@entrorove/skill 0.1.58 → 0.1.60

package/CAPABILITY-MAP.md

@@ -93,6 +93,8 @@ Entrorove 只治理通过技能入口执行的动作：路径、通行证、快
 
 `scope-connect <absolute repositoryRoot>` 是 CLI 编排入口，不改变这 100 项本地操作。它串联远端 `scope-runner-prepare/register/challenge/attest` 与已有真实快照、签名检查，为原账号与任务提交范围证据；不授予执行证据签名或写入权限。全部远端操作以实时 discovery 为准。
 
+`scope-amend <original repositoryRoot>` 使用原 S 签名人完成同一 flow 的精确范围补正。先通过 `workflow-scope-review` 审核完整文件、哈希与写入/只读角色，再提供 `{flowId,proposalId,proposalDigest}`。真实审批、原合同和剩余预算仍有效；成功后计划绑定返回的 `scopeRevisionDigest`，原入口与失败历史保留。详见 [IDE-EXECUTION.md](IDE-EXECUTION.md#correcting-omitted-scope-before-plan-freeze)。
+
 当前增量操作（不改写上述历史分母）为：`peer-status`、`discipline-check`、`discipline-review`、`flow-cancel`、`flow-abandon`、`guarded-delete`、`guarded-move`、`mutation-delegate-prepare`、`mutation-consumption-attest`。它们计入当前 109 项公开 schema。
 
 | 分区 | 精确操作名 | 证据位置 |

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.1.60 — 2026-10-17
+
+- 修复范围补正误用独立交接的完整依赖校验，接收原账号签名器的真实受限扫描并保留未解析依赖、原审批与预算；新增当前 IDE 会话离线 exit，识别明确停用决定并保持退出状态，不再要求重建流程。
+- Fix scope amendments to verify the original member signer wire receipt while preserving unresolved imports, owner approval and native budgets. Add offline exit for the current IDE session, recognize explicit stop decisions and preserve exited governance without requiring a replacement flow.
+
+## 0.1.59 — 2026-10-17
+
+- 新增同一任务的精确范围补正：原账号审核文件哈希与写入/只读角色，原S签名真实事实并重评原合同；计划、写入和结算绑定不可变范围修订，改后刷新保留原M消费证据与失败历史。
+- Add same-task exact scope amendment with original owner review of file hashes and write/read-only roles, original S observations and native contract reassessment; bind plans, writes and settlement to immutable scope revisions and retain actual M consumption and failure history during post-write refresh.
+
 ## 0.1.58 — 2026-10-17
 
 - 修复截图等多模态 PostToolUse 事件超过旧输入上限时被误拦：完整读取并严格校验最多 32 MiB 的 UTF-8 JSON 对象，超限或无效事件返回固定安全诊断；保留原授权、待回执调用及 O 证据，私有状态文件仍限 1,000,000 字节。

package/IDE-EXECUTION.md

@@ -14,6 +14,8 @@ Approved Codex `exec_command` reads and SDK calls run with `/bin/sh` and `login:
 
 For a Codex task-to-task report explicitly authorized by the human user, the guard passes the exact `mcp__codex_app__send_message_to_thread` tool through unchanged, including a static `tools.mcp__codex_app__send_message_to_thread({...})` call inside `functions.exec`. Codex still decides whether the user authorized the message. Its text and response grant no Entrorove flow, file, shell or task-creation authority.
 
+To stop governance only in the current IDE session after an explicit user decision, run `entrorove exit`. It needs no network, credential, agreement or hook callback and preserves original evidence and queues. Other sessions remain unchanged. `flow-cancel` and `flow-abandon` settle a flow; they do not express a decision to stop using the skill.
+
 To stop using Entrorove on this computer, run `entrorove uninstall` directly. It works offline, removes only the recorded Entrorove host hooks and pristine global skill, and leaves other host settings, credentials and task records in place. A hand-edited file is reported as preserved rather than deleted. This command does not inspect or change another project.
 
 Every invocation rereads that same credential file, including clients already running. After an authenticated account page supplies the current key and `configure` synchronizes it once, all tasks under the same OS user automatically use the new value. A revoked or expired key cannot obtain new permissions for itself: return to the authenticated account page and synchronize once through JSON stdin. Status recovery only queries the original request; it never rotates credentials or repeats the operation.
@@ -76,6 +78,16 @@ When intake returns `workflow-gate`, connect the current repository before invok
 
 Scope inspection resolves aliases from actual `tsconfig.json` or `jsconfig.json`, including relative and npm `extends` and ordered inheritance arrays. Npm configuration lookup uses the pinned TypeScript JSON-config resolver over controlled metadata reads, including scoped packages, subpaths, package `tsconfig`, `exports` and `typesVersions`. Read-only candidate probes treat a child beneath an ordinary file as absent so normal TypeScript fallbacks continue; actual sources, control files and mutation targets retain strict validation. Rejected paths report the requested path, blocking ancestor, resolved target and reason, including broken or cyclic dependency links. Configurations and package metadata enter the signed hashes; dependencies are read only, never executed. Repository-local pnpm links use their actual configuration location. Read-only external dependency packages support parents and mappings inside their reference boundary; references requiring an unrepresentable external canonical ancestor fail explicitly rather than selecting a different same-name repository package. For plugin source compiled by a host project whose config is outside the source's ancestors, include `importContexts: [{"sourcePrefix":"<plugin source directory>","configPath":"<actual host tsconfig.json>"}]` in `scope-connect` input. Inspect the real build configuration first; never invent an alias or mark an unresolved import as external. These context paths remain inside the repository, their hashes enter the signed facts, and the local task binding freezes them.
 
+### Correcting omitted scope before plan freeze
+
+If the original selection omitted actual components or inspection files, use the discovered `workflow-scope-review` on the **same flow**, with its original gate digest, current effective revision (`0` before the first amendment), and the complete sorted exact file map. Each entry declares its real `path`, `sha256`, `access` (`write` or `read-only`), original `requirementRefs` and reason. Include all original entries even when reducing their access to read-only. Existing dependencies may become writable only through this exact new review; a directory prefix or manifest inclusion does not grant that permission.
+
+Present the returned scope-revision question and submit the original owner's actual answer through its bound `interaction-answer`. Approval is specific to that complete proposal; it does not approve a plan or perform a write. Then run `npx @entrorove/skill scope-amend <original repositoryRoot>` with `{flowId,proposalId,proposalDigest}` on stdin. It loads the **existing** S key and original repository/entry/import-context binding, obtains a W challenge, scans the real complete file set into a separate candidate snapshot and submits signed evidence. It never creates a replacement signer, answers approval itself, or overwrites the original scope history.
+
+Only a successful native gate and the original approved contracts and remaining budgets can activate the immutable scope revision. Keep the original Blueprint, plan identities, task order and failure receipts. Submit the complete corrected plan with the returned `scopeRevisionDigest` under its canonical new request identity. Exact read-only files remain read-only, even if included in the manifest or a broad write contract. An unknown request outcome is recovered with the original GET; do not replay an uncertain POST or restart the flow.
+
+After an amended task's actual guarded writes, follow its returned `scope-amend` refresh action, which adds the original stored `gatePassPath` to the same `{flowId,proposalId,proposalDigest}`. The connector preserves the real M consumption receipt and observes new S facts without another write. It appends facts under the same approved role revision, then the original `mutation-settle` and local observation can continue. Changed read-only files, a different pass or extra writes remain blocked. A proof refresh cannot change permissions or reset a consumed budget. Live `workflow-scope-status` observes the current head; an uncertain mutating request is still recovered only through its original GET.
+
 Keep snapshot before-images distinct from a frozen execution plan's expected final file hashes. Controlled writes consume the original approved authority; the runner then verifies the actual planned final bytes. Never edit a signed plan or silently substitute a newer snapshot after an unknown or failed gate. Existing changes outside that authority require explicit revalidation of the same original flow.
 
 Computed runtime imports remain explicitly unresolved with their actual source paths and hashes. A member's scope-only signer may submit these observations to enter restricted planning; the cloud returns `planningOnly: true` and `requires-complete-import-graph-before-mutation`. Do not treat this as full dependency verification, execution permission, or business completion. Obtain the limited original-task editing delegation below when eligible, or resolve and verify the dependency contract. Never set `complete` manually or replace the original signer or paths.
@@ -90,7 +102,7 @@ The connector creates a separate local editing key, requests the cloud's origina
 
 Use the returned `gatePassPath` with the discovered `local guarded-write` contract and preserve its exact flow, step and repository. Only existing declared modify targets are eligible. Runtime loader sources and observed project configuration stay protected by their original hashes and physical file identity. The local preflight rejects changed imports, removed definitions, public contract changes, new unknown dependencies and unsupported source formats. Unknown dependency coverage remains unknown after an eligible edit.
 
-After the pass's actual writes finish, rerun the original `scope-connect` with its complete original input, including `importContexts`. Run `npx @entrorove/skill mutation-settle <original repositoryRoot>` with `{taskId,flowId,stepId,gatePassPath}`. The local M signer observes the real completed consumption, and the service requires a fresh S scan captured after those writes. This settlement preserves both before and after hashes, unchanged modes, pass nonces and the original lease. It never creates an architecture verification event. Further edits use the returned `localAction`, whose `previousPassId` identifies that exact settled pass; do not resend an already consumed write.
+After the pass's actual writes finish, follow its scope refresh action: an amended scope uses `scope-amend` with the original stored `gatePassPath`; an unchanged original scope uses its complete original `scope-connect` input, including `importContexts`. Run `npx @entrorove/skill mutation-settle <original repositoryRoot>` with `{taskId,flowId,stepId,gatePassPath}`. The local M signer observes the real completed consumption, and the service requires a fresh S scan captured after those writes. This settlement preserves both before and after hashes, unchanged modes, pass nonces and the original lease. It never creates an architecture verification event. Further edits use the returned `localAction`, whose `previousPassId` identifies that exact settled pass; do not resend an already consumed write.
 
