@entrorove/skill 0.1.55 → 0.1.57

package/CAPABILITY-MAP.md

@@ -6,7 +6,7 @@
 | --- | --- | --- |
 | 成员受限编辑 | `mutation-connect <repositoryRoot>`、`local mutation-delegate-prepare` | 原任务、冻结修改声明及租约绑定；观察、编辑、独立验证三把密钥分离。运行时依赖保持未知且只读，只允许现存文件的受限修改；不授予通用执行、合并或交付权限 |
 | 连续编辑结算 | `mutation-settle <repositoryRoot>`、`local mutation-consumption-attest`、服务端 `mutation-pass-settle` | 实际写后 M 回执与 fresh S 后验共同确认原 pass；下一轮使用 `previousPassId`，不伪造架构验证事件 |
-| 沙箱关闭后的本地测试 | `workflow-observe-step <repositoryRoot>`、`member-observation-admit/report/status` | 仅运行原冻结命令，对照已结算源文件和保护依赖；结果独立保存为 local / pending-independent，不升格为 V 验证或交付 |
+| 沙箱关闭后的本地验收 | `workflow-observe-step <repositoryRoot>`、`member-observation-admit/report/status`、`workflow-verdict` | 服务器签名 member-local 计划中，原冻结命令和测试真实通过后签发独立保存的 localAcceptance，续跑原步骤并完成本地验收；原 O 无 V 回执，明确未进行独立验证。原范围、审批、S/M 分离及未知依赖保护保留 |
 | 续跑入口 | 原 `execution-claim`、原 flow 恢复 | 成员受限范围返回原字段的 `localAction`，客户端串联真实快照、签名、云端通行证及本地安装；网络结果不明时恢复原请求 |
 | 同一阻断停止 | IDE `Stop` 回调 | 真实重复阻断可等待；状态查询及检查点不能重置阻断，宿主重复 Stop 不再生成无限续跑。原 flow、需求队列与恢复数据保留 |
 

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.57 — 2026-10-17
+
+- 云端关闭时以原本地 IDE 执行与实际测试完成本地验收，补齐签名步骤续跑、最终验收、钩子与队列恢复；保留原范围、审批和 S/M 证据，明确未做独立验证。修复原规划字段诊断与沙箱模式恢复。
+- Completed explicit local IDE acceptance with real execution and tests when cloud sandbox is disabled, including signed step progress, final acceptance, hooks and queue recovery while preserving original scope, approvals and S/M evidence without claiming independent verification. Added precise planning diagnostics and original sandbox-mode recovery.
+
+## 0.1.56 — 2026-10-17
+
+- 补齐原工作流显式只读步骤及无写入结算的本地观察，复核真实受检仓库字节与权限；修复流程列表空输入兼容，返回精确规划前置条件与范围错误，并配置 GitHub OIDC 发布。
+- Added explicit read-only workflow steps and local observations without fabricated mutation settlements, checking actual repository bytes and modes; fixed empty-input flow listing, precise planning prerequisite and scope errors, and GitHub OIDC publishing metadata.
+
 ## 0.1.55 — 2026-10-17
 
 - 修复任务间消息被技能误拦截，将已授权通信交回主机审批；规范只读和 SDK 命令执行参数；新增原流程计划阶段的显式范围重评与恢复提示，保留原门禁、合同、请求身份及失败历史。

package/IDE-EXECUTION.md

@@ -6,6 +6,8 @@ If the IDE guard itself is the blocked step, run `entrorove unlock` directly fro
 
 Capability discovery and offline unlock remain administrative calls during `entry`, before a flow exists. The guard recognizes its own rendered commands with quoted identity assignments, their order changed, or a literal `env` prefix containing only supported host/session identities; it rewrites approved calls to the installed runtime and current session. This does not authorize native scripts or unbound project writes.
 
+`flows` is a read-only account query with no stdin. For host compatibility, the guard accepts a literal empty `{}` here-doc on `flows` and removes it from the bound command; any nonempty input remains rejected.
+
 Approved Codex `exec_command` reads and SDK calls run with `/bin/sh` and `login:false`; static code mode uses the same execution input check. Its noninteractive workdir and output controls pass through. Other hosts keep their adapter's command schema, including timeout where supported, with custom executors and permission expansion rejected.
 
 For a Codex task-to-task report explicitly authorized by the human user, the guard passes the exact `mcp__codex_app__send_message_to_thread` tool through unchanged, including a static `tools.mcp__codex_app__send_message_to_thread({...})` call inside `functions.exec`. Codex still decides whether the user authorized the message. Its text and response grant no Entrorove flow, file, shell or task-creation authority.
@@ -34,7 +36,7 @@ Set `ENTROROVE_IDE` to the actual host name (for example `Codex`, `Cursor` or `C
 
 ### Interrupting and resuming requirements
 
-User text received during an unfinished governed task is persisted as an exact, private queue entry. `queue status` reads it; `queue route` assigns the existing `background`, `normal`, `high` or `urgent` priority. `interrupt` only takes effect at a controlled-call checkpoint and keeps the parent flow, task ID, task number, request ID, repository and account binding. Once the inserted requirement has a verified completion and stored feedback acknowledgement, the parent is restored and its returned `nextStep` is the only continuation. Stop may request one bounded continuation to classify a queued requirement or recover an unresolved request read only. A persisted repeated blocker may wait without terminating or advancing the original queue; automatic continuation is limited to one attempt per user turn and respects the host's `stop_hook_active` signal. Status queries and checkpoints do not erase the blocker. The queue does not promise execution when the host is powered off or the IDE process is unavailable.
+User text received during an unfinished governed task is persisted as an exact, private queue entry. `queue status` reads it; `queue route` assigns the existing `background`, `normal`, `high` or `urgent` priority. `interrupt` only takes effect at a controlled-call checkpoint and keeps the parent flow, task ID, task number, request ID, repository and account binding. Once the inserted requirement satisfies its original completion contract and stored feedback acknowledgement, the parent is restored and its returned `nextStep` is the only continuation. A member-local task requires the signed final local acceptance; an independent task requires verified completion. Stop may request one bounded continuation to classify a queued requirement or recover an unresolved request read only. A persisted repeated blocker may wait without terminating or advancing the original queue; automatic continuation is limited to one attempt per user turn and respects the host's `stop_hook_active` signal. Status queries and checkpoints do not erase the blocker. The queue does not promise execution when the host is powered off or the IDE process is unavailable.
 
 ### Delivery boundaries and stop-loss
 
@@ -90,7 +92,19 @@ After the pass's actual writes finish, rerun the original `scope-connect` with i
 
 If settlement reports `ENTROROVE_SCOPE_AFTER_WRITE_REQUIRED`, refresh only the original scope and retry the same consumption request and receipt. A lost network response is different: rerunning the identical connector restores its original GET result without a replacement POST or signature.
 
