsolation !== 'host-permissions' || result.externalEffects !== 'unverified'
+    || !['incomplete', 'failed'].includes(result.status) || result.admissionDigest !== sha256(canonical(admission))) {
+    observationFail('Local observation cannot replace independent validation or its original admitted result');
+  }
+  const reported = state.reported ?? await observationRemote('reported', 'member-observation-report', {
+    observationId: admission.observationId, admissionDigest: sha256(canonical(admission)), result,
+  }, state, location, dependencies);
+  if (reported.observationId !== admission.observationId || reported.observationStatus !== 'pending-independent'
+    || reported.resultDigest !== sha256(canonical(result)) || canonical(reported.result) !== canonical(result)) {
+    observationFail('Stored local observation differs from its actual original result');
+  }
+  return { ...result, taskId: input.taskId, flowId: input.flowId, stepId: input.stepId, cached, stored: true,
+    resultDigest: sha256(canonical(result)), grantsExecutionAuthority: false, grantsValidatorAuthority: false };
+}
+export async function connectWorkflowObservation(repositoryRoot, original, dependencies) {
+  const location = await observationLocation(repositoryRoot, original, dependencies.home, trustedOrigin(dependencies.apiOrigin()));
+  const input = { ...original, repositoryRoot: location.root, home: location.home };
+  return withStateLock(location.file, async () => connect(input, await readObservationState(location), location, dependencies));
+}

package/workflow-observation-remote.mjs

@@ -0,0 +1,84 @@
+import { canonical } from './local-integrity.mjs';
+import { buildInvocation, invokeRemoteResult } from './remote-client.mjs';
+import { requestTransport, parseTransportResponse } from './remote-transport.mjs';
+import { ideClientHeaders } from './ide-presentation.mjs';
+import { acknowledgeAutomaticFeedback, queryAutomaticFeedback, verifyAutomaticFeedback } from './automatic-feedback-client.mjs';
+import { saveObservationState } from './workflow-observation-state.mjs';
+import { observationFail } from './workflow-observation-wire.mjs';
+import { readInvocations } from './local-invocations.mjs';
+
+const unknown = requestId => Object.assign(new Error('Original local observation request outcome is unknown; recover its GET without repeating execution'),
+  { code: 'ENTROROVE_LOCAL_OBSERVATION_UNKNOWN', outcomeUnknown: true, requestId });
+const notSent = requestId => Object.assign(new Error('Original local observation was not transmitted'),
+  { code: 'ENTROROVE_LOCAL_OBSERVATION_NOT_SENT', knownBeforeTransmission: true, requestId });
+async function knownNotSent(pending, home) {
+  try {
+    const records = (await readInvocations(home)).filter(value => value.kind === 'remote'
+      && value.operation === pending.operation && value.requestId === pending.requestId);
+    return !records.length || records.at(-1).event === 'not-sent';
+  } catch (error) { return error?.code === 'ENOENT'; }
+}
+async function recover(pending, dependencies) {
+  const token = await dependencies.readCredential(dependencies.home), origin = dependencies.apiOrigin();
+  let response, result;
+  try {
+    response = await requestTransport(origin, `/api/skill/status/${pending.requestId}`, { headers: {
+      authorization: `Bearer ${token}`, ...ideClientHeaders() } });
+    result = parseTransportResponse(response, 'original local observation status');
+    if (!response.ok || result?.output?.requestId !== pending.requestId
+      || ['pending', 'running'].includes(result.output.status)) throw unknown(pending.requestId);
+    result.feedback ??= await queryAutomaticFeedback(pending.requestId, dependencies);
+    verifyAutomaticFeedback(result.feedback, pending.requestId, pending.requestId);
+    result.feedback = await acknowledgeAutomaticFeedback(result.feedback, origin, token, ideClientHeaders());
+  } catch { throw unknown(pending.requestId); }
+  return { response, result };
+}
+function prerequisite(output) {
+  return output?.status === 'blocked' && output.recoverable === true && (output.observationPrerequisite?.effect === 'none'
+    || ['ENTROROVE_SCOPE_RECEIPT_EXPIRED', 'ENTROROVE_SCOPE_RUNNER_REQUIRED', 'ENTROROVE_SCOPE_SNAPSHOT_REQUIRED',