 If settlement reports `ENTROROVE_SCOPE_AFTER_WRITE_REQUIRED`, refresh only the original scope and retry the same consumption request and receipt. A lost network response is different: rerunning the identical connector restores its original GET result without a replacement POST or signature.
 

package/SKILL.md

@@ -5,7 +5,7 @@ description: Execute an engineering task through Entrorove, preserving its origi
 
 # entrorove · 熵巡
 
-Version: 0.1.58.
+Version: 0.1.60.
 
 Entrorove applies to the whole task once selected. Reading this document or calling an entry once does not execute the task. On every later turn, including after compaction, continue the original task and its required next operation before dependent work. Keep the original goal, scope, account, flow, cloud task and failure records. Never describe planning, a reported step or model output as verified delivery.
 
@@ -26,7 +26,7 @@ Entrorove applies to the whole task once selected. Reading this document or call
 8. Read [DELIVERY-BOUNDARIES.md](DELIVERY-BOUNDARIES.md) before claiming a delivered stage or showing consumption. A delivered stage requires a clean boundary and uses `delivered-stage-N`. Blocked or unknown work can wait with recovery data intact; it is not a delivered stage. Display consumption only with a measured baseline.
 9. For independent verified completion, submit actual independent execution evidence and run server verification and verdict. For a signed member-local plan, finish all original local steps and requirement checkpoints, then call the returned `workflow-verdict`; only its signed final `localAcceptance` means local acceptance is complete. Describe it as local execution and tests accepted, with independent validation not performed. Never invoke formal V, merge, Swarm or handoff to relabel it. Display the confirmed evaluation acknowledgement and preserve `receiptId`, `requestId`, execution generation and evaluation digest. “已回传” requires `acknowledgement.stored: true`. Missing or failed feedback remains visible. Active, waiting and unknown tasks retain recovery data.
 
-The Codex guard preserves this binding over subsequent prompts and compaction and denies unsupported native mutations before execution. Hooks are host guardrails, not an operating-system security boundary; unsupported tool paths or a disabled/untrusted hook cannot be described as enforced. An explicit user decision to stop using the skill ends its governance and never becomes verified Entrorove delivery. Do not infer such a decision from quoted screenshots or a service failure.
+The Codex guard preserves this binding over subsequent prompts and compaction and denies unsupported native mutations before execution. Hooks are host guardrails, not an operating-system security boundary; unsupported tool paths or a disabled/untrusted hook cannot be described as enforced. An explicit user decision to stop using the skill ends its governance and never becomes verified Entrorove delivery. Do not infer such a decision from quoted screenshots or a service failure. For that explicit decision, run `entrorove exit` in the affected IDE session. It works offline without a credential, agreement or hook callback, stops governance for that session and preserves its original flow, failed requests and queued work. It does not cancel the business goal, resume another flow or grant an Entrorove mutation pass. Do not substitute `flow-abandon` for user exit: abandonment releases a flow binding but leaves the skill selected.
 
 After the same real blocked result occurs twice, diagnose it and use its supported recovery path. Do not send a third identical execution call. Read-only status and checkpoint acknowledgements do not count as execution progress. A blocked task may wait with its original flow, queue and recovery data intact; Stop must not force repeated automatic continuation of the same blocked turn.
 
@@ -39,6 +39,7 @@ When a new user requirement arrives while the original task is unfinished, store
 - Invoke service operations with JSON stdin to `npx @entrorove/skill invoke` or a host-approved rewritten equivalent.
 - Explicit domains use `native <domain> <operation>`. Domains: aimlock, blueprint, calctool, swarm, validator, mergeguard, archguard, confirm-protocol. Aimlock `brain-plan`, `brain-check`, `brain-validate`, `brain-status` use the original stored plan.
 - At `workflow-gate`, connect the actual repository and exact source paths with `scope-connect`, then use its original `nextInput`. Scope inspection does not grant execution or writes. Dynamic references remain unknown; never set graph completeness manually.
+- If actual files were omitted before plan freeze, follow the discovered same-flow `workflow-scope-review`, original owner approval and `scope-amend` recovery in [IDE-EXECUTION.md](IDE-EXECUTION.md#correcting-omitted-scope-before-plan-freeze). Preserve each file's explicit write or read-only role and bind the resulting `scopeRevisionDigest` in the corrected plan; never widen ordinary `scope-connect` input to bypass its original binding.
 - `local capabilities` describes scope, snapshot, budget, ownership, mutation, review and evidence contracts. Do not call a guessed operation or construct a local signature in place of cloud authority.
 - Cloud events and homepage progress share the same account-bound stream. Show public entering, allocation, model activity, output and termination as they occur. Show the server-selected promotion and execution notice separately. Deduplicate task/event/receipt IDs; never invent progress or model reasoning.
 - `status`, `cloud-status` and `feedback` recover the original identity with GET only. Never repeat a paid POST to recover an uncertain result.

package/cli.mjs

@@ -21,6 +21,7 @@ import { activeIdeAdapters, ideAdapters, installIdeHooks, uninstallIdeHooks } fr
 import { cleanManagedDuplicates } from './install-cleanup.mjs';
 import { assertIdeExecution, ideGuardBinding, settleBreakGlassSession } from './ide-session.mjs';
 import { writeBreakGlass } from './break-glass.mjs';
+import { exitIdeSession } from './ide-exit.mjs';
 const markerName = '.entrorove-managed.json';
 const installFiles = ['SKILL.md', 'CAPABILITY-MAP.md', 'AGREEMENT.md', 'manifest.json', 'IDE-EXECUTION.md', 'REUSE-DISCIPLINE.md', 'DELIVERY-BOUNDARIES.md'];
 const markerSchema = 'entrorove.managed-install/1.0';
@@ -427,7 +428,9 @@ async function runAccountCommand(command, args) {
 
 async function main() {
   const [command, ...args] = process.argv.slice(2);
-  if (command === 'unlock' && args.length === 0) {
+  if (command === 'exit' && args.length === 0) {
+    process.stdout.write(`${JSON.stringify(await exitIdeSession())}\n`);
+  } else if (command === 'unlock' && args.length === 0) {
     process.stdout.write(`${JSON.stringify(await writeBreakGlass(os.homedir(), Date.now(), ideGuardBinding().sessionId))}\n`);
   } else if (command === 'uninstall' && args.length === 0) {
     const result = await uninstall();
@@ -477,7 +480,7 @@ async function main() {
   } else if (command === 'local') {
     await runLocal(args);
   } else {
-    throw new Error('Usage: entrorove unlock | uninstall | install [--host codex] | configure | agreement | invoke | queue | native <domain> <operation> | notifications configure|status|test | scope-connect <repositoryRoot> | mutation-connect <repositoryRoot> | mutation-settle <repositoryRoot> | workflow-observe-step <repositoryRoot> | host-message [adapterModulePath] | cloud-task | cloud-watch | cloud-status | feedback <requestId> [generation] | status <requestId> | flows | usage [flowId] | billing | recurring list|claim|finish|runs | review | local (JSON on stdin)');
+    throw new Error('Usage: entrorove exit | unlock | uninstall | install [--host codex] | configure | agreement | invoke | queue | native <domain> <operation> | notifications configure|status|test | scope-connect <repositoryRoot> | scope-amend <repositoryRoot> | mutation-connect <repositoryRoot> | mutation-settle <repositoryRoot> | workflow-observe-step <repositoryRoot> | host-message [adapterModulePath] | cloud-task | cloud-watch | cloud-status | feedback <requestId> [generation] | status <requestId> | flows | usage [flowId] | billing | recurring list|claim|finish|runs | review | local (JSON on stdin)');
   }
 }
 if (process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) { const { captureIdeResults } = await import('./ide-results.mjs');

package/connected-cli.mjs

@@ -1,9 +1,11 @@
 import { runScopeConnect } from './scope-runner-client.mjs';
 import { runMutationConnect, runMutationSettle } from './mutation-client.mjs';
 import { runWorkflowObserveStep } from './workflow-observation-client.mjs';
+import { runScopeAmend } from './scope-amendment-client.mjs';
 
 const commands = Object.freeze({
   'scope-connect': runScopeConnect,
+  'scope-amend': runScopeAmend,
   'mutation-connect': runMutationConnect,
   'mutation-settle': runMutationSettle,
   'workflow-observe-step': runWorkflowObserveStep,

package/ide-command.mjs

@@ -76,7 +76,7 @@ export function sdkCommand(parsed, runtime) {
     args = words.slice(1);
   } else return null;
   const simple = new Set(['invoke', 'cloud-task', 'cloud-status', 'cloud-watch', 'agreement', 'configure', 'queue', 'unlock']);
-  if (['unlock', 'uninstall'].includes(args[0]) && args.length === 1 && !parsed.input) return { args };
+  if (['exit', 'unlock', 'uninstall'].includes(args[0]) && args.length === 1 && !parsed.input) return { args };
   if (simple.has(args[0]) && args.length === 1 && parsed.input) return { args, input: parsed.input };
   if (['status', 'feedback'].includes(args[0]) && /^[a-f0-9]{64}$/u.test(args[1] ?? '') && [2,3].includes(args.length)) return { args };
   if (args[0] === 'flows' && args.length === 1 && (!parsed.input || typeof parsed.input === 'object'
@@ -88,7 +88,7 @@ export function sdkCommand(parsed, runtime) {
   if (args[0] === 'usage' && args.length <= 2 && !parsed.input
     && (args[1] === undefined || /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u.test(args[1]))) return { args };
   if (args[0] === 'local' && /^[a-z][a-z0-9-]+$/u.test(args[1] ?? '') && [2,3].includes(args.length) && parsed.input) return { args, input: parsed.input };
-  if (['scope-connect', 'mutation-connect', 'mutation-settle', 'workflow-observe-step'].includes(args[0]) && args.length === 2 && parsed.input) return { args, input: parsed.input };
+  if (['scope-connect', 'scope-amend', 'mutation-connect', 'mutation-settle', 'workflow-observe-step'].includes(args[0]) && args.length === 2 && parsed.input) return { args, input: parsed.input };
   if (args[0] === 'native' && args.length === 3 && parsed.input) return { args, input: parsed.input };
   return null;
 }