-With cloud sandbox disabled, the returned `observationAction` runs `npx @entrorove/skill workflow-observe-step <original repositoryRoot>` with `{taskId,flowId,stepId,leaseId,generation,settlementId}`. The service admits only the original frozen command, executable hash, environment and limits, with source hashes updated solely by accepted settlements. The local runner checks the actual source and protected dependencies before and after execution. No validator private key is needed. A real successful process remains `status: incomplete`, `runner: local`, `receipt: null`, `independentValidation: pending`; its result is stored separately and read with `member-observation-status`. It cannot advance formal verified dependencies or task delivery. Reentry preserves a completed process result; an unknown process outcome never authorizes an automatic second launch.
+With cloud sandbox disabled, the returned `observationAction` runs `npx @entrorove/skill workflow-observe-step <original repositoryRoot>`. A mutable step uses `{taskId,flowId,stepId,leaseId,generation,settlementId}` and the service updates source hashes only through accepted M settlements. An explicitly frozen read-only step uses `{taskId,flowId,stepId,leaseId,generation}`; its signed admission declares `sourceKind: original-read-only-plan` and contains no settlement ID or digest. Both paths require the original frozen command, executable hash, environment, limits and current signed source manifest. The local runner checks actual source and protected dependencies before and after execution, including repository bytes and modes. No validator private key is needed. The raw observation stays `status: incomplete`, `runner: local`, `receipt: null`, `independentValidation: pending`; local acceptance is represented separately below. Reentry preserves a completed process result; an unknown process outcome never authorizes an automatic second launch.
+
+### Local IDE acceptance
+
+For an enrolled member with the account's cloud sandbox disabled, `workflow-plan` freezes a server-signed `verificationMode: member-local`, `runnerKeyId: null` plan bound to the original scope signer. This is an explicit local acceptance contract. It neither depends on a missing V key nor changes an already frozen independent plan. Both fully known and restricted dependency scopes retain their existing write guards; unknown loaders remain protected.
+
+Use each returned original `localAction` and `observationAction`. Only an actual successful original process, passing checks and unchanged protected repository can receive a server-signed `localAcceptance`. The wrapper reports `local-accepted` and `independentValidation: not-performed`, while its raw observation remains intact. The CLI and IDE hook verify that signature and the original request, lease and result binding. Local dependencies carry `localDependencies`; formal `verifiedDependencies` remain empty. A failed process, changed bytes, forged signature or unknown outcome cannot advance the next step.
+
+After all original steps and requirement checkpoints have passed, invoke the returned `workflow-verdict`. A signed `entrorove.member-local-workflow-acceptance/1.0` completes local acceptance of that same task. Display “本地执行与测试已验收；未进行独立验证”. Formal V, Blueprint independent criteria, Swarm, merge and handoff reject local plans. Do not generate a validator key, claim independent verification, alter failed history or create a replacement flow.
+
+The installed hook verifies the original signed local result before continuing or ending the task. Final acceptance and acknowledged truthful feedback permit restoring its queued parent and cleaning superseded snapshots for this flow, preserving original, final and referenced rollback copies. Cloud resource expiry can clean that resource while a valid original local plan continues; explicit cancellation and already terminal workflows retain their original termination.
+
+For `ENTROROVE_PLAN_VALIDATION_REQUIRED`, correct only the identified proposal field and derive a canonical request identity from the corrected content on the same flow. Manifest hashes use `SHA256("validator.file-manifest/1.0\n" + files.map(file => file.path + "\0" + file.sha256).join("\n"))`, without a trailing newline. This is distinct from the canonical JSON digest of the tests array. `ENTROROVE_PLAN_SCOPE_REVIEW_REQUIRED` does not authorize extra existing files or name an executable scope amendment operation; preserve the exact accepted targets and obtain the original scope authority before expanding them.
 
 This command runs with the host OS user's permissions, not inside an OS sandbox. Its repository checks do not prove that external files, networks or databases were unchanged: `executionIsolation` remains `host-permissions`, and `externalEffects` remains `unverified`. The independent supervisor enforces the admitted start deadline and command timeout and reclaims its own process group if the CLI disappears. Only the original approved command can be launched; these observations grant no general shell or project-write permission.
 
@@ -100,7 +114,7 @@ An editing pass does not certify test execution, independent validation, merge o
 
 For a decision, include `input.task.interaction` with `type` (`confirm`, `choice`, `multi` or `input`), a `question`, `options` (two or more with unique `id` and `label`, or an empty array for input), and a `callback` containing its `operation` and `payload`. Medium- and high-risk decisions also need a `riskDescription`. The decision waits for an explicit answer; it never chooses a default on timeout.
 
-Use `npx @entrorove/skill status <requestId>` after a connection loss. It performs a read-only GET lookup and never resends a POST. Use `npx @entrorove/skill flows` to list recoverable flow steps. `npx @entrorove/skill usage [flowId]` reads measured consumption grouped per host and model and, with an original flow, its delivered stages; it never displays an invented quota or a predicted duration. `npx @entrorove/skill billing` exports measured cost per account, host, model and task with that task's delivery stages. A declared host adapter may report the host's own remaining quota through the same module that describes its guard; when it cannot, the answer stays explicitly `unknown` and only this skill's measured ledger is used. `GET /api/skill/flows/:id/status` reports `delivery` with delivered, total and remaining stages, counted from independently verified steps only. A v2 flow has its own `flowId` and progresses through `pending`, `running`, `reported`, `verified`, `blocked` or `failed`; a reported result is not a verified result.
+Use `npx @entrorove/skill status <requestId>` after a connection loss. It performs a read-only GET lookup and never resends a POST. Use `npx @entrorove/skill flows` to list recoverable flow steps. `npx @entrorove/skill usage [flowId]` reads measured consumption grouped per host and model and, with an original flow, its delivered stages; it never displays an invented quota or a predicted duration. `npx @entrorove/skill billing` exports measured cost per account, host, model and task with that task's delivery stages. A declared host adapter may report the host's own remaining quota through the same module that describes its guard; when it cannot, the answer stays explicitly `unknown` and only this skill's measured ledger is used. `GET /api/skill/flows/:id/status` reports `delivery` with delivered, total and remaining stages. Independent plans count independently verified steps; member-local plans count only signed local acceptances of original business steps and explicitly report that basis. A v2 flow keeps its original `flowId`; local acceptance does not change formal step status to `verified`.
 
 The local execution layer is available through `npx @entrorove/skill local <operation> [repositoryRoot]` with a JSON object on standard input. `local capabilities` lists the complete contract, operation groups and `requiresPass` metadata. `local capabilities <group>` filters that same contract. Operations include `snapshot-plan`, `snapshot-verify`, `mutate-gate`, `gate-issue`, `gate-verify`, `guarded-write`, `budget-init`, `budget-context`, `budget-read`, `budget-status`, `budget-extend`, budget renewal confirmation, `peer-coordinate`, `spawn-bind`, `peer-complete`, `lease-verify`, `probe`, `reassess`, execution ledger and virtual branch records, `chain-init`, `chain-resume`, `chain-status`, `chain-answer`, `evidence-sign`, `evidence-verify`, `merge-verified`, `rollback`, `formula-evaluate`, `formula-graph`, `formula-final-gate`, `run-approved-plan` and `final-gate`. State is kept only under `~/.entrorove/`; snapshots never create Git branches or worktrees. Guarded writes require a short-lived Ed25519 pass bound to the flow, step, snapshot digest and path set. Local evidence uses `entrorove.test-evidence/2.0`; unsigned local evidence remains incomplete and verified delivery requires a trusted receipt. Approved plan execution requires a frozen plan, matching approval and unchanged files; without a configured runner signer it reports local evidence as incomplete.
 
@@ -120,7 +134,7 @@ The website's signed-in bell control enables encrypted Web Push for the current
 
 Every completed or failed execution call receives a server-generated `feedback` receipt bound to the original account, request hash and result digest. Durable calls commit this evaluation in the same transaction as the result; domain adapters return an idempotent receipt with the same HTTP response. The CLI verifies the original identity and evaluation digest, then immediately returns that exact receipt identity to the authenticated acknowledgement endpoint before finishing the call. Cloud watches do the same as soon as the original evaluation is available. A confirmed `acknowledgement` records the IDE and server reception time without changing the evaluation or counting another invocation. Preserve `receiptId`, `requestId` and `evaluation.digest`; never generate a score or comment locally. Immediately display the confirmed evaluation acknowledgement in visible IDE commentary before the task's final answer, deduplicated by receipt ID. Tool output alone is insufficient. Say “已回传” only with a confirmed acknowledgement; an upload failure must remain visible and cannot become successful feedback. Read the saved receipt with `npx @entrorove/skill feedback <original requestId>` after a connection loss; this is GET only and never repeats execution or submits another evaluation. An authorized retry before side effects keeps the original request but gets a new server execution generation and immutable receipt. Default feedback reads the latest generation; `feedback <original requestId> <generation>` reads a preserved earlier receipt. Never overwrite a failed receipt or use it as the current retry result. Discovery/status queries create no evaluations.
 