+      'ENTROROVE_SCOPE_AFTER_WRITE_REQUIRED'].includes(output.code));
+}
+export async function observationRemote(stage, operation, input, state, location, dependencies) {
+  const requestId = buildInvocation(operation, input).requestId;
+  let response, result;
+  if (state.pending) {
+    if (state.pending.stage !== stage || state.pending.operation !== operation || state.pending.requestId !== requestId
+      || canonical(state.pending.input) !== canonical(input)) observationFail('Original observation request must finish before another operation');
+    ({ response, result } = await recover(state.pending, dependencies));
+  } else {
+    state.pending = { stage, operation, input, requestId };
+    try { await saveObservationState(location, state); } catch { throw notSent(requestId); }
+    try { ({ response, result } = await invokeRemoteResult({ operation, input }, dependencies)); }
+    catch {
+      if (await knownNotSent(state.pending, dependencies.home)) {
+        delete state.pending;
+        try { await saveObservationState(location, state); } catch { throw notSent(requestId); }
+        throw notSent(requestId);
+      }
+      throw unknown(requestId);
+    }
+  }
+  if (!response.ok || !['reported', 'succeeded'].includes(result?.output?.status)) {
+    if (operation === 'member-observation-admit' && prerequisite(result?.output)) {
+      delete state.pending; await saveObservationState(location, state);
+      throw Object.assign(new Error(result.output.message ?? 'Original local observation prerequisite is unresolved'),
+        { code: result.output.code, output: result.output });
+    }
+    throw unknown(requestId);
+  }
+  state[stage] = result.output; delete state.pending; await saveObservationState(location, state);
+  return result.output;
+}
+export async function authorizeObservation(admission, dependencies, launching) {
+  const token = await dependencies.readCredential(dependencies.home);
+  const response = await requestTransport(dependencies.apiOrigin(), `/api/skill/flows/${admission.flowId}/status`, {
+    headers: { authorization: `Bearer ${token}`, ...ideClientHeaders() } });
+  const status = parseTransportResponse(response, 'original local observation account');
+  if (!response.ok || status?.schemaVersion !== 'entrorove.flow-status/1.0'
+    || status.flow?.flowId !== admission.flowId || status.flow.ownerId !== admission.ownerId
+    || launching && (status.flow.stepId !== admission.stepId || status.flow.status !== 'running'
+      || status.workflow?.phase !== 'execute' || status.workflow.terminalAt
+      || ['pending', 'declined'].includes(status.workflow.authorization))) {
+    observationFail('Current account cannot confirm its original local observation task and execution step');
+  }
+}

package/workflow-observation-runner.mjs

@@ -0,0 +1,87 @@
+import { promises as fs } from 'node:fs';
+import { canonical, sha256 } from './local-integrity.mjs';
+import { scopeRead, scopeTarget } from './local-scope-files.mjs';
+import { regular } from './local-task-handoff-storage.mjs';
+import { assertBudgetRunnerAllowed, withBudgetReadContext } from './local-budget-reads.mjs';
+import { disciplineRepositoryObservation, disciplineRepositoryDifferences } from './local-discipline-repository.mjs';
+import { runApprovedProcess } from './local-approved-process.mjs';
+import { observationAdmission, observationFail } from './workflow-observation-wire.mjs';
+import { saveObservationState } from './workflow-observation-state.mjs';
+
+async function observeFile(input, expected) {
+  const before = await scopeTarget(input.repositoryRoot, expected.path, false, true);
+  const read = await scopeRead(input.repositoryRoot, expected.path, input);
+  const after = await scopeTarget(input.repositoryRoot, expected.path, false, true);
+  if (read.sha256 !== expected.sha256 || expected.mode !== undefined && expected.mode !== null && (after.stat.mode & 511) !== expected.mode
+    || before.stat.dev !== after.stat.dev || before.stat.ino !== after.stat.ino || before.stat.mode !== after.stat.mode) {
+    observationFail('Local observation source or dependency differs from its admitted bytes and permissions');
+  }
+  return { path: expected.path, sha256: read.sha256, mode: after.stat.mode & 511,