package/ide-exit.mjs

@@ -0,0 +1,26 @@
+import os from 'node:os';
+import path from 'node:path';
+import { ideDirectory, ideDigest, ideError, ideGuardBinding, ideSession, readIdeJson, verifiedIdeGuards } from './ide-session.mjs';
+
+const exactExit = /^(?:(?:请)?(?:停止使用|退出)\s*\$?entrorove|(?:stop using|exit)\s+\$?entrorove)[.!。！]?$/iu;
+const naturalExit = /(?:^|[，,。；;！!\n])\s*(?:从现在开始|接下来|今后)?\s*(?:停止使用|不再使用|不使用)\s*(?:entrorove(?:\s*技能)?|(?:这个|该)?技能)\s*(?:(?:来)?(?:执行|处理|完成|继续)[^，,。；;！!\n]{0,40}(?:任务|工作))?[。！!]?\s*$/iu;
+export function explicitIdeExit(prompt) {
+  if (exactExit.test(prompt)) return true;
+  return !/[`"'“”‘’「」『』<>]|如果|假如|假设|示例|截图|引用/u.test(prompt) && naturalExit.test(prompt);
+}
+export function markIdeExited(state, source) {
+  if (state.phase !== 'user-exited') state.exitPhase = state.phase;
+  state.active = false; state.phase = 'user-exited';
+  state.exitDecision = { source, observedAt: new Date().toISOString() };
+}
+export async function exitIdeSession({ home = os.homedir(), environment = process.env } = {}) {
+  const { host, sessionId } = ideGuardBinding(environment);
+  if (!Object.hasOwn(verifiedIdeGuards, host) || !sessionId) throw ideError('ENTROROVE_IDE_IDENTITY', 'Exit requires the current verified IDE session identity');
+  const directory = await ideDirectory(home), state = await readIdeJson(path.join(directory, `session-${ideDigest(sessionId)}.json`));
+  if (!state || state.sessionId !== sessionId) throw ideError('ENTROROVE_IDE_IDENTITY', 'Exit requires the existing current IDE session');
+  return ideSession({ session_id: sessionId, cwd: state.repositoryRoot }, current => {
+    markIdeExited(current, 'cli');
+    return { schemaVersion: 'entrorove.ide-exit/1.0', status: 'user-exited', sessionId,
+      offline: true, network: false, hook: 'not-required', originalFlowPreserved: true, claimsCompletion: false };
+  }, home);
+}

package/ide-hook.mjs

@@ -13,6 +13,7 @@ import { parseIdeResults, consumeIdeResults } from './ide-results.mjs';
 import { verifyIdeLocalAcceptance } from './ide-local-acceptance.mjs';
 import { registerIdeRequirement, ideQueueContext, unclassifiedIdeRequirements,
   advanceIdeQueue, checkQueuedStart, unfinishedIdeQueue } from './ide-queue.mjs';
+import { explicitIdeExit, markIdeExited } from './ide-exit.mjs';
 
 const output = (event, extra = {}) => ({ hookSpecificOutput: { hookEventName: event, ...extra } });
 const deny = reason => output('PreToolUse', { permissionDecision: 'deny', permissionDecisionReason: reason });
@@ -24,7 +25,6 @@ const inputErrors = {
 const publicId = value => typeof value === 'string' && /^[A-Za-z0-9_-]{1,200}$/u.test(value);
 const readTools = new Set(['wait', 'view_image', 'list_mcp_resources', 'list_mcp_resource_templates', 'read_mcp_resource', 'web_search', 'update_plan', 'request_user_input', 'request_user_input_async', 'get_goal']);
 const unlockCommand = 'entrorove unlock';
-const exitPrompt = /^(?:(?:请)?(?:停止使用|退出)\s*\$?entrorove|(?:stop using|exit)\s+\$?entrorove)[.!。！]?$/iu;
 const selectPrompt = /^(?:(?:请)?(?:使用|启用)\s+\$?entrorove|\$entrorove)(?:\s|[，。,:：！!]|$)/iu;
 function userPrompt(event) {
   let prompt = (event.prompt ?? '').trim();
@@ -143,19 +143,24 @@ function originalLocalCall(pending, call, input) {
     ['taskId', 'flowId', 'stepId', 'leaseId', 'generation'].map(field => [field, input?.[field]]));
   if (operationOf(call) === 'continue') pending.continuationOperation = input?.operation;
 }
+function offlineExitCall(event, runtime, state, call) {
+  return output('PreToolUse', { permissionDecision: 'allow', updatedInput: prepareIdeShellInput(event.tool_name,
+    event.tool_input, renderSdkCommand(call, runtime, state.sessionId), true) });
+}
+function allowInstaller(event, state, command) {
+  const safeInput = prepareIdeShellInput(event.tool_name, event.tool_input, command, true);
+  if (!safeInput) return denyUnsafeShellInput(state, event);
+  if (state.active) { state.readCalls ??= {};
+    state.readCalls[event.tool_use_id] = { toolUseId: event.tool_use_id, command: 'install' }; }
+  return output('PreToolUse', { permissionDecision: 'allow', updatedInput: safeInput });
+}
 async function beforeTool(event, state, home) {
   if (state.phase === 'user-exited') return {};
   const unlocked = await readBreakGlass(home, state.sessionId);
   const command = event.tool_input?.command ?? event.tool_input?.cmd, parsed = literalCommand(command);
   const isShell = ['Bash', 'exec_command', 'shell_command'].includes(event.tool_name);
   const installer = isShell && installerCommand(parsed);
-  if (installer) {
-    const safeInput = prepareIdeShellInput(event.tool_name, event.tool_input, installer, true);
-    if (!safeInput) return denyUnsafeShellInput(state, event);
-    if (state.active) { state.readCalls ??= {};
-      state.readCalls[event.tool_use_id] = { toolUseId: event.tool_use_id, command: 'install' }; }
-    return output('PreToolUse', { permissionDecision: 'allow', updatedInput: safeInput });
-  }
+  if (installer) return allowInstaller(event, state, installer);
   const namedSdk = parsed?.words.some(word => word === 'entrorove' || /^@entrorove\/skill(?:@[^ ]+)?$/u.test(word)
     || /(?:@entrorove\/skill|entrorove-skill)\/cli\.mjs$/u.test(word));
   if (!state.active && !namedSdk) return {};
@@ -163,6 +168,7 @@ async function beforeTool(event, state, home) {
   const call = runtime && sdkCommand(parsed, runtime);
   if (call) {
     if (!prepareIdeShellInput(event.tool_name, event.tool_input, command, true)) return denyUnsafeShellInput(state, event);
+    if (call.args[0] === 'exit' && call.args.length === 1) return offlineExitCall(event, runtime, state, call);
     if (call.args[0] === 'uninstall') {
       state.active = false; state.phase = 'user-exited';
       return output('PreToolUse', { permissionDecision: 'allow', updatedInput: prepareIdeShellInput(event.tool_name,
@@ -183,11 +189,11 @@ async function beforeTool(event, state, home) {
     const observer = discovery || ['status','feedback','cloud-status','configure','agreement','install','queue','flows','usage','billing','recurring'].includes(call.args[0]);
     if (unclassifiedIdeRequirements(state) && !observer && !(unlocked && isManagementCall(call))) return denyBlocked(state, event, 'Entrorove：新需求已保存，先用 queue status 读取并按轻重缓急 route 分类；禁止丢弃新需求或覆盖原任务。');
     if (newStart && !checkQueuedStart(state,call)) return denyBlocked(state, event, 'Entrorove：新任务目标必须与实际进入队列的用户原文一致。');
-    if (['local', 'mutation-connect', 'mutation-settle', 'workflow-observe-step'].includes(call.args[0]) && !discovery && !state.flowId) return denyBlocked(state, event, 'Entrorove：本地执行前必须先受理原任务并绑定账号、flowId 与仓库；不能直接使用其它流程的通行证。');
+    if (['local', 'scope-amend', 'mutation-connect', 'mutation-settle', 'workflow-observe-step'].includes(call.args[0]) && !discovery && !state.flowId) return denyBlocked(state, event, 'Entrorove：本地执行前必须先受理原任务并绑定账号、flowId 与仓库；不能直接使用其它流程的通行证。');
     if (state.pendingCall && !observer && !(unlocked && isManagementCall(call))) return denyBlocked(state, event, 'Entrorove：原调用尚未收到结束回执；先只读恢复其状态，禁止并发重发。');
     const input = call.args[0] === 'invoke' ? call.input?.input : call.input;
     if (input?.flowId && state.flowId && input.flowId !== state.flowId || input?.taskId && state.taskId && ['cloud-watch','cloud-status'].includes(call.args[0]) && input.taskId !== state.taskId) return denyBlocked(state, event, 'Entrorove：调用与本 IDE 任务的原编号不一致。');
-    if (['scope-connect', 'mutation-connect', 'mutation-settle', 'workflow-observe-step'].includes(call.args[0]) && call.args[1] !== state.repositoryRoot
+    if (['scope-connect', 'scope-amend', 'mutation-connect', 'mutation-settle', 'workflow-observe-step'].includes(call.args[0]) && call.args[1] !== state.repositoryRoot
       || call.args[0] === 'local' && (input?.repositoryRoot && input.repositoryRoot !== state.repositoryRoot || call.args[2] && call.args[2] !== state.repositoryRoot)) return denyBlocked(state, event, 'Entrorove：调用不能替换本任务的实际仓库。');
     let requestId;
     if (newStart) state.taskGoal = call.args[0] === 'cloud-task' ? call.input?.goal : call.input?.input?.task?.goal;
@@ -196,7 +202,7 @@ async function beforeTool(event, state, home) {
       requestId = buildInvocation(call.input.operation, call.input.input).requestId;
     }
     const pending = { toolUseId: event.tool_use_id, inputDigest: ideDigest(call), command: call.args[0],
-      operation: operationOf(call), observer, managementOnly: observer || isManagementCall(call)
+      operation: operationOf(call), observer, managementOnly: observer || call.args[0] === 'scope-amend' || isManagementCall(call)
         && !['start', 'continue', 'cloud-task'].includes(operationOf(call)) || operationOf(call) === 'task-checkpoint',
       ...(requestId ? { requestId } : {}) };
     originalLocalCall(pending, call, input);
@@ -253,9 +259,8 @@ export async function runIdeHook(event, { home } = {}) {
       delete state.stopNoticeTurn;
     }
     if (name === 'PreToolUse') state.enforcement = 'enforced';
-    if (name === 'UserPromptSubmit' && exitPrompt.test(userPrompt(event))) {
-      if (state.phase !== 'user-exited') state.exitPhase = state.phase;
-      state.active = false; state.phase = 'user-exited';
+    if (name === 'UserPromptSubmit' && explicitIdeExit(userPrompt(event))) {
+      markIdeExited(state, 'user-prompt');
       return output(name, { additionalContext: '用户明确退出 Entrorove 管理；原任务仍保留，未验收、未评分为成功。' });
     }
     if (selected) {