-Only server-verified progress or a validated pure operation earns a positive automatic evaluation. Reported steps, intake, model summaries and incomplete evidence remain `pending` with no score. Blocked/failed results and P0/P1 findings cannot become positive. These are private technical evaluations; they do not create a public user review or masquerade as the user's words. If a server advertising this extension returns no valid receipt, show the missing receipt and query its original ID. Do not silently claim that evaluation was reported.
+Only server-verified progress, a validated pure operation or a verified server-signed local acceptance earns a positive automatic evaluation. Local evaluations state `verificationMode: member-local` and `independentValidation: not-performed`. Reported steps, intake, model summaries and incomplete evidence without local acceptance remain `pending` with no score. Blocked/failed results and P0/P1 findings cannot become positive. These are private technical evaluations; they do not create a public user review or masquerade as the user's words. If a server advertising this extension returns no valid receipt, show the missing receipt and query its original ID. Do not silently claim that evaluation was reported.
 
 When the user gives an actual evaluation after using the skill, offer to publish that feedback. Only after they explicitly agree to public display under the current notice, send their unchanged words, IDE name and 1–5 rating as JSON on standard input to `npx @entrorove/skill review`, including `invocationRequestId` from their actual successful call, `publicConsent: true` and `noticeVersion: "2026-10-07.1"`. The same account must own that successful call within the last 30 days; a recorded usage event, failed call or unknown result does not qualify. Three public reviews per account per day share one server quota across API replicas. Public output exposes only IDE, rating, original text and time, never account or invocation identity. Never invent, rewrite or infer a review from task completion. The website reads accepted reviews directly from entrorove's independent database.
 

package/SKILL.md

@@ -5,7 +5,7 @@ description: Execute an engineering task through Entrorove, preserving its origi
 
 # entrorove · 熵巡
 
-Version: 0.1.55.
+Version: 0.1.57.
 
 Entrorove applies to the whole task once selected. Reading this document or calling an entry once does not execute the task. On every later turn, including after compaction, continue the original task and its required next operation before dependent work. Keep the original goal, scope, account, flow, cloud task and failure records. Never describe planning, a reported step or model output as verified delivery.
 
@@ -16,15 +16,15 @@ Entrorove applies to the whole task once selected. Reading this document or call
    To remove this skill and its host hooks, run `entrorove uninstall` directly. It works offline and preserves unrelated host settings, credentials and task records. If a managed file was edited, it reports the preserved path instead of deleting it.
 2. Read [IDE-EXECUTION.md](IDE-EXECUTION.md) for the exact entry, cloud callbacks, account agreement and operation contracts. Use the stored account credential; never put it in arguments, URLs, project files, output or fixtures. Entrorove is independent of other systems.
 3. Discover `capabilities`, then invoke `start` with the actual goal, task type, risk and scope facts. An enabled account returns a cloud choice before charging a model. Show that choice visibly using the host question tool. Confirmation calls its original callback; exit adopts the local route for this task. Never treat silence as permission, invent acceptance, or create both routes. Existing explicit authorization for this task persists.
-   With cloud sandbox disabled, the IDE performs its own planning and continues the original API flow. Do not require a cloud model call or create a sandbox task to perform local work.
+   With cloud sandbox disabled, the IDE performs its own planning and continues the original API flow. Do not require a cloud model call or create a sandbox task to perform local work. The service freezes eligible member plans with `verificationMode: member-local` and `runnerKeyId: null`; successful original IDE execution and tests satisfy local acceptance. This mode comes from the stored account preference and enrolled scope, never a caller flag or an unavailable validator key. An already frozen independent plan keeps its original acceptance contract.
    When the model produces a task contract, preserve its `workType`, `risk`, `difficulty`, `crossModule`, `parallel`, `unclear`, `architectureContract`, optional `baselineRef`, and optional `interaction` as returned. Valid work types are `implementation`, `documentation`, `calculation`, `merge`, `review`, `decision`, and `diagnosis`. A `merge` requires a concrete `baselineRef` identifying the branch, tag, commit, or review baseline; keep that baseline unchanged through independent verification. A `decision` requires `interaction`, including a risk description for medium or high risk. Do not fill missing required fields by guessing.
 4. After real cloud acceptance, immediately display **云端任务 <taskNumber> · 已进入**. Preserve `taskNumber` verbatim: it is the homepage sandbox tab number. Keep its UUID `taskId` separately. Run the returned `cloud-watch`, show each real public event and its cursor, and continue the original accepted flow from status. A command log alone is insufficient. No accepted cloud task means no cloud ID or model-execution claim.
 5. For an accepted `flowId`, execute the returned `nextStep` with its required payload. Discover the schema before constructing input. An empty payload is valid only when that operation's schema allows it. Reconnect and refresh only the original flow. A changed snapshot is a binding failure to investigate; do not invent a fresh successful baseline, rebuild a flow to evade it, or erase the old failure. If a fresh scope proof returns `ENTROROVE_SCOPE_PLANNING_REASSESSMENT_REQUIRED` before plan freeze, follow its explicit `workflow-scope-reassess` recovery and retry the original complete request; a local reassessment or snapshot refresh alone does not renew the accepted gate. If the terminal flow truly owns a stale task slot, use the explicit `flow-abandon` lifecycle operation described below before routing the original task again.
 6. All governed mutations use the original authority: `local guarded-write`, `local guarded-delete`, `local guarded-move`, or the original frozen approved runner plan. Native patches, scripts, terminal writes, database mutations and unknown MCP operations must not substitute for the controlled entry. User-authorized task messages use the host's message tool and remain subject to host approval; sending a report does not change the flow or grant execution authority. **A failed gate or unknown outcome must never be replaced with another executor or reported as local success.** Query the original request read-only, repair the cause, and obtain the original flow's valid authority before proceeding.
-   For a restricted member scope, follow a returned `localAction` before submitting execution evidence. `mutation-connect` obtains only the original task's limited editing pass; it keeps unresolved loader files and project configuration read only. After actual writes, refresh the original scope and run `mutation-settle`. Use the returned `previousPassId` for further edits. With sandbox disabled, `workflow-observe-step` runs the original approved command and preserves its real local result without a validator private key; independent verification remains pending. See [IDE-EXECUTION.md](IDE-EXECUTION.md#restricted-member-editing).
+   For a member scope, follow a returned `localAction` before submitting execution evidence. `mutation-connect` obtains only the original task's limited editing pass; it keeps unresolved loader files and project configuration read only. After actual writes, refresh the original scope and run `mutation-settle`. Use the returned `previousPassId` for further edits. In a signed member-local plan, `workflow-observe-step` runs the original approved command and tests without a validator private key. A server-signed `localAcceptance` advances local dependencies; a failed test does not. Preserve the raw observation and its absent independent receipt. See [IDE-EXECUTION.md](IDE-EXECUTION.md#local-ide-acceptance).
 7. Read [REUSE-DISCIPLINE.md](REUSE-DISCIPLINE.md) when modifying an existing system. The comparison baseline is the existing implementation in that same repository. It never means another project, another account, or copying external systems.
 8. Read [DELIVERY-BOUNDARIES.md](DELIVERY-BOUNDARIES.md) before claiming a delivered stage or showing consumption. A delivered stage requires a clean boundary and uses `delivered-stage-N`. Blocked or unknown work can wait with recovery data intact; it is not a delivered stage. Display consumption only with a measured baseline.
-9. Before claiming verified completion, submit actual independent execution evidence, run the server's verification and verdict, and display the confirmed evaluation acknowledgement. Preserve `receiptId`, `requestId`, execution generation and evaluation digest. “已回传” requires `acknowledgement.stored: true`. Missing or failed feedback remains visible. Completed verified tasks automatically release superseded Entrorove snapshot copies, preserving origin and final rollback images; active, waiting and unknown tasks retain recovery data.
+9. For independent verified completion, submit actual independent execution evidence and run server verification and verdict. For a signed member-local plan, finish all original local steps and requirement checkpoints, then call the returned `workflow-verdict`; only its signed final `localAcceptance` means local acceptance is complete. Describe it as local execution and tests accepted, with independent validation not performed. Never invoke formal V, merge, Swarm or handoff to relabel it. Display the confirmed evaluation acknowledgement and preserve `receiptId`, `requestId`, execution generation and evaluation digest. “已回传” requires `acknowledgement.stored: true`. Missing or failed feedback remains visible. Active, waiting and unknown tasks retain recovery data.
 