+    realPath: await fs.realpath(after.target), dev: after.stat.dev, ino: after.stat.ino };
+}
+async function files(input, manifest) {
+  const result = [];
+  for (const expected of manifest) result.push(await observeFile(input, expected));
+  return result;
+}
+async function executable(admission) {
+  const { bytes, stat } = await regular(admission.command.executable, 256 * 1024 * 1024);
+  if (sha256(bytes) !== admission.command.executableSha256) observationFail('Local observation executable differs from its frozen command hash');
+  return { mode: stat.mode, dev: stat.dev, ino: stat.ino };
+}
+const same = (before, after) => canonical(before) === canonical(after);
+async function remains(action, expected) { try { return same(expected, await action()); } catch { return false; } }
+function processMetadata(process) {
+  return Object.fromEntries(['status', 'started', 'startedAt', 'finishedAt', 'exitCode', 'signal', 'timedOut',
+    'outputLimitExceeded', 'durationMs', 'stdoutSha256', 'stderrSha256', 'capturedBytes', 'droppedBytes'].map(key => [key, process[key]]));
+}
+async function execute(input, admission, state, location, options) {
+  if (state.run) observationFail('Original local observation already started or has an unknown outcome; a new process is forbidden');
+  observationAdmission(admission, input);
+  await assertBudgetRunnerAllowed(input);
+  const originalSources = await files(input, admission.sourceManifest), originalProtected = await files(input, admission.protectedFiles);
+  const originalExecutable = await executable(admission);
+  const before = (await disciplineRepositoryObservation(input, input.repositoryRoot)).comparison;
+  observationAdmission(admission, input);
+  state.run = { phase: 'running', pid: process.pid, startedAt: new Date().toISOString() };
+  await saveObservationState(location, state);
+  let processResult;
+  try {
+    await assertBudgetRunnerAllowed(input);
+    if (!same(originalSources, await files(input, admission.sourceManifest))
+      || !same(originalProtected, await files(input, admission.protectedFiles))
+      || !same(originalExecutable, await executable(admission))) observationFail('Local observation inputs changed immediately before execution');
+    observationAdmission(admission, input);
+    if (options.authorize) await options.authorize();
+    observationAdmission(admission, input);
+    processResult = await runApprovedProcess({ root: input.repositoryRoot, policy: admission.command,
+      objectPlan: true, startDeadlineAt: admission.expiresAt });
+  } catch (error) {
+    if (!error?.execution?.process) {
+      state.run.phase = 'aborted'; await saveObservationState(location, state);
+      observationFail('Local observation stopped before a completed process; recover the original observation without rerunning');
+    }
+    processResult = error.execution.process;
+  }
+  let after = before, budgetAllowed = true;
+  try { await assertBudgetRunnerAllowed(input); after = (await disciplineRepositoryObservation(input, input.repositoryRoot)).comparison; }
+  catch { budgetAllowed = false; }
+  const checks = { sourceManifestUnchanged: budgetAllowed && await remains(() => files(input, admission.sourceManifest), originalSources),
+    protectedFilesUnchanged: budgetAllowed && await remains(() => files(input, admission.protectedFiles), originalProtected),
+    repositoryUnchanged: budgetAllowed && disciplineRepositoryDifferences(before, after).length === 0
+      && await remains(() => executable(admission), originalExecutable) };
+  state.result = { schemaVersion: 'entrorove.local-observation-result/1.0', observationId: admission.observationId,
+    admissionDigest: sha256(canonical(admission)), status: processResult.status === 'succeeded' && Object.values(checks).every(Boolean) ? 'incomplete' : 'failed',
+    independentValidation: 'pending', runner: 'local', receipt: null,
+    executionIsolation: 'host-permissions', externalEffects: 'unverified', process: processMetadata(processResult),
+    sourceManifestDigest: sha256(canonical(admission.sourceManifest)), checks,
+    beforeRepositoryDigest: sha256(canonical(before)), afterRepositoryDigest: sha256(canonical(after)) };