package/ide-install.mjs

@@ -5,7 +5,7 @@ import { ideDirectory, ideDigest, readIdeJson, writeIdeJson, ideError } from './
 import { withStateLock } from './local-state-lock.mjs';
 
 const source = path.dirname(fileURLToPath(import.meta.url));
-const files = ['ide-hook.mjs', 'ide-session.mjs', 'break-glass.mjs', 'ide-results.mjs', 'ide-local-acceptance.mjs', 'ide-queue.mjs', 'ide-command.mjs', 'ide-code-mode.mjs', 'remote-transport.mjs', 'local-credential.mjs', 'local-state-lock.mjs', 'local-stage-boundary.mjs'];
+const files = ['ide-hook.mjs', 'ide-session.mjs', 'ide-exit.mjs', 'break-glass.mjs', 'ide-results.mjs', 'ide-local-acceptance.mjs', 'ide-queue.mjs', 'ide-command.mjs', 'ide-code-mode.mjs', 'remote-transport.mjs', 'local-credential.mjs', 'local-state-lock.mjs', 'local-stage-boundary.mjs'];
 const quote = text => `'${text.replace(/'/gu, "'\\''")}'`;
 
 // One shared host-agnostic hook binary; every host is described by its own

package/ide-session.mjs

@@ -204,7 +204,7 @@ export async function settleBreakGlassSession(args, input, result, { home = os.h
       for (const key of ['flowId', 'taskId', 'taskNumber', 'requestId', 'remoteRequestId', 'nextStep', 'pendingCall', 'readCalls']) delete state[key];
       state.feedbackAcknowledged = false;
       if (state.phase !== 'user-exited') state.phase = 'entry';
-    } else state.phase = 'ended';
+    } else if (state.phase !== 'user-exited') state.phase = 'ended';
     return true;
   }, home);
 }

package/local-mutation-authority.mjs

@@ -16,6 +16,7 @@ import { readDisciplineSnapshot } from './local-discipline-snapshot.mjs';
 import { assertDisciplineRepository } from './local-discipline-repository.mjs';
 import { withPreservedMutationFence } from './local-preserved-mutation-state.mjs';
 import { assertPreservedMutationProtection } from './local-preserved-mutation-protection.mjs';
+import { scopeAmendmentRefreshAction } from './scope-amendment-reference.mjs';
 export { beginMutationBatch14, finishMutationBatch14, failMutationBatch14 } from './local-mutation-batch.mjs';
 
 const SCHEMA = 'entrorove.local-execution/1.0';
@@ -117,7 +118,10 @@ async function performWrite(input, state, value) {
     await privateMutationDirectory14(path.join(stateRoot, 'ledgers', pass.repositoryDigest), { privateFrom: stateRoot });
     await appendLedgerRecord(input, 'guarded-write', { flowId: pass.flowId, stepId: pass.stepId, targetPath: target,
       sha256: written.sha256, passId: pass.passId });
-    return { schemaVersion: SCHEMA, status: 'verified', written: true, targetPath: target, sha256: written.sha256 };
+    const nextAction = pass.paths.every(file => completed.writes[file]?.status === 'written')
+      ? await scopeAmendmentRefreshAction({ ...input, repositoryRoot: binding.root }, pass) : undefined;
+    return { schemaVersion: SCHEMA, status: 'verified', written: true, targetPath: target, sha256: written.sha256,
+      ...(nextAction ? { nextAction } : {}) };
   });
 }
 export async function guardedWrite14(input) {

package/local-mutation-wire.mjs

@@ -40,6 +40,9 @@ function pinnedAuthority() {
   } catch { mutationFail14('ENTROROVE_MUTATION_AUTHORITY_INVALID', 'Pinned cloud mutation authority is unavailable or invalid'); }
 }
 function identity(payload) {
+  if (Object.hasOwn(payload, 'scopeRevisionDigest') && !SHA.test(payload.scopeRevisionDigest)) {
+    mutationFail14('ENTROROVE_MUTATION_AUTHORITY_INVALID', 'Mutation authority scope revision is invalid');
+  }
   const local = payload.verificationMode === 'member-local';
   if (local ? payload.runnerKeyId !== null || !payload.writeDelegation
     || !SHA.test(payload.memberScopeKeyId ?? '') || !SHA.test(payload.memberScopeBindingDigest ?? '')
@@ -103,7 +106,7 @@ export function mutationChallenge14(value, options) {
 function authorityFields(value, fields) {
   const original = Object.hasOwn(value ?? {}, 'writeDelegation') ? [...fields.filter(field =>
     !['executionAuthorityId', 'executionAuthorityDigest', 'executionAttemptNonce'].includes(field)), 'writeDelegation'] : fields;
-  return [...original, ...['previousPassId', ...localRoleFields].filter(field => Object.hasOwn(value ?? {}, field))];
+  return [...original, ...['previousPassId', 'scopeRevisionDigest', ...localRoleFields].filter(field => Object.hasOwn(value ?? {}, field))];
 }
 export function mutationPass14(value, options) {
   const fields = [...authorityFields(value, PASS_FIELDS), ...['disciplinePolicy', 'parallelPaths'].filter(key => Object.hasOwn(value ?? {}, key))];

package/local-scope-signature.mjs

@@ -33,7 +33,10 @@ function binding(input, result) {
   for (const field of ['taskDigest', 'chainDigest']) if (!digest.test(String(input[field] ?? ''))) scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'scope signature requires original task and chain digests');
   if (!digest.test(String(result.snapshotDigest ?? ''))) scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'scope signature requires a verified preserved snapshot digest');
 }
-export async function attestScopeFacts(input, result) {
+export async function attestScopeFacts(input, result, { maximumExpiresAt } = {}) {
+  if (maximumExpiresAt !== undefined && (!Number.isSafeInteger(maximumExpiresAt) || maximumExpiresAt < 1)) {
+    scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'scope signature deadline must be a finite exact bound');
+  }
   rejectScopePrivileges(input);
   if (input.signerConfigPath === undefined || input.signerConfigPath === null) return result;
   binding(input, result);
@@ -58,7 +61,8 @@ export async function attestScopeFacts(input, result) {
     scopeFail('ENTROROVE_SCOPE_SIGNER_INVALID', 'scope signer configuration or signing key could not be read');
   }
   const now = Date.now();
-  const expiresAt = Math.min(now + config.receiptTtlMs, candidate ? Date.parse(candidate.expiresAt) : Infinity);
+  const expiresAt = Math.min(now + config.receiptTtlMs, candidate ? Date.parse(candidate.expiresAt) : Infinity,
+    maximumExpiresAt ?? Infinity);
   if (expiresAt <= now) scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'candidate challenge expired before its actual scope signature');
   const core = { schemaVersion: 'entrorove.scope-facts/1.0', flowId: input.flowId, stepId: input.stepId,
     taskDigest: input.taskDigest, ownerId: input.ownerId, chainDigest: input.chainDigest, repositoryId: input.repositoryId,

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": "entrorove.skill-manifest/1.0",
   "name": "entrorove",
-  "version": "0.1.58",
+  "version": "0.1.60",
   "endpoint": "https://entrorove.com",
   "requestSchemaVersion": "entrorove.skill.request/2.0",
   "supportedRequestSchemaVersions": [

package/mutation-client.mjs

@@ -16,6 +16,7 @@ import { ideClientHeaders } from './ide-presentation.mjs';
 import { appendInvocation, readInvocations } from './local-invocations.mjs';
 import { bootstrapCloudMutationAuthority } from './cloud-mutation-authority.mjs';
 import { attestMutationConsumption14, preservedMutationConsumptionState } from './local-mutation-consumption.mjs';
+import { scopeAmendmentRefreshAction } from './scope-amendment-reference.mjs';
 