 The Codex guard preserves this binding over subsequent prompts and compaction and denies unsupported native mutations before execution. Hooks are host guardrails, not an operating-system security boundary; unsupported tool paths or a disabled/untrusted hook cannot be described as enforced. An explicit user decision to stop using the skill ends its governance and never becomes verified Entrorove delivery. Do not infer such a decision from quoted screenshots or a service failure.
 

package/automatic-feedback-client.mjs

@@ -23,10 +23,14 @@ export function verifyAutomaticFeedback(feedback, requestId, requestHash) {
     throw new Error(`Invalid automatic feedback receipt; query feedback ${requestId} without repeating the invocation`);
   }
   const { digest: checksum,...core } = evaluation;
-  if (digest(core) !== checksum || !['succeeded','reported','blocked','failed','incomplete'].includes(evaluation.status)
+  const local = evaluation.status === 'local-accepted';
+  if (digest(core) !== checksum || !['succeeded','reported','blocked','failed','incomplete','local-accepted'].includes(evaluation.status)
+    || local && (evaluation.verificationMode !== 'member-local' || evaluation.independentValidation !== 'not-performed'
+      || evaluation.disposition !== 'good' || evaluation.validation !== 'passed')
+    || !local && (evaluation.verificationMode !== undefined || evaluation.independentValidation !== undefined)
     || evaluation.findingCount < evaluation.p0Count + evaluation.p1Count
     || evaluation.disposition === 'pending' && (evaluation.score !== null || evaluation.validation !== 'incomplete')
-    || evaluation.disposition === 'good' && (evaluation.status !== 'succeeded' || evaluation.validation !== 'passed' || evaluation.p0Count || evaluation.p1Count)
+    || evaluation.disposition === 'good' && (!['succeeded','local-accepted'].includes(evaluation.status) || evaluation.validation !== 'passed' || evaluation.p0Count || evaluation.p1Count)
     || evaluation.disposition === 'bad' && evaluation.validation !== 'failed'
     || evaluation.disposition !== 'pending' && (!Number.isInteger(evaluation.score) || evaluation.score < 0 || evaluation.score > 100)) {
     throw new Error('Automatic feedback digest or validation state is inconsistent');

package/connected-cli.mjs

@@ -14,7 +14,8 @@ export async function runConnectedCommand(command, root, input, dependencies) {
   if (!isConnectedCommand(command)) throw new Error('Unsupported connected command');
   const result = await commands[command](root, input, dependencies);
   process.stdout.write(`${JSON.stringify(result)}\n`);
-  const expected = command === 'mutation-settle' ? ['reported', 'succeeded'] : ['succeeded'];
+  const expected = command === 'mutation-settle' ? ['reported', 'succeeded']
+    : command === 'workflow-observe-step' ? ['succeeded', 'local-accepted'] : ['succeeded'];
   if (!expected.includes(result.status)) process.exitCode = 2;
   return result;
 }

package/ide-command.mjs

@@ -79,7 +79,9 @@ export function sdkCommand(parsed, runtime) {
   if (['unlock', 'uninstall'].includes(args[0]) && args.length === 1 && !parsed.input) return { args };
   if (simple.has(args[0]) && args.length === 1 && parsed.input) return { args, input: parsed.input };
   if (['status', 'feedback'].includes(args[0]) && /^[a-f0-9]{64}$/u.test(args[1] ?? '') && [2,3].includes(args.length)) return { args };
-  if (['flows', 'install', 'billing'].includes(args[0]) && args.length === 1 && !parsed.input) return { args };
+  if (args[0] === 'flows' && args.length === 1 && (!parsed.input || typeof parsed.input === 'object'
+    && !Array.isArray(parsed.input) && Object.keys(parsed.input).length === 0)) return { args };
+  if (['install', 'billing'].includes(args[0]) && args.length === 1 && !parsed.input) return { args };
   if (args[0] === 'install' && args.length === 3 && args[1] === '--host' && args[2] === 'codex' && !parsed.input) return { args };
   if (args[0] === 'recurring' && ['list', 'claim'].includes(args[1] ?? '') && args.length === 2 && !parsed.input) return { args };
   if (args[0] === 'recurring' && ['finish', 'runs'].includes(args[1] ?? '') && args.length === 3 && (!parsed.input || args[1] === 'finish')) return { args, ...(parsed.input ? { input: parsed.input } : {}) };

package/ide-hook.mjs

@@ -10,6 +10,7 @@ import { hostTaskMessageInput, hostTaskMessageTool, prepareIdeCodeMode } from '.
 import { pathToFileURL } from 'node:url';
 import path from 'node:path';
 import { parseIdeResults, consumeIdeResults } from './ide-results.mjs';
+import { verifyIdeLocalAcceptance } from './ide-local-acceptance.mjs';
 import { registerIdeRequirement, ideQueueContext, unclassifiedIdeRequirements,
   advanceIdeQueue, checkQueuedStart, unfinishedIdeQueue } from './ide-queue.mjs';
 