+  state.resultDigest = sha256(canonical(state.result)); state.run.phase = 'finished';
+  await saveObservationState(location, state);
+  return state.result;
+}
+export async function runWorkflowObservation(input, admission, state, location, options = {}) {
+  observationAdmission(admission, input, { allowExpired: Boolean(state.result) });
+  if (state.result) return state.result;
+  return withBudgetReadContext(input, () => execute(input, admission, state, location, options));
+}

package/workflow-observation-state.mjs

@@ -0,0 +1,36 @@
+import path from 'node:path';
+import { canonical, sha256 } from './local-integrity.mjs';
+import { mutationRoot14, mutationHome14, mutationStateRoot14, privateMutationDirectory14,
+  readMutationJson14, atomicMutationJson14 } from './local-mutation-files.mjs';
+import { observationExact, observationFail } from './workflow-observation-wire.mjs';
+
+export async function observationLocation(repositoryRoot, input, home, apiOrigin) {
+  const root = await mutationRoot14(repositoryRoot), actualHome = await mutationHome14(home);
+  const relative = path.relative(root, actualHome);
+  if (!relative || relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative)) {
+    observationFail('Local observation state must be outside the observed repository');
+  }
+  const identity = { ...input, repositoryRoot: root, home: actualHome, apiOrigin };
+  const stateRoot = await mutationStateRoot14({ home: actualHome });
+  const directory = path.join(stateRoot, 'local-observations', sha256(root).slice(0, 32), input.flowId, sha256(canonical(identity)));
+  await privateMutationDirectory14(directory, { privateFrom: stateRoot });
+  return { root, home: actualHome, identity, stateRoot, file: path.join(directory, 'journal.json') };
+}
+export async function readObservationState(location) {
+  let state;
+  try { state = await readMutationJson14(location.file); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; }
+  if (!state) return { schemaVersion: 'entrorove.local-observation-state/1.0', identity: location.identity };
+  if (state.schemaVersion !== 'entrorove.local-observation-state/1.0' || canonical(state.identity) !== canonical(location.identity)) {
+    observationFail('Local observation journal lost its original repository, home, task or settlement');
+  }
+  if (state.result && state.resultDigest !== sha256(canonical(state.result))) observationFail('Local observation stored result integrity changed');
+  if (state.run) {
+    observationExact(state.run, ['phase', 'pid', 'startedAt']);
+    if (!['running', 'finished', 'aborted'].includes(state.run.phase) || !Number.isSafeInteger(state.run.pid)
+      || !Number.isFinite(Date.parse(state.run.startedAt))) observationFail('Local observation running state is invalid');
+  }
+  return state;
+}
+export const saveObservationState = (location, state) => atomicMutationJson14(location.file, state,
+  { privateFrom: location.stateRoot, replace: true });

package/workflow-observation-wire.mjs

@@ -0,0 +1,69 @@
+import { createPublicKey, verify } from 'node:crypto';
+import { canonical, sha256 } from './local-integrity.mjs';
+import { mutationId14, mutationPaths14 } from './local-mutation-files.mjs';
+
+export const observationFail = message => { throw Object.assign(new Error(message), { code: 'ENTROROVE_LOCAL_OBSERVATION' }); };
+export const observationIdentityFields = ['taskId', 'flowId', 'stepId', 'leaseId', 'generation', 'settlementId'];
+export function observationExact(value, fields) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || canonical(Object.keys(value).sort()) !== canonical([...fields].sort())) observationFail('Local observation fields are invalid');
+}
+export function observationInput(input) {
+  observationExact(input, observationIdentityFields);
+  for (const field of observationIdentityFields.filter(field => field !== 'generation')) mutationId14(input[field], field);
+  if (!Number.isSafeInteger(input.generation) || input.generation < 1) observationFail('Local observation generation is invalid');
+  return input;
+}
+function command(value) {
+  observationExact(value, ['executable', 'executableSha256', 'args', 'environment', 'timeoutMs', 'maxOutputBytes', 'requiredExitCode']);
+  if (typeof value.executable !== 'string' || !value.executable.startsWith('/') || /[\u0000-\u001f\u007f]/.test(value.executable)