 const schema = 'entrorove.mutation-connection-state/1.0';
 const fields = ['taskId', 'flowId', 'stepId', 'leaseId', 'generation', 'runnerId', 'paths'];
@@ -111,7 +112,7 @@ function passBinding(pass, challenge, attestation, options) {
   mutationPass14(pass, options);
   if (pass.challengeId !== challenge.challengeId || pass.challengeDigest !== sha256(canonical(challenge))
     || pass.attestationDigest !== sha256(canonical(attestation)) || pass.snapshotDigest !== attestation.manifest.snapshotDigest
-    || [...fields, 'previousPassId', 'verificationMode', 'runnerKeyId', 'memberScopeKeyId', 'memberScopeBindingDigest', 'scopeBindingDigest']
+    || [...fields, 'previousPassId', 'scopeRevisionDigest', 'verificationMode', 'runnerKeyId', 'memberScopeKeyId', 'memberScopeBindingDigest', 'scopeBindingDigest']
       .some(field => canonical(pass[field]) !== canonical(challenge[field]))
     || canonical(pass.writeDelegation) !== canonical(challenge.writeDelegation)) fail('Mutation pass differs from its original signed challenge or actual M snapshot');
 }
@@ -169,7 +170,7 @@ async function connect(identity, local, mutator, location, dependencies) {
     if (consumption.complete) return { schemaVersion: 'entrorove.mutation-connection/1.0', status: 'blocked', flowId: identity.flowId,
       code: 'ENTROROVE_MUTATION_SETTLEMENT_REQUIRED', gatePassPath: state.gatePassPath,
       message: 'Original physical writes are consumed; settle their actual M receipt with fresh S evidence before requesting the next restricted pass',
-      localAction: { command: 'npx @entrorove/skill mutation-settle <absolute repositoryRoot>',
+      localAction: await scopeAmendmentRefreshAction({ ...input, gatePassPath: state.gatePassPath }, stored) ?? { command: 'npx @entrorove/skill mutation-settle <absolute repositoryRoot>',
         input: { taskId: stored.taskId, flowId: stored.flowId, stepId: stored.stepId, gatePassPath: state.gatePassPath } } };
     passBinding(state.issued.pass, challenge, state.attestation);
     return connected(identity, state);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@entrorove/skill",
-  "version": "0.1.58",
+  "version": "0.1.60",
   "type": "module",
   "bin": {
     "entrorove": "cli.mjs"
@@ -89,6 +89,13 @@
     "local-task-handoff-write-receipts.mjs",
     "remote-client.mjs",
     "scope-runner-client.mjs",
+    "scope-amendment-client.mjs",
+    "scope-amendment-state.mjs",
+    "scope-amendment-wire.mjs",
+    "scope-amendment-remote.mjs",
+    "scope-amendment-observer.mjs",
+    "scope-amendment-mutation.mjs",
+    "scope-amendment-reference.mjs",
     "cloud-task-client.mjs",
     "task-entry-client.mjs",
     "task-identity.mjs",
@@ -218,6 +225,7 @@
     "ide-install.mjs",
     "install-cleanup.mjs",
     "ide-session.mjs",
+    "ide-exit.mjs",
     "break-glass.mjs",
     "ide-results.mjs",
     "ide-local-acceptance.mjs",

package/release-state.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": "entrorove.release-state/1.0",
-  "version": "0.1.58",
-  "digest": "503f521d785c3da28cf88eb604daa30ed9c28ab2e847cd8f4472773600fd4b3b",
+  "version": "0.1.60",
+  "digest": "e17ae66b1a55cf8a12f750bc8211a083ecb15c6625687e7d17b7ea08a4b302a1",
   "files": {
-    "connected-cli.mjs": "d5fc2542ae0aa36bf45b0f3d493fe1e7479a4a25c50c8f3730f8b0c4007a7f8f",
+    "connected-cli.mjs": "79c3359303957a9ebb8987e3dfb181f189d380fa02ef4462683b786aedfc7802",
     "local-approved-process.mjs": "442856df788e63f38757439ba0657d1c689aaf797631a955fae3dd639e844e6d",
     "local-approved-supervisor.mjs": "87142a4c13d27c8265cc1fd7fc9088988da9bbb02134164e1a7c5417da926ac7",
     "local-mutation-consumption.mjs": "cd8650b9be894639ceb35af88d23c8002b4acff27afad2e64174eb21a9424cfb",
@@ -19,13 +19,13 @@
     "local-preserved-mutation-state.mjs": "337a172b2d0a03b0d5a89b8483afdd9a043a4999fe38f87679633c98c450126b",
     "local-preserved-mutation-wire.mjs": "2f2f623e768d49af59dbb9bb8245627cb7e72184e5a5d3239d91f395152cf9bf",
     "local-delegated-modify-analysis.mjs": "f87148ddb023b79e241ca97db582991da8d0e1a51b26b1d9bc2799a76efd7297",
-    "mutation-client.mjs": "4d5fadb0277ce8cc1eaf96f613ef496201910e64d21355627ec68d88c01b5eb9",
+    "mutation-client.mjs": "6455c35b483d6d22e42e7be708630db07d9fd1d3cdf639294b126b69db2eae2f",
     "cloud-mutation-authority.mjs": "c7226e882a4f3be4d2f55728f515d5a815c0aa1f21aa5e4689314e6e6a8c66a2",
     "ide-code-mode.mjs": "f8ba4de33632ab4c6df52dab52f392414b4632c7e94b218b8065677970c075c7",
-    "ide-command.mjs": "3db45dd1d12db670e594b6ced35f2d7778cb01091695b1e240179b1ea34f25ee",
-    "ide-hook.mjs": "00d67d0a49e2d13d718a376090804804af8f20973f9b552c13c0d53daa375d13",
-    "ide-install.mjs": "6322f76d8c0f5c864d8c61f4ee90ae029ccf4bbf1e31fbca7590b78b6c7eaa78",
-    "ide-session.mjs": "6df04bca3231954e8b83f6b1b535befff16b6c62c51ca65ae3aa2559180ad7c2",
+    "ide-command.mjs": "4f61da5a39f88b8ba657d6b1beeb76f765c7f37f3d3e7f52dd9d2eb398499ec3",
+    "ide-hook.mjs": "037c245cd2b261acbaed126d5441a2b64a91bc9733a150ebd1ecfdf531d8c49f",
+    "ide-install.mjs": "7effa871a44e1215e26b913edc3de0c5b36deaff1a57c0f20d33212160a63f22",
+    "ide-session.mjs": "eb8021bc6e38e5c9c35d1dc4cc0015178960cb4eeb39da5a4de47762bf8d7c95",
     "break-glass.mjs": "6ec9f97c5d68bb33121b2374c06b9d4c8eb3419b52d00849fec7124bc63e4582",
     "ide-results.mjs": "baa0618845ced901334644479bf4e0d298bad3f955bc18846752de6c283a5573",
     "ide-local-acceptance.mjs": "238eec6d7b6093fb8ad022da0ed3383a48ba2ffcf693e3ce8a241cf9624088d8",
@@ -50,7 +50,7 @@
     "runtime/validator-runtime-v7.0.44.d.mts": "7797edbfe2f7de24da370204dce4dfd22822a1bd80df93514fff900b98afe36f",
     "snapshot-retention.mjs": "ca46aeb36b1a5a24fe7e967031a71b9a3d33f40cb715d344402cbe0dc9c425cb",
     "snapshot-cleanup-journal.mjs": "76a9684cc95b4eb076e1298d78a9dff37948b00d9607b8f546c599072d3ed331",
-    "IDE-EXECUTION.md": "7d0aa5d1e3dc8dfd3bd0598aa7dc32c50ecd80197cf6958bf836c0b434a9ae5e",
+    "IDE-EXECUTION.md": "12bff5711e9100ffcab03409bdf2b587e4a2d3f464500dbaa48ff59786d9cf42",
     "REUSE-DISCIPLINE.md": "5b214cf313e7f715f52d54e28093a2d038f0f196ca64b15d1c49587b9d8eecf8",
     "reuse-discipline-release.mjs": "7f55ae10ec3396ed3bc5430a0c64f94c33c2dfbc57b32084caab92fd5fd1586f",
     "local-final-gate16.mjs": "083aec470670e6cdb7ad2ab27b7a51b53a9ec3a8b4121cb9cbfa17d9940892c2",
@@ -94,17 +94,18 @@
     "local-autocoord17-waits.mjs": "2b0a713987822548a94e1ed3a9a891532db45383797dfc5d5bc8d1e35593cf25",
     "local-validator-isolation17.mjs": "48e94604e28b8fddd567dfb35ff60b73fd094a5803bd49f076388b7f310f92aa",
     "local-calctool-composition17.mjs": "ac89fcb41ab0d0d9b47c1b5696945281b0894eb064820775e36a011c76314e6a",
-    "cli.mjs": "74b72be1190c4ff79279a8b911a85cc654ea860574691eb79eefb5fbab4a6fbe",
+    "cli.mjs": "d0f29034c812f6d2ebfecdfcddacce70334ab379e3d25dc673a72ece817a977c",
+    "ide-exit.mjs": "c890c7b34fa6f12e0ccff7a7b85738d515fb13ad93f671a8547ae6570b66488d",
     "install-cleanup.mjs": "8a8e1a7dfe37427f86cd4d6e317890d0829894a9949d4216674a716b36edbc54",
     "review-client.mjs": "3491eef68ed533174b31db3c53febb6519b8f088f71a9964644714a9a4c03c77",
     "version.mjs": "1f392147d72c40af4b03b307ea607075fb815af5174fa07e254b95fe12dbf3e7",
-    "SKILL.md": "96f83041a2f9933876e6a94f487e472e95d029251375449336ae4fc535801ef9",
-    "CAPABILITY-MAP.md": "0e85f26ebf2a5be5e6e5d2af66f910db03c69cb268edad1b2541dd3834991f90",
+    "SKILL.md": "f6e8b3f64d102063b8e6e263b3422563ed3dd4781c7dd5c46a1c6bccef02ffad",
+    "CAPABILITY-MAP.md": "e420bbc202c27d983635ae33b823b39dd445cf5cdf40ffe88e210a755cb7424d",
     "AGREEMENT.md": "f93a68e92c457200dd024610e65f74e478b8f60860f951da818b70561f1b9bf8",
     "DELIVERY-BOUNDARIES.md": "9b9db50ed1bcce9e77ff6527b6bb7eaf12f3b913162ea9cb7fe90db06b393a4f",
-    "package.json": "3fbb42236d00d8c5a92c1cc4c75de4cea0581b8ee22721fe57aa760513744787",
+    "package.json": "5da583a9c348c5acedbd8a97c9ed0b3ba3844bb8b6445c7b3d78690981f612ba",
     "manifest.json": "ab06e307795bc9da5add926752b6c4dbdaf18625090261a035aa356a679c504f",
-    "release.mjs": "a0693132999f5be6030761c3992071d7416a75471f6b73bdd720d52f55ea3c3f",
+    "release.mjs": "b404798d90a4447740857a58a7656ecd80b51c36971561d822961913793e101b",
     "local-cli.mjs": "41e2a737c8587cb5ce469a7661f6d14b5ea4cd073f8286822fc4dc96b67f56a1",
     "local-state-lock.mjs": "1dbf64264642a0851faf043e07ee9f66d2ad0508e9f799b0626246e42fae893e",
     "local-execution.mjs": "185f34e917440a360b3c4bafd3af245243807d964ae3820b3cffaaa2e6348cc6",
@@ -169,7 +170,7 @@
     "local-budget-git-system-attributes.mjs": "367a4e5a88490c4d4c3717bc893a271970fe70d7705f0c1c72d6f76a442d5d21",
     "runtime/git-native-linux-v1.mjs": "cf5cb91426a105e62c0f07a8a230dec592dba46f85a3f708b4c4e8cfcd1126c6",
     "runtime/git-native-darwin-v1.mjs": "f88aab72dc86f94eb1115784872957cb8ed0f74205ae70e1ecd1939e7790e310",
-    "local-scope-signature.mjs": "bd05e8cf9e23f9511a16844974362297b9e9d11930ff7b8ad2a490e8d7660fe9",
+    "local-scope-signature.mjs": "c4c1551c66bb276bf44c66d8e96f3cacc6edac48f6599ad964cd67f5e18110ac",
     "local-scope-config-imports.mjs": "a399407227bbdd14468633bb6d25586df7c6a30a1ef0d1a80ab7c7b499d3fadf",
     "local-scope-config-extends.mjs": "3ab4150b846b247e9e0851221123f220c5574699af651830e751f026ab33659e",
     "local-scope-snapshot.mjs": "c0f851470b98863a1d187825ed61ee6072d1c057b178fdc85ae29af02a3b250f",
@@ -179,6 +180,13 @@
     "remote-client.mjs": "0d1ec6506fe53a1e33c31c5ba19d14e30e00e85e11eaf7ff8277ea798b9f36c9",
     "cloud-task-client.mjs": "11acb1a033c94cdfbdfb177a3402ad97f6a5226f577138c8cf6395dc3ebb1a39",
     "scope-runner-client.mjs": "2afcbb8bc8a26d03f26787cb2ffd9994c4377757d16d54aa0c83752a29e833ea",
+    "scope-amendment-client.mjs": "2161daaee131cc209d7ab75cde91a920cbca98153e7e7fd058ba5aacdf6789a3",
+    "scope-amendment-state.mjs": "045375115cdca8c265f1bfd14d5cb052fcd24a97c5cc1e50a44a6f6725319698",
+    "scope-amendment-wire.mjs": "bc4c80fda3154b7151006f7bed6cc0884050868e7ba936309b6516ed5c20512f",
+    "scope-amendment-remote.mjs": "e73bc3e67b8adb663d679cdcc46f0f1a18529d0bf14dd1f6cdf21ad87ead7c71",
+    "scope-amendment-observer.mjs": "6c0539e4ac0f738939a169826400d822d68c1e70ca2d87a9fe10a26945158770",
+    "scope-amendment-mutation.mjs": "9b120b60aef4d04790a75d599595c5251649b843996f66ebe02e9ac40ffb99b2",
+    "scope-amendment-reference.mjs": "0537e53a1bea4b695f4804c5051261778c88f05b1ae4aff86c709dcfe83aa148",
     "native-client.mjs": "6f5575909bae9daba643287f876ffa0f9ff1c53a367b32a40145d740456d6605",
     "native-notification.mjs": "8859a26c6f13d222711f763acf49ed8546b3306cf71f990643ac31a5ccaf1ba1",
     "local-peer-status.mjs": "a971bcc69d60bb32b875ca5bb4297d948631d5d2821b812c279613ea059a8b4f",
@@ -203,8 +211,8 @@
     "local-task-handoff-read-authority.mjs": "7d2991cfac4562039232566d25441aa98106ce27bc9b7bcf6df4ff28d738e167",
     "local-task-handoff-write-archive.mjs": "3668f39d8ab5664ed717994cf1b4bcc7ea23e146a0e06291f851d30337faeb77",
     "local-task-handoff-write-receipts.mjs": "e1321127bd6fcad7840e185639f81ae68a8722a0ee4264a7b504a02b27887647",
-    "workflow-local-runner.mjs": "baeb0178aa9260f2e02c5c8bc3f1a4934827a5552d0db18fe8ad6acfee579459",
-    "workflow-local-contracts.mjs": "ed7807c6230c3f9a2bd7c7a0ca255aec5e8e922fe71a75b95904d87709a615b6",
+    "workflow-local-runner.mjs": "dc26f408178f145cbecda7b65add6956c897b952cfa74a77474471d3b97bead1",
+    "workflow-local-contracts.mjs": "2ab69043b498dad007e46fa5b4cbda6bffb6720652b970c3dec7f2825175ef87",
     "workflow-local-client.mjs": "45c954f694d96bf0ea87ee2dc6902a6763dac2cb1df713b6a5e749632054e9af",
     "workflow-local-request.mjs": "4e24c543ce386292a87dc9cd41f90d23375f12079cacffc515c8cd01fd571780",
     "task-message-entry.mjs": "31d10056cb905237cd5649e8eb067009ff1612ec5dc1061e0373209fbc0b646a",
@@ -239,10 +247,10 @@
     "local-mutation-files.mjs": "087b00e8424a135e783eb432271012a71e55eeb4a5e30119490d1bc0b2160320",
     "local-mutation-snapshot.mjs": "f9077539680fb8d3ff33a962657756a8fe6afa8409b6191334509534216ebfe8",
     "local-mutation-audit.mjs": "5a30ee3446f632e032ffcfe46bcd97d6dfc0f099a76ea5185c3f9a9118c4f6cb",
-    "local-mutation-wire.mjs": "52f3e4bd90e246abd47163199fed508d9a243770580bb8617bbf58f1da28e01f",
+    "local-mutation-wire.mjs": "fe251b3112d2394c5a0ab108f067ec17fb8569db7be9b3ceb86fab25c68e98e9",
     "local-mutation-binding.mjs": "4440d792453a07a375b635fa5a91db607e58162824baced5c79a9a513f4ec918",
     "local-mutation-pass-store.mjs": "1edc5fcc537dfa04b8ae8b07af554d61ea5911a5da281423ad57214ccf753ad4",
-    "local-mutation-authority.mjs": "ebac0cc8126969bafb0aaaeacf71e05124997d5c3214f8ec32b7a4fa14569bcf",
+    "local-mutation-authority.mjs": "e6b79430ee6b5eb28173843a5faaf1c277da1e5ca7c1dcbd6d96cd60c4460c59",
     "local-mutation-batch.mjs": "de27686b5f99a99b02f0218a3fa159e9469d6b19c595117287d6dd37a6efcb3b",
     "local-mutation-batch-receipt.mjs": "b0e6a8522867255d899e60b66677885933f6a1c4c771cbb52f84dbbbdcf5e5c2",
     "calctool-runtime-entry.mjs": "98d2bc8df38d16131fc56db0a3d4d260531ba4df412baa5ddc4b8b5c5ca99fe9",