@@ -83,9 +84,9 @@ function lifecycleResult(value, depth = 0) {
   }
   return null;
 }
-function collectResult(state, values, local) {
+function collectResult(state, values, local, acceptances = []) {
   const messages = [];
-  for (const result of values) {
+  for (const [index, result] of values.entries()) {
     const value = result.output ?? result;
     const lifecycleValue = lifecycleResult(result) ?? value;
     const lifecycle = lifecycleValue.operation === 'flow-cancel' || lifecycleValue.operation === 'flow-abandon';
@@ -105,7 +106,10 @@ function collectResult(state, values, local) {
       state.taskId = value.taskId; state.taskNumber = value.taskNumber;
     }
     const nextStep = value.nextStep ?? value.result?.nextStep ?? value.result?.result?.nextStep;
-    if (!lifecycle && (value.status === 'needs-input' || value.result?.status === 'needs-input' || value.interaction || value.result?.interaction)) state.phase = 'needs-input';
+    if (acceptances[index] === 'workflow') { state.phase = 'ended'; delete state.nextStep; }
+    else if (acceptances[index] === 'step') { state.phase = 'continuing'; state.nextStep = { operation: 'task-resume', payload: { flowId: state.flowId } }; }
+    else if (acceptances[index] === 'invalid') state.phase = 'blocked';
+    else if (!lifecycle && (value.status === 'needs-input' || value.result?.status === 'needs-input' || value.interaction || value.result?.interaction)) state.phase = 'needs-input';
     else if (isStageTerminal(value.status) || isStageTerminal(value.result?.status)) {
       state.phase = 'delivered'; state.deliveredStage = stageOf(value.status) ?? stageOf(value.result?.status);
     }
@@ -116,7 +120,7 @@ function collectResult(state, values, local) {
       && result.feedback?.acknowledgement?.stored === true) state.phase = 'ended';
     else if (!lifecycle && local && value.status === 'verified') state.phase = 'continuing';
     else if (!lifecycle && (value.status === 'started' || value.status === 'succeeded')) state.phase = 'continuing';
-    if (!lifecycle && nextStep) state.nextStep = { operation: nextStep.operation, payload: nextStep.payload };
+    if (!lifecycle && !acceptances[index] && nextStep) state.nextStep = { operation: nextStep.operation, payload: nextStep.payload };
     const notices = [...(result.ideMessages ?? []), ...(value.ideMessages ?? []),
       ...(value.schemaVersion === 'entrorove.ide-event/1.0' ? [value.message] : []), ...(value.events ?? []).map(item => item.message)];
     for (const message of notices) {
@@ -129,6 +133,11 @@ function collectResult(state, values, local) {
   state.seen = state.seen.slice(-200);
   return messages;
 }
+function originalLocalCall(pending, call, input) {
+  if (call.args[0] === 'workflow-observe-step') pending.observation = Object.fromEntries(
+    ['taskId', 'flowId', 'stepId', 'leaseId', 'generation'].map(field => [field, input?.[field]]));
+  if (operationOf(call) === 'continue') pending.continuationOperation = input?.operation;
+}
 async function beforeTool(event, state, home) {
   if (state.phase === 'user-exited') return {};
   const unlocked = await readBreakGlass(home, state.sessionId);
@@ -185,6 +194,7 @@ async function beforeTool(event, state, home) {
       operation: operationOf(call), observer, managementOnly: observer || isManagementCall(call)
         && !['start', 'continue', 'cloud-task'].includes(operationOf(call)) || operationOf(call) === 'task-checkpoint',
       ...(requestId ? { requestId } : {}) };
+    originalLocalCall(pending, call, input);
     if (observer) {
       state.readCalls ??= {};
       if (Object.keys(state.readCalls).length >= 32) return denyBlocked(state, event, 'Entrorove：只读恢复尚未返回，请等待原调用。');
@@ -282,8 +292,14 @@ export async function runIdeHook(event, { home } = {}) {
       }) : values;
       const recoveredOriginal = pendingRead && state.pendingCall?.requestId
         && values.some(result => (result.output ?? result).requestId === state.pendingCall.requestId);
-      const messages = collectResult(state, bound, pending.command === 'local');
-      observeIdeToolOutcome(state, bound, pending);
+      const acceptances = await Promise.all(bound.map(value => verifyIdeLocalAcceptance(value, pending, state, home)));
+      const messages = collectResult(state, bound, pending.command === 'local', acceptances);
+      // Preserve the full raw O in the completion file/output. Only this control
+      // projection can omit its pending status after the signed proof is checked.
+      const outcomes = bound.map((value, index) => acceptances[index] === 'step'
+        ? { status: 'local-accepted', nextStep: { operation: 'task-resume' } }
+        : acceptances[index] === 'invalid' ? { status: 'blocked' } : value);
+      observeIdeToolOutcome(state, outcomes, pending);
       if (pendingRead) delete state.readCalls[event.tool_use_id];
       if (!pendingRead || recoveredOriginal) delete state.pendingCall;
       const resumed = state.phase === 'blocked' || repeatedIdeBlock(state) ? '' : await advanceIdeQueue(state,home);

package/ide-install.mjs

@@ -5,7 +5,7 @@ import { ideDirectory, ideDigest, readIdeJson, writeIdeJson, ideError } from './
 import { withStateLock } from './local-state-lock.mjs';
 
 const source = path.dirname(fileURLToPath(import.meta.url));
-const files = ['ide-hook.mjs', 'ide-session.mjs', 'break-glass.mjs', 'ide-results.mjs', 'ide-queue.mjs', 'ide-command.mjs', 'ide-code-mode.mjs', 'remote-transport.mjs', 'local-credential.mjs', 'local-state-lock.mjs', 'local-stage-boundary.mjs'];
+const files = ['ide-hook.mjs', 'ide-session.mjs', 'break-glass.mjs', 'ide-results.mjs', 'ide-local-acceptance.mjs', 'ide-queue.mjs', 'ide-command.mjs', 'ide-code-mode.mjs', 'remote-transport.mjs', 'local-credential.mjs', 'local-state-lock.mjs', 'local-stage-boundary.mjs'];
 const quote = text => `'${text.replace(/'/gu, "'\\''")}'`;
 