+    || !/^[a-f0-9]{64}$/.test(value.executableSha256) || !Array.isArray(value.args) || value.args.length > 128
+    || value.args.some(arg => typeof arg !== 'string' || arg.length > 4096 || arg.includes('\0'))
+    || !value.environment || typeof value.environment !== 'object' || Array.isArray(value.environment)
+    || Object.keys(value.environment).length > 64 || Object.entries(value.environment).some(([key, val]) =>
+      !/^[A-Za-z_][A-Za-z0-9_]*$/.test(key) || typeof val !== 'string' || val.length > 16_384 || val.includes('\0'))
+    || !Number.isSafeInteger(value.timeoutMs) || value.timeoutMs < 1 || value.timeoutMs > 300_000
+    || !Number.isSafeInteger(value.maxOutputBytes) || value.maxOutputBytes < 1 || value.maxOutputBytes > 1_048_576
+    || value.requiredExitCode !== 0) observationFail('Local observation command differs from its bounded frozen policy');
+}
+function files(values, modes) {
+  if (!Array.isArray(values) || !values.length || values.length > (modes ? 512 : 2_000)) observationFail('Local observation manifest is invalid');
+  const paths = mutationPaths14(values.map(file => file.path));
+  if (canonical(paths) !== canonical(values.map(file => file.path))) observationFail('Local observation manifest must be sorted and unique');
+  for (const file of values) {
+    observationExact(file, ['path', 'sha256', ...(modes ? ['mode'] : [])]);
+    if (!/^[a-f0-9]{64}$/.test(file.sha256) || modes && file.mode !== null
+      && (!Number.isSafeInteger(file.mode) || file.mode < 0 || file.mode > 511)) observationFail('Local observation file baseline is invalid');
+  }
+}
+function signature(value) {
+  try {
+    const encoded = process.env.ENTROROVE_WORKFLOW_PLAN_PUBLIC_KEY, der = Buffer.from(encoded ?? '', 'base64');
+    const key = createPublicKey({ key: der, type: 'spki', format: 'der' }), receipt = value.authorityReceipt;
+    observationExact(receipt, ['schemaVersion', 'keyId', 'payloadDigest', 'signature']);
+    const { authorityReceipt: _, ...core } = value, bytes = Buffer.from(canonical(core));
+    const signed = Buffer.from(receipt.signature, 'base64url');
+    if (key.asymmetricKeyType !== 'ed25519' || key.export({ type: 'spki', format: 'der' }).toString('base64') !== encoded
+      || receipt.schemaVersion !== 'entrorove.workflow-authority-receipt/1.0' || receipt.keyId !== sha256(der)
+      || receipt.payloadDigest !== sha256(bytes) || bytes.length > 1_048_576
+      || signed.length !== 64 || signed.toString('base64url') !== receipt.signature || !verify(null, bytes, key, signed)) throw new Error();
+  } catch { observationFail('Local observation requires its original pinned public cloud admission signature'); }
+}
+export function observationAdmission(value, input, { allowExpired = false } = {}) {
+  observationExact(value, [...observationIdentityFields, 'schemaVersion', 'purpose', 'observationId', 'ownerId', 'taskDigest',
+    'chainDigest', 'epoch', 'planId', 'planDigest', 'executionPlanSha256', 'repositoryDigest', 'settlementDigest', 'command',
+    'sourceManifest', 'protectedFiles', 'issuedAt', 'expiresAt', 'authorityReceipt']);
+  signature(value);
+  const start = Date.parse(value.issuedAt), end = Date.parse(value.expiresAt);
+  if (value.schemaVersion !== 'entrorove.local-observation-admission/1.0' || value.purpose !== 'observe-approved-command'
+    || value.epoch !== 0 || observationIdentityFields.some(field => value[field] !== input[field])
+    || value.repositoryDigest !== sha256(input.repositoryRoot).slice(0, 32) || !Number.isFinite(start) || !Number.isFinite(end)
+    || start > Date.now() || end <= start || end - start > 600_000 || !allowExpired && end <= Date.now()
+    || !/^[a-f0-9-]{36}$/.test(value.ownerId)
+    || ['taskDigest', 'chainDigest', 'planDigest', 'executionPlanSha256', 'settlementDigest'].some(field => !/^[a-f0-9]{64}$/.test(value[field]))) {
+    observationFail('Local observation admission is expired or lost its original task, repository or settlement');
+  }
+  mutationId14(value.observationId, 'observationId'); mutationId14(value.planId, 'planId');
+  command(value.command); files(value.sourceManifest, true); files(value.protectedFiles, false);
+  return value;
+}