package/release.mjs

@@ -68,7 +68,7 @@ const sourceFiles = [
   'local-merge-transaction.mjs',
   ...swarmSourceFiles,
   ...coordination17SourceFiles,
-  'cli.mjs', 'install-cleanup.mjs', 'review-client.mjs', 'version.mjs', 'SKILL.md', 'CAPABILITY-MAP.md', 'AGREEMENT.md', 'DELIVERY-BOUNDARIES.md',
+  'cli.mjs', 'ide-exit.mjs', 'install-cleanup.mjs', 'review-client.mjs', 'version.mjs', 'SKILL.md', 'CAPABILITY-MAP.md', 'AGREEMENT.md', 'DELIVERY-BOUNDARIES.md',
   'package.json', 'manifest.json', 'release.mjs',
   'local-cli.mjs', 'local-state-lock.mjs', 'local-execution.mjs', 'local-integrity.mjs', 'local-evidence-verification.mjs', 'local-formula.mjs', 'local-ledger.mjs',
   'local-error.mjs',
@@ -118,6 +118,9 @@ const sourceFiles = [
   'local-scope-workspaces.mjs',
   'local-task-routing.mjs', 'remote-client.mjs', 'cloud-task-client.mjs',
   'scope-runner-client.mjs',
+  'scope-amendment-client.mjs', 'scope-amendment-state.mjs', 'scope-amendment-wire.mjs',
+  'scope-amendment-remote.mjs', 'scope-amendment-observer.mjs', 'scope-amendment-mutation.mjs',
+  'scope-amendment-reference.mjs',
   'native-client.mjs', 'native-notification.mjs', 'local-peer-status.mjs',
   'cloud-watch-client.mjs', 'cloud-event-stream.mjs', 'ide-presentation.mjs', 'automatic-feedback-client.mjs',
   'task-entry-client.mjs', 'task-identity.mjs', 'task-identity.d.mts',
@@ -292,6 +295,10 @@ const taskEntryReleaseLabels = {
 }
 
 function releaseNote(changed) {
+  if (changed.some(file => file.startsWith('scope-amendment-'))) return {
+    zh: '新增同一任务的精确范围补正：原账号审核文件哈希与写入/只读角色，原S签名真实事实并重评原合同；计划、写入和结算绑定不可变范围修订，改后刷新保留原M消费证据与失败历史。',
+    en: 'Add same-task exact scope amendment with original owner review of file hashes and write/read-only roles, original S observations and native contract reassessment; bind plans, writes and settlement to immutable scope revisions and retain actual M consumption and failure history during post-write refresh.',
+  }
   const suppliedZh = process.env.ENTROROVE_RELEASE_NOTE_ZH?.trim()
   const suppliedEn = process.env.ENTROROVE_RELEASE_NOTE_EN?.trim()
   if (Boolean(suppliedZh) !== Boolean(suppliedEn)) {
@@ -330,6 +337,7 @@ function releaseLabels() {
     'blueprint-criterion-wire.mjs': { zh: '蓝图验收标准执行授权', en: 'Blueprint criterion execution authority' },
     'blueprint-criterion-runner.mjs': { zh: '蓝图验收标准实际执行器', en: 'Blueprint criterion process runner' },
     'cli.mjs': { zh: '技能运行和受管安装', en: 'skill runtime and managed installation' },
+    'ide-exit.mjs': { zh: '当前 IDE 会话明确退出', en: 'explicit exit for the current IDE session' },
     'install-cleanup.mjs': { zh: '旧版受管安装清理', en: 'managed installation cleanup' },
     'version.mjs': { zh: '版本安全检查', en: 'version safety checks' },
     'SKILL.md': { zh: 'IDE 工作流程说明', en: 'IDE workflow instructions' },