 // One shared host-agnostic hook binary; every host is described by its own

package/ide-local-acceptance.mjs

@@ -0,0 +1,134 @@
+import { createHash, createPublicKey, verify } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { readIdeJson } from './ide-session.mjs';
+
+const hash = value => createHash('sha256').update(value).digest('hex');
+const sha = value => typeof value === 'string' && /^[a-f0-9]{64}$/u.test(value);
+const id = value => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(value);
+const exact = (value, fields) => value && typeof value === 'object' && !Array.isArray(value)
+  && Object.keys(value).sort().join('\0') === [...fields].sort().join('\0');
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`;
+  if (value && typeof value === 'object') return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}`;
+  return JSON.stringify(value);
+}
+const digest = value => hash(canonical(value));
+const common = ['schemaVersion', 'status', 'verificationMode', 'independentValidation', 'runnerKeyId',
+  'flowId', 'ownerId', 'taskId', 'taskDigest', 'chainDigest', 'planId', 'planDigest', 'requestId', 'acceptedAt', 'authorityReceipt'];
+const step = ['stepId', 'executionPlanSha256', 'leaseId', 'leaseDigest', 'generation', 'observationId', 'admissionDigest', 'resultDigest'];
+const workflow = ['stepAcceptances', 'claimsIndependentVerification', 'localExecutionAndTestsPassed'];
+function localCore(value) {
+  if (value?.localAcceptance || value?.status === 'local-accepted') return value;
+  if (value?.result?.localAcceptance || value?.result?.status === 'local-accepted') return value.result;
+  return null;
+}
+export function ideLocalAcceptanceMetadata(value) {
+  if (!localCore(value) || Buffer.byteLength(JSON.stringify(value)) > 100_000) return null;
+  // A complete bounded output is needed to check the acknowledged feedback's
+  // original digest. No command output is included in local observation results.
+  return structuredClone(value);
+}
+async function authority(home = os.homedir()) {
+  for (const directory of [home, path.join(home, '.entrorove')]) {
+    const stat = await fs.lstat(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || process.platform !== 'win32'
+      && (stat.uid !== process.getuid() || directory !== home && stat.mode & 0o077)) throw new Error();
+  }
+  const pin = await readIdeJson(path.join(home, '.entrorove', 'cloud-mutation-authority.json'));
+  const testOrigin = process.env.NODE_ENV === 'test' && /^http:\/\/(?:127\.0\.0\.1|localhost|\[::1\]):[0-9]+$/u.test(pin?.apiOrigin ?? '');
+  if (!exact(pin, ['schemaVersion', 'apiOrigin', 'authority']) || pin.schemaVersion !== 'entrorove.cloud-mutation-authority-pin/1.0'
+    || pin.apiOrigin !== 'https://entrorove.com' && !testOrigin
+    || !exact(pin.authority, ['schemaVersion', 'purpose', 'algorithm', 'keyId', 'publicKey'])
+    || pin.authority.schemaVersion !== 'entrorove.mutation-authority-key/1.0'
+    || pin.authority.purpose !== 'mutation-pass-verification' || pin.authority.algorithm !== 'Ed25519') throw new Error();
+  const encoded = pin.authority.publicKey, der = Buffer.from(encoded, 'base64');
+  const key = createPublicKey({ key: der, type: 'spki', format: 'der' });
+  if (key.asymmetricKeyType !== 'ed25519' || der.toString('base64') !== encoded
+    || key.export({ type: 'spki', format: 'der' }).toString('base64') !== encoded || hash(der) !== pin.authority.keyId) throw new Error();
+  return { key, keyId: hash(der) };
+}
+async function signedAcceptance(value, kind, home) {
+  if (!exact(value, [...common, ...(kind === 'step' ? step : workflow)])
+    || value.schemaVersion !== `entrorove.member-local-${kind === 'step' ? 'step' : 'workflow'}-acceptance/1.0`
+    || value.status !== 'local-accepted' || value.verificationMode !== 'member-local'
+    || value.independentValidation !== 'not-performed' || value.runnerKeyId !== null
+    || !['flowId', 'taskId', 'planId'].every(field => id(value[field]))
+    || !/^[a-f0-9-]{36}$/u.test(value.ownerId ?? '')
+    || !['taskDigest', 'chainDigest', 'planDigest', 'requestId'].every(field => sha(value[field]))
+    || typeof value.acceptedAt !== 'string' || !Number.isFinite(Date.parse(value.acceptedAt))
+    || new Date(value.acceptedAt).toISOString() !== value.acceptedAt) throw new Error();
+  const receipt = value.authorityReceipt, trusted = await authority(home);
+  if (!exact(receipt, ['schemaVersion', 'keyId', 'payloadDigest', 'signature'])) throw new Error();
+  const { authorityReceipt: _, ...payload } = value, bytes = Buffer.from(canonical(payload));
+  const signature = Buffer.from(receipt.signature ?? '', 'base64url');
+  if (receipt.schemaVersion !== 'entrorove.workflow-authority-receipt/1.0' || receipt.keyId !== trusted.keyId
+    || receipt.payloadDigest !== hash(bytes) || signature.length !== 64 || signature.toString('base64url') !== receipt.signature
+    || !verify(null, bytes, trusted.key, signature)) throw new Error();
+}
+function successfulObservation(proof, result) {
+  const process = result?.process, checks = ['sourceManifestUnchanged', 'protectedFilesUnchanged', 'repositoryUnchanged'];
+  return result?.schemaVersion === 'entrorove.local-observation-result/1.0' && result.status === 'incomplete'
+    && result.independentValidation === 'pending' && result.runner === 'local' && result.receipt === null
+    && result.executionIsolation === 'host-permissions' && result.externalEffects === 'unverified'
+    && result.observationId === proof.observationId && result.admissionDigest === proof.admissionDigest
+    && digest(result) === proof.resultDigest && sha(result.sourceManifestDigest)
+    && exact(result.checks, checks) && checks.every(field => result.checks[field] === true)
+    && sha(result.beforeRepositoryDigest) && result.beforeRepositoryDigest === result.afterRepositoryDigest
+    && process?.started === true && process.status === 'succeeded' && process.exitCode === 0 && process.signal === null
+    && process.timedOut === false && process.outputLimitExceeded === false;
+}
+function acknowledgedLocalFeedback(result, output, requestId) {
+  const feedback = result.feedback, evaluation = feedback?.evaluation, ack = feedback?.acknowledgement;
+  if (!evaluation) return false;
+  const { digest: checksum, ...core } = evaluation;
+  return feedback.schemaVersion === 'entrorove.automatic-feedback/1.0' && feedback.stored === true
+    && feedback.requestId === requestId && feedback.requestHash === requestId && feedback.resultDigest === digest(output)
+    && evaluation.requestId === requestId && evaluation.schemaVersion === 'entrorove.automatic-evaluation/1.0'
+    && evaluation.status === 'local-accepted' && evaluation.verificationMode === 'member-local'
+    && evaluation.independentValidation === 'not-performed' && evaluation.disposition === 'good'
+    && evaluation.validation === 'passed' && evaluation.p0Count === 0 && evaluation.p1Count === 0
+    && checksum === digest(core) && ack?.schemaVersion === 'entrorove.feedback-acknowledgement/1.0'
+    && ack.stored === true && ack.receiptId === feedback.receiptId && ack.requestId === requestId
+    && ack.generation === (feedback.generation ?? 1);
+}
+function workflowProof(proof) {
+  return proof.claimsIndependentVerification === false && proof.localExecutionAndTestsPassed === true
+    && Array.isArray(proof.stepAcceptances) && proof.stepAcceptances.length > 0 && proof.stepAcceptances.length <= 2_000
+    && new Set(proof.stepAcceptances.map(value => value.stepId)).size === proof.stepAcceptances.length
+    && proof.stepAcceptances.every(value => exact(value, ['stepId', 'acceptanceDigest', 'observationId', 'resultDigest'])
+      && id(value.stepId) && id(value.observationId) && sha(value.acceptanceDigest) && sha(value.resultDigest));
+}
+export async function verifyIdeLocalAcceptance(result, pending, state, home) {
+  const output = result?.output ?? result, source = output?.localAcceptanceOutput ?? output, core = localCore(source);
+  if (!core) return null;
+  try {
+    const proof = core.localAcceptance, kind = proof?.schemaVersion === 'entrorove.member-local-step-acceptance/1.0' ? 'step' : 'workflow';
+    await signedAcceptance(proof, kind, home);
+    if (core.status !== 'local-accepted' || core.independentValidation !== 'not-performed'
+      || !['local-accepted', 'succeeded'].includes(output.status) || source.flowId && source.flowId !== proof.flowId
+      || proof.flowId !== state.flowId || state.taskId && proof.taskId !== state.taskId) throw new Error();
+    if (kind === 'step') {
+      if (pending.command !== 'workflow-observe-step' || !pending.observation
+        || core.grantsExecutionAuthority !== false || core.grantsValidatorAuthority !== false || core.stored !== true
+        || core.localObservationStatus !== 'local-accepted' || core.receipt !== null || core.resultDigest !== proof.resultDigest
+        || ['taskId', 'flowId', 'stepId'].some(field => core[field] !== proof[field])
+        || ['taskId', 'flowId', 'stepId', 'leaseId', 'generation'].some(field => proof[field] !== pending.observation[field])
+        || !['stepId', 'leaseId', 'observationId'].every(field => id(proof[field]))
+        || !['executionPlanSha256', 'leaseDigest', 'admissionDigest', 'resultDigest'].every(field => sha(proof[field]))
+        || !Number.isSafeInteger(proof.generation) || proof.generation < 1 || !successfulObservation(proof, core.result)
+        || proof.requestId !== hash('member-observation-report' + canonical({ observationId: proof.observationId,
+          admissionDigest: proof.admissionDigest, result: core.result }))) throw new Error();
+    } else if (core.verificationMode !== 'member-local' || pending.operation !== 'continue' || pending.continuationOperation !== 'workflow-verdict'
+      || pending.requestId !== proof.requestId || source.requestId !== proof.requestId || !workflowProof(proof)
+      || !acknowledgedLocalFeedback(result, source, proof.requestId)) throw new Error();
+    return kind;
+  } catch { return 'invalid'; }
+}
+export async function verifiedLocalWorkflowCompletion(call, result, home) {
+  const output = result?.output;
+  if (call.operation !== 'continue' || call.input?.operation !== 'workflow-verdict' || !id(call.input.flowId)) return false;
+  return await verifyIdeLocalAcceptance(result, { operation: 'continue', continuationOperation: 'workflow-verdict', requestId: call.requestId },
+    { flowId: call.input.flowId }, home) === 'workflow' && output?.flowId === call.input.flowId;
+}

package/ide-results.mjs

@@ -1,6 +1,7 @@
 import path from 'node:path';
 import { promises as fs } from 'node:fs';
 import { ideDirectory, ideDigest, ideResultContext, readIdeJson, writeIdeJson } from './ide-session.mjs';
+import { ideLocalAcceptanceMetadata } from './ide-local-acceptance.mjs';
 
 export function parseIdeResults(response) {
   const raw = typeof response === 'string' ? response : response?.output ?? response?.stdout ?? response?.aggregated_output
@@ -14,6 +15,8 @@ export function parseIdeResults(response) {
 function resultMetadata(value, depth = 0) {
   if (!value || typeof value !== 'object' || depth > 3) return undefined;
   const metadata = {};
+  const localOutput = ideLocalAcceptanceMetadata(value);
+  if (localOutput) metadata.localAcceptanceOutput = localOutput;
   for (const key of ['schemaVersion', 'requestId', 'flowId', 'status', 'operation', 'termination', 'flowStatus', 'taskId', 'taskNumber', 'taskStatus']) {
     if (typeof value[key] === 'string' && value[key].length <= 200) metadata[key] = value[key];
   }
@@ -22,7 +25,8 @@ function resultMetadata(value, depth = 0) {
   for (const key of ['nextStep', 'nextAction']) if (typeof value[key]?.operation === 'string') metadata[key] = { operation: value[key].operation };
   if (value.interaction) metadata.interaction = true;
   if (Array.isArray(value.reports)) metadata.reports = value.reports.map(report => ({ verdict: report.verdict }));
-  if (value.feedback?.acknowledgement?.stored === true) metadata.feedback = { receiptId: value.feedback.receiptId, acknowledgement: { stored: true } };
+  if (value.feedback?.acknowledgement?.stored === true) metadata.feedback = ideLocalAcceptanceMetadata(value.output)
+    ? structuredClone(value.feedback) : { receiptId: value.feedback.receiptId, acknowledgement: { stored: true } };
   return metadata;
 }
 const resultFile = (directory, sessionId, toolUseId) => path.join(directory, `result-${ideDigest({ sessionId, toolUseId })}.json`);

package/local-approved-plan.mjs

@@ -40,6 +40,7 @@ function validatePlan(plan, artifactDigest = planArtifact) {
   validateRunnerParallelPaths(plan);
   if (policy.discipline) {
     const reviewed = disciplineApprovedPolicy(policy.discipline);
+    if (reviewed.access === 'read-only' && policy.parallelPaths !== undefined) fail('ENTROROVE_READ_ONLY_POLICY_INVALID', 'Read-only execution cannot grant parallel mutation or equivalence permissions');
     if (!disciplineDataSnapshotsBound(reviewed, plan.files)) {
       fail('ENTROROVE_DISCIPLINE_DATA_SNAPSHOT_REQUIRED', 'Existing data operations require their actual frozen snapshot artifact before execution');
     }
@@ -96,7 +97,7 @@ function evidence(authority, result, sub) { const summary = result.timedOut ? 'A
 }
 
 export async function runApprovedPlan(input) { const owner = await authority(input); const comparison = await runnerDisciplineBefore(input, owner); const result = await runCommand(owner); try { const after = await authority(input); if (after.planFile.sha256 !== owner.planFile.sha256) fail('ENTROROVE_PLAN_CHANGED', 'plan changed during execution'); } catch (cause) { const execution = { schemaVersion: RUNNER_SCHEMA, status: 'failed', error: cause.message, process: result, evidence: [] }; const error = new Error(cause.message); error.code = cause.code; error.execution = execution; throw error; }
-  owner.disciplineComparison = await runnerDisciplineAfter(comparison, owner);
+  owner.disciplineComparison = await runnerDisciplineAfter(comparison, owner, result);
   const sub = await subject(owner, result); const item = evidence(owner, result, sub); const status = !owner.signing && result.status === 'succeeded' ? 'incomplete' : result.status; return { schemaVersion: RUNNER_SCHEMA, status, planSha256: owner.planFile.sha256, approvalSha256: owner.approval.sha256, approvedBy: owner.approval.approval.approvedBy, subject: sub, process: result, evidence: [item], receipt: item.receipt ?? null, ...(owner.signing ? { receiptPublicKey: createPublicKey(owner.signing.privateKey).export({ format: 'der', type: 'spki' }).toString('base64') } : {}), signingBoundary: owner.signing ? 'configured-signature-only' : 'local-evidence-only' };
 }
 
@@ -125,7 +126,7 @@ export async function runApprovedPlanObject(input) {
     const error = new Error(cause.message); error.code = cause.code;
     error.execution = { schemaVersion: RUNNER_SCHEMA, status: 'failed', error: cause.message, process: result, evidence: [], effects: 'unknown' }; throw error;
   }
-  owner.disciplineComparison = await runnerDisciplineAfter(comparison, owner);
+  owner.disciplineComparison = await runnerDisciplineAfter(comparison, owner, result);
   const sub = await subject(owner, result); const item = evidence(owner, result, sub);
   return { schemaVersion: RUNNER_SCHEMA, status: !owner.signing && result.status === 'succeeded' ? 'incomplete' : result.status,
     planSha256: owner.planFile.sha256, approvalSha256: owner.approval.sha256, approvedBy: owner.approval.approval.approvedBy,

package/local-discipline-contracts.mjs

@@ -12,11 +12,15 @@ export const DISCIPLINE_WRITE_SCHEMA = object({ targetPath: relativePath,
 }, ['targetPath', 'kind', 'reason', 'requirementRefs']);
 const approval = object({ interactionId: identifier, interactionDigest: shaSchema, auditId: identifier,
   proposalDigest: shaSchema }, ['interactionId', 'interactionDigest', 'auditId', 'proposalDigest']);
-export const DISCIPLINE_POLICY_SCHEMA = object({ schemaVersion: { const: 'entrorove.discipline-policy/1.0' },
+const mutablePolicy = object({ schemaVersion: { const: 'entrorove.discipline-policy/1.0' },
   requirementIds: refs, writes: array(DISCIPLINE_WRITE_SCHEMA, 1), approval,
   dataOperations: array(object({ operation: { enum: ['delete', 'migrate', 'rebuild'] }, target: text,
     reason: text, requirementRefs: refs, snapshotArtifactDigest: shaSchema }, ['operation', 'target', 'reason', 'requirementRefs', 'snapshotArtifactDigest'])),
 }, ['schemaVersion', 'requirementIds', 'writes']);
+const readOnlyPolicy = object({ schemaVersion: { const: 'entrorove.discipline-policy/1.0' },
+  access: { const: 'read-only' }, requirementIds: refs, writes: { type: 'array', maxItems: 0 },
+}, ['schemaVersion', 'access', 'requirementIds', 'writes']);
+export const DISCIPLINE_POLICY_SCHEMA = { oneOf: [mutablePolicy, readOnlyPolicy] };
 export const DISCIPLINE_DECLARATION_SCHEMA = object({ ...DISCIPLINE_WRITE_SCHEMA.properties,
   usageReviewDigest: shaSchema }, DISCIPLINE_WRITE_SCHEMA.required);
 const validate = new Ajv({ allErrors: true, strict: true }).compile(DISCIPLINE_POLICY_SCHEMA);