package/releases.json

@@ -1,4 +1,16 @@
 [
+  {
+    "version": "0.1.60",
+    "date": "2026-10-17",
+    "zh": "修复范围补正误用独立交接的完整依赖校验，接收原账号签名器的真实受限扫描并保留未解析依赖、原审批与预算；新增当前 IDE 会话离线 exit，识别明确停用决定并保持退出状态，不再要求重建流程。",
+    "en": "Fix scope amendments to verify the original member signer wire receipt while preserving unresolved imports, owner approval and native budgets. Add offline exit for the current IDE session, recognize explicit stop decisions and preserve exited governance without requiring a replacement flow."
+  },
+  {
+    "version": "0.1.59",
+    "date": "2026-10-17",
+    "zh": "新增同一任务的精确范围补正：原账号审核文件哈希与写入/只读角色，原S签名真实事实并重评原合同；计划、写入和结算绑定不可变范围修订，改后刷新保留原M消费证据与失败历史。",
+    "en": "Add same-task exact scope amendment with original owner review of file hashes and write/read-only roles, original S observations and native contract reassessment; bind plans, writes and settlement to immutable scope revisions and retain actual M consumption and failure history during post-write refresh."
+  },
   {
     "version": "0.1.58",
     "date": "2026-10-17",

package/scope-amendment-client.mjs

@@ -0,0 +1,123 @@
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { canonical, sha256 } from './local-integrity.mjs';
+import { withStateLock } from './local-state-lock.mjs';
+import { atomicMutationJson14, readMutationJson14 } from './local-mutation-files.mjs';
+import { bootstrapCloudMutationAuthority } from './cloud-mutation-authority.mjs';
+import { amendmentInput, amendmentFail, scopeAmendmentChallenge, scopeRevisionAuthority } from './scope-amendment-wire.mjs';
+import { scopeAmendmentLocation, readScopeAmendmentState, saveScopeAmendmentState } from './scope-amendment-state.mjs';
+import { amendmentRemote, scopeAmendmentStatus } from './scope-amendment-remote.mjs';
+import { observeScopeAmendment } from './scope-amendment-observer.mjs';
+import { retainScopeAmendmentReference } from './scope-amendment-reference.mjs';
+
+const schemaVersion = 'entrorove.scope-amendment-connection/1.0';
+function validateProposal(status, input) {
+  const proposal = status.proposal;
+  if (!proposal || proposal.proposalId !== input.proposalId || proposal.proposalDigest !== input.proposalDigest
+    || !['pending', 'approved', 'declined'].includes(proposal.approval)) amendmentFail('Current account has no matching original scope proposal');
+  return proposal;
+}
+function validateApplied(output, state, location) {
+  const effective = output.effectiveAuthority, record = scopeRevisionAuthority(effective?.record, 'entrorove.scope-revision-authority/1.0');
+  const challenge = scopeAmendmentChallenge(state.challenged.challenge, location, { allowExpired: true }), refresh = challenge.purpose === 'scope-revision-refresh';
+  if (output.status !== 'succeeded' || output.grantsExecutionAuthority !== false || output.claimsCompletion !== false
+    || output.scopeRevisionDigest !== sha256(canonical(record)) || effective.revisionDigest !== output.scopeRevisionDigest
+    || output.revision !== effective.revision || record.revision !== effective.revision
+    || ['flowId', 'proposalId', 'proposalDigest', 'ownerId', 'taskDigest', 'chainDigest', 'originalBindingDigest']
+      .some(field => record[field] !== challenge[field])
+    || record.scope?.keyId !== location.binding.keyId || record.scope?.runnerId !== location.binding.runnerId
+    || record.scope?.repositoryId !== location.binding.repositoryId
+    || canonical(record.files.map(file => ({ ...file, sha256: null }))) !== canonical(challenge.files.map(file => ({ ...file, sha256: null })))) {
+    amendmentFail('Applied scope amendment lost its signed original authority or exact roles');
+  }
+  const fact = refresh ? scopeRevisionAuthority(effective.fact, 'entrorove.scope-revision-facts/1.0') : record;
+  if (refresh && (fact.scopeRevisionDigest !== output.scopeRevisionDigest || fact.factRevision !== challenge.expectedFactRevision
+    || ['flowId', 'ownerId', 'taskDigest', 'chainDigest'].some(field => fact[field] !== challenge[field]))
+    || canonical(fact.candidateAttestation) !== canonical(state.attestation)
+    || fact.scope?.attestationDigest !== sha256(canonical(state.attestation.scopeAttestation))
+    || effective.factRevision !== (refresh ? fact.factRevision : 0) || output.factRevision !== effective.factRevision) {
+    amendmentFail('Applied scope proof differs from this exact actual signed candidate');
+  }
+  return { schemaVersion, status: 'succeeded', flowId: challenge.flowId, proposalId: challenge.proposalId,
+    proposalDigest: challenge.proposalDigest, scopeRevisionDigest: output.scopeRevisionDigest, revision: output.revision,
+    factRevision: effective.factRevision, grantsExecutionAuthority: false, claimsCompletion: false,
+    ...(refresh && state.attestation.memberMutation ? { localAction: {
+      command: 'npx @entrorove/skill mutation-settle <absolute repositoryRoot>', input: {
+        flowId: challenge.flowId, taskId: state.attestation.memberMutation.consumptionReceipt.taskId,
+        stepId: state.attestation.memberMutation.consumptionReceipt.stepId, gatePassPath: location.identity.gatePassPath } } } : {}),
+    nextStep: output.nextStep, ...(state.feedback ? { feedback: state.feedback } : {}) };
+}
+async function archiveAttempt(location, state) {
+  if (!state.attemptId) return;
+  const archive = path.join(location.directory, `${state.attemptId}.json`);
+  try { if (canonical(await readMutationJson14(archive)) !== canonical(state)) amendmentFail('Original scope amendment attempt history changed'); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; await atomicMutationJson14(archive, state, { privateFrom: location.stateRoot }); }
+  for (const key of Object.keys(state)) if (!['schemaVersion', 'identity'].includes(key)) delete state[key];
+  await saveScopeAmendmentState(location, state);
+}
+async function finish(location, state, dependencies) {
+  if (!state.attestation) {
+    state.attestation = await observeScopeAmendment(location, state);
+    state.attestationDigest = sha256(canonical(state.attestation)); await saveScopeAmendmentState(location, state);
+  }
+  const applied = state.applied ?? await amendmentRemote('applied', 'workflow-scope-apply', {
+    proposalId: location.identity.proposalId, proposalDigest: location.identity.proposalDigest,
+    attestation: state.attestation }, state, location, dependencies);
+  const result = validateApplied(applied, state, location);
+  await retainScopeAmendmentReference(location, applied); return result;
+}
+async function amend(location, dependencies) {
+  const state = await readScopeAmendmentState(location);
+  if (state.pending) {
+    const pending = state.pending;
+    await amendmentRemote(pending.stage, pending.input.operation, pending.input.payload, state, location, dependencies);
+    if (pending.stage === 'applied') {
+      const result = validateApplied(state.applied, state, location);
+      await retainScopeAmendmentReference(location, state.applied); return result;
+    }
+    return finish(location, state, dependencies);
+  }
+  const status = await scopeAmendmentStatus(location.identity.flowId, dependencies), proposal = validateProposal(status, location.identity);
+  if (proposal.approval !== 'approved') return { schemaVersion, status: proposal.approval === 'pending' ? 'needs-input' : 'blocked',
+    flowId: location.identity.flowId, proposalId: proposal.proposalId, proposalDigest: proposal.proposalDigest,
+    grantsExecutionAuthority: false, claimsCompletion: false, nextStep: { operation: 'interaction-answer',
+      requiresOriginalOwnerApproval: true, scopeExpansionAutomaticallyAuthorized: false } };
+  if (state.challenged && !state.applied && !state.rejection) {
+    const challenge = scopeAmendmentChallenge(state.challenged.challenge, location, { allowExpired: true });
+    if (Date.parse(challenge.expiresAt) > Date.now()) return finish(location, state, dependencies);
+    state.rejection = { code: 'ENTROROVE_SCOPE_AMENDMENT_CHALLENGE_EXPIRED', effects: 'none',
+      reason: 'signed-unused-challenge-expired-before-next-post' }; await saveScopeAmendmentState(location, state);
+  }
+  await archiveAttempt(location, state);
+  state.attemptId = randomUUID(); await saveScopeAmendmentState(location, state);
+  const challenged = await amendmentRemote('challenged', 'workflow-scope-challenge', { proposalId: proposal.proposalId,
+    proposalDigest: proposal.proposalDigest, receiverId: location.binding.runnerId, attemptId: state.attemptId }, state, location, dependencies);
+  const challenge = scopeAmendmentChallenge(challenged.challenge, location);
+  if (status.effective ? challenge.purpose !== 'scope-revision-refresh'
+    || challenge.authorityRevisionDigest !== status.effective.revisionDigest || challenge.expectedFactRevision !== status.effective.factRevision + 1
+    || challenge.currentScopeArtifactDigest !== sha256(canonical(status.effective.scope))
+    : challenge.purpose !== 'scope-revision' || challenge.expectedRevision !== proposal.expectedRevision
+      || challenge.previousDigest !== proposal.previousDigest) amendmentFail('Scope amendment challenge has a different original authority head');
+  return finish(location, state, dependencies);
+}
+export async function runScopeAmend(repositoryRoot, input, dependencies) {
+  try {
+    const identity = amendmentInput(input);
+    await dependencies.install();
+    if (!await dependencies.agreementAccepted(dependencies.home)) return dependencies.agreementRequired(dependencies.home);
+    await bootstrapCloudMutationAuthority(dependencies);
+    const location = await scopeAmendmentLocation(repositoryRoot, identity, dependencies);
+    return await withStateLock(location.file, () => amend(location, dependencies));
+  } catch (error) {
+    const requestId = /^[a-f0-9]{64}$/.test(error?.requestId ?? '') ? error.requestId : undefined;
+    return { schemaVersion, status: 'blocked', flowId: input?.flowId,
+      code: error?.code?.startsWith('ENTROROVE_') ? error.code : 'ENTROROVE_SCOPE_AMENDMENT_PREREQUISITE',
+      message: ['ENTROROVE_SCOPE_AMENDMENT_BINDING', 'ENTROROVE_SCOPE_AMENDMENT_STATE', 'ENTROROVE_SCOPE_AMENDMENT_UNKNOWN',
+        'ENTROROVE_SCOPE_AMENDMENT_NOT_SENT'].includes(error?.code) ? error.message
+        : 'Scope amendment stopped; preserve the original proposal, signer, journal and actual evidence.',
+      ...(requestId ? { requestId } : {}), ...(error?.output ? { output: error.output } : {}),
+      ...(error?.feedback ? { feedback: error.feedback } : {}),
+      ...(error?.outcomeUnknown ? { outcomeUnknown: true, nextAction: { operation: 'scope-amend', requestId,
+        method: 'GET', reuseOriginalInput: true, repeatPost: false } } : {}) };
+  }
+}