package/local-mutation-wire.mjs

@@ -17,6 +17,7 @@ const PASS_FIELDS = ['schemaVersion', 'passId', 'challengeId', 'challengeDigest'
   'snapshotManifestDigest', 'attestationDigest', 'coordinationRequired'];
 const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
 const SHA = /^[0-9a-f]{64}$/;
+const localRoleFields = ['verificationMode', 'memberScopeKeyId', 'memberScopeBindingDigest'];
 function exact(value, fields) {
   if (!value || typeof value !== 'object' || Array.isArray(value)
     || Object.keys(value).sort().join('\0') !== [...fields].sort().join('\0')) {
@@ -39,13 +40,21 @@ function pinnedAuthority() {
   } catch { mutationFail14('ENTROROVE_MUTATION_AUTHORITY_INVALID', 'Pinned cloud mutation authority is unavailable or invalid'); }
 }
 function identity(payload) {
+  const local = payload.verificationMode === 'member-local';
+  if (local ? payload.runnerKeyId !== null || !payload.writeDelegation
+    || !SHA.test(payload.memberScopeKeyId ?? '') || !SHA.test(payload.memberScopeBindingDigest ?? '')
+    || payload.memberScopeKeyId !== payload.writeDelegation.scopeKeyId || payload.memberScopeBindingDigest !== payload.scopeBindingDigest
+    : (payload.verificationMode !== undefined && payload.verificationMode !== 'independent') || !SHA.test(payload.runnerKeyId ?? '')
+      || Object.hasOwn(payload, 'memberScopeKeyId') || Object.hasOwn(payload, 'memberScopeBindingDigest')) {
+    mutationFail14('ENTROROVE_MUTATION_AUTHORITY_INVALID', 'Mutation verification roles must preserve their original independent or member-local authority');
+  }
   if (Object.hasOwn(payload, 'previousPassId') && (!ID.test(payload.previousPassId) || payload.previousPassId === payload.passId)) {
     mutationFail14('ENTROROVE_MUTATION_AUTHORITY_INVALID', 'Mutation continuation must retain a distinct original settled predecessor');
   }
   const ids = ['flowId', 'taskId', 'acceptanceReceiptId', 'stepId', 'leaseId', 'planId', 'executionAuthorityId',
     'executionAttemptNonce', 'runnerId', 'repositoryId', 'snapshotId', 'nonce', 'challengeId'];
   const digests = ['taskDigest', 'chainDigest', 'acceptanceDigest', 'routeDigest', 'receiverDigest', 'leaseDigest',
-    'planDigest', 'executionPlanSha256', 'executionAuthorityDigest', 'runnerKeyId', 'scopeBindingDigest',
+    'planDigest', 'executionPlanSha256', 'executionAuthorityDigest', ...(local ? [] : ['runnerKeyId']), 'scopeBindingDigest',
     'scopeArtifactDigest', 'scopeContractDigest'];
   const delegated = Object.hasOwn(payload, 'writeDelegation');
   const execution = new Set(['executionAuthorityId', 'executionAuthorityDigest', 'executionAttemptNonce']);
@@ -83,6 +92,9 @@ function authority(value, fields, schema, options) {
     || receipt.payloadDigest !== sha256(bytes) || !verify(null, bytes, key.key, signature)) {
     mutationFail14('ENTROROVE_MUTATION_AUTHORITY_INVALID', 'Mutation authority requires a valid pinned cloud signature');
   }
+  if (payload.runnerKeyId !== null && payload.runnerKeyId === receipt.keyId) {
+    mutationFail14('ENTROROVE_MUTATION_AUTHORITY_INVALID', 'The workflow authority key cannot become an independent Validator runner');
+  }
   identity(payload); mutationLifetime14(payload, options); return value;
 }
 export function mutationChallenge14(value, options) {
@@ -91,7 +103,7 @@ export function mutationChallenge14(value, options) {
 function authorityFields(value, fields) {
   const original = Object.hasOwn(value ?? {}, 'writeDelegation') ? [...fields.filter(field =>
     !['executionAuthorityId', 'executionAuthorityDigest', 'executionAttemptNonce'].includes(field)), 'writeDelegation'] : fields;
-  return [...original, ...['previousPassId'].filter(field => Object.hasOwn(value ?? {}, field))];
+  return [...original, ...['previousPassId', ...localRoleFields].filter(field => Object.hasOwn(value ?? {}, field))];
 }
 export function mutationPass14(value, options) {
   const fields = [...authorityFields(value, PASS_FIELDS), ...['disciplinePolicy', 'parallelPaths'].filter(key => Object.hasOwn(value ?? {}, key))];

package/local-preserved-mutation-state.mjs

@@ -8,7 +8,9 @@ import { readPreservedMutationBinding, loadPreservedMutationSigner } from './loc
 import { preservedMutationDelegation, preservedMutationFail, preservedMutationPublicKey } from './local-preserved-mutation-wire.mjs';
 
 const identity = authority => Object.fromEntries(['flowId', 'taskId', 'ownerId', 'taskDigest', 'chainDigest',
-  'repositoryDigest', 'runnerKeyId', 'runnerId', 'repositoryId', 'receiverDigest'].map(field => [field, authority[field]]));
+  'repositoryDigest', 'runnerKeyId', 'runnerId', 'repositoryId', 'receiverDigest',
+  ...['verificationMode', 'memberScopeKeyId', 'memberScopeBindingDigest'].filter(field => Object.hasOwn(authority, field))]
+  .map(field => [field, authority[field]]));
 async function rejectGenericHistory(location) {
   const anchor = process.env.ENTROROVE_TASK_HANDOFF_STATE_DIRECTORY;
   if (!anchor) return;

package/local-preserved-mutation-wire.mjs

@@ -30,9 +30,16 @@ export function preservedMutationDelegation(authority) {
   exact(value, ['schemaVersion', 'purpose', 'scopeKeyId', 'mutationKeyId', 'mutationPublicKey',
     'gateEvidenceDigest', 'importGraphDigest', 'protectedFiles', 'targetFiles', 'targetImports']);
   const publicKey = preservedMutationPublicKey(value.mutationPublicKey);
+  const local = authority.verificationMode === 'member-local';
+  const roleKeys = local ? [value.scopeKeyId, value.mutationKeyId] : [authority.runnerKeyId, value.scopeKeyId, value.mutationKeyId];
+  if (local && (authority.runnerKeyId !== null || authority.memberScopeKeyId !== value.scopeKeyId
+    || authority.memberScopeBindingDigest !== authority.scopeBindingDigest)
+    || !local && authority.runnerKeyId === authority.authorityReceipt?.keyId) {
+    preservedMutationFail('Preserved mutation cannot promote scope, mutation or workflow signing keys to independent validation');
+  }
   if (value.schemaVersion !== 'entrorove.preserved-write-delegation/1.0' || value.purpose !== 'preserved-existing-modify'
     || ['scopeKeyId', 'mutationKeyId', 'gateEvidenceDigest', 'importGraphDigest'].some(field => !/^[0-9a-f]{64}$/.test(value[field]))
-    || publicKey.keyId !== value.mutationKeyId || new Set([authority.runnerKeyId, value.scopeKeyId, value.mutationKeyId]).size !== 3
+    || publicKey.keyId !== value.mutationKeyId || new Set(roleKeys).size !== roleKeys.length
     || authority.epoch !== 0 || authority.newFilePaths.length !== 0) preservedMutationFail('Preserved mutation role or original epoch is invalid');
   files(value.protectedFiles); files(value.targetFiles);
   if (canonical(value.targetFiles.map(file => file.path)) !== canonical(authority.paths)