package/scope-amendment-mutation.mjs

@@ -0,0 +1,26 @@
+import { mutationPass14 } from './local-mutation-wire.mjs';
+import { readMutationJson14 } from './local-mutation-files.mjs';
+import { attestMutationConsumption14 } from './local-mutation-consumption.mjs';
+import { amendmentFail } from './scope-amendment-wire.mjs';
+import path from 'node:path';
+import { sha256 } from './local-integrity.mjs';
+
+export async function scopeAmendmentMutation(location, state, challenge, facts) {
+  const changed = challenge.files.filter(file => file.access === 'write'
+    && facts.files.find(actual => actual.path === file.path)?.sha256 !== challenge.currentFiles.find(current => current.path === file.path)?.sha256);
+  if (!changed.length || challenge.purpose !== 'scope-revision-refresh') return undefined;
+  const gatePassPath = location.identity.gatePassPath;
+  if (!gatePassPath) amendmentFail('Changed write bytes require the exact original stored mutation pass for actual M consumption proof');
+  const gates = path.join(location.stateRoot, 'gates', sha256(location.root).slice(0, 32), challenge.flowId);
+  if (path.dirname(gatePassPath) !== gates || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}\.json$/.test(path.basename(gatePassPath))) {
+    amendmentFail('Scope refresh may read only an original stored pass in this repository and flow');
+  }
+  const pass = mutationPass14(await readMutationJson14(gatePassPath), { live: false });
+  if (['flowId', 'ownerId', 'taskDigest', 'chainDigest'].some(field => pass[field] !== challenge[field])
+    || pass.memberScopeKeyId !== challenge.keyId || pass.memberScopeBindingDigest !== challenge.originalBindingDigest
+    || pass.scopeRevisionDigest !== challenge.authorityRevisionDigest
+    || changed.some(file => !pass.paths.includes(file.path))) amendmentFail('Scope refresh cannot replace its actual original mutation pass or approved write paths');
+  const observed = await attestMutationConsumption14({ repositoryRoot: location.root, home: location.home,
+    flowId: pass.flowId, taskId: pass.taskId, stepId: pass.stepId, gatePassPath }, { allowExpiredReplay: true });
+  return { passId: pass.passId, consumptionReceipt: observed.consumptionReceipt };
+}

package/scope-amendment-observer.mjs

@@ -0,0 +1,63 @@
+import { sign, randomUUID } from 'node:crypto';
+import { canonical, sha256 } from './local-integrity.mjs';
+import { scopeTarget } from './local-scope-files.mjs';
+import { snapshotPlan, snapshotVerify } from './local-execution.mjs';
+import { readScopeSnapshot, verifyFreshScopeSnapshot } from './local-scope-snapshot.mjs';
+import { collectScopeFacts } from './local-scope-repository.mjs';
+import { attestScopeFacts } from './local-scope-signature.mjs';
+import { scopeAmendmentChallenge, amendmentFail } from './scope-amendment-wire.mjs';
+import { saveScopeAmendmentState } from './scope-amendment-state.mjs';
+import { scopeAmendmentMutation } from './scope-amendment-mutation.mjs';
+
+async function inspectFiles(location, challenge) {
+  const physical = new Set();
+  for (const file of challenge.files) {
+    const target = await scopeTarget(location.root, file.path);
+    if (!target.stat.isFile()) amendmentFail('Scope amendment permits only exact existing ordinary files');
+    const identity = `${target.stat.dev}:${target.stat.ino}`;
+    if (physical.has(identity)) amendmentFail('Scope amendment roles cannot alias the same physical file');
+    physical.add(identity);
+  }
+}
+export async function observeScopeAmendment(location, state) {
+  const challenge = scopeAmendmentChallenge(state.challenged.challenge, location);
+  await inspectFiles(location, challenge);
+  if (!state.snapshotId) { state.snapshotId = `scope-amend-${randomUUID()}`; await saveScopeAmendmentState(location, state); }
+  const input = { repositoryRoot: location.root, home: location.home, flowId: challenge.flowId, stepId: challenge.stepId,
+    snapshotId: state.snapshotId, paths: challenge.files.map(file => file.path).sort(),
+    contractDigest: challenge.proposalDigest, importContexts: location.binding.importContexts };
+  if (!state.snapshot) {
+    if (!state.snapshotStarted) {
+      state.snapshotStarted = true; await saveScopeAmendmentState(location, state);
+      try { await snapshotPlan(input); }
+      catch (error) { delete state.snapshotStarted; await saveScopeAmendmentState(location, state); throw error; }
+    }
+    const verified = await snapshotVerify(input);
+    if (verified.verified !== true || verified.receipt.contractDigest !== input.contractDigest) amendmentFail('Actual amendment snapshot did not verify');
+    state.snapshot = verified.receipt; await saveScopeAmendmentState(location, state);
+  }
+  const verified = await snapshotVerify(input), snapshot = await readScopeSnapshot(input, location.root);
+  if (verified.verified !== true || verified.receipt.snapshotDigest !== state.snapshot.snapshotDigest
+    || snapshot.manifest.contractDigest !== input.contractDigest) amendmentFail('Amendment cannot replace its original candidate snapshot');
+  const facts = await collectScopeFacts(location.root, input.paths, undefined, snapshot.known, input);
+  facts.snapshotEvidence = await verifyFreshScopeSnapshot(input, location.root, facts);
+  for (const file of challenge.files) {
+    const actual = facts.files.find(item => item.path === file.path);
+    if (!actual?.exists || (challenge.purpose === 'scope-revision' || file.access === 'read-only') && actual.sha256 !== file.sha256) {
+      amendmentFail('Scope amendment bytes differ from the exact original approved roles');
+    }
+  }
+  const observed = await attestScopeFacts({ ...input, ownerId: challenge.ownerId, taskDigest: challenge.taskDigest,
+    chainDigest: challenge.chainDigest, repositoryId: challenge.repositoryId, challenge: challenge.challenge,
+    signerConfigPath: location.signerConfigPath }, { repositoryRoot: location.root, facts,
+    snapshotDigest: facts.snapshotEvidence.snapshotDigest }, { maximumExpiresAt: Date.parse(challenge.expiresAt) });
+  const memberMutation = await scopeAmendmentMutation(location, state, challenge, facts);
+  const core = { schemaVersion: 'entrorove.scope-revision-attestation/1.0', purpose: challenge.purpose,
+    proposalId: challenge.proposalId, proposalDigest: challenge.proposalDigest, expectedRevision: challenge.expectedRevision,
+    previousDigest: challenge.previousDigest, originalBindingDigest: challenge.originalBindingDigest,
+    ...(challenge.purpose === 'scope-revision-refresh' ? { authorityRevisionDigest: challenge.authorityRevisionDigest,
+      expectedFactRevision: challenge.expectedFactRevision } : {}), scopeAttestation: observed.attestation,
+    ...(memberMutation ? { memberMutation } : {}) };
+  if (Date.parse(observed.attestation.expiresAt) <= Date.now()) amendmentFail('Scope amendment expired before signing');
+  return { ...core, signature: sign(null, Buffer.from(canonical(core)), location.key).toString('base64url') };
+}

package/scope-amendment-reference.mjs

@@ -0,0 +1,35 @@
+import path from 'node:path';
+import { canonical, sha256 } from './local-integrity.mjs';
+import { mutationHome14, privateMutationDirectory14, readMutationJson14, atomicMutationJson14 } from './local-mutation-files.mjs';
+import { scopeRevisionAuthority, amendmentFail } from './scope-amendment-wire.mjs';
+
+async function referenceLocation(root, home, flowId, revisionDigest) {
+  const stateRoot = path.join(await mutationHome14(home), '.entrorove');
+  return { stateRoot, directory: path.join(stateRoot, 'scope-revisions', sha256(root).slice(0, 32), flowId),
+    file: path.join(stateRoot, 'scope-revisions', sha256(root).slice(0, 32), flowId, `${revisionDigest}.json`) };
+}
+export async function retainScopeAmendmentReference(location, output) {
+  const effective = output.effectiveAuthority, target = await referenceLocation(location.root, location.home,
+    location.identity.flowId, output.scopeRevisionDigest);
+  const value = { schemaVersion: 'entrorove.scope-amendment-reference/1.0', input: {
+    flowId: location.identity.flowId, proposalId: location.identity.proposalId, proposalDigest: location.identity.proposalDigest }, record: effective.record };
+  await privateMutationDirectory14(target.directory, { privateFrom: target.stateRoot });
+  try { if (canonical(await readMutationJson14(target.file)) !== canonical(value)) amendmentFail('Scope amendment original authority reference changed'); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; await atomicMutationJson14(target.file, value, { privateFrom: target.stateRoot }); }
+}
+export async function scopeAmendmentRefreshAction(input, pass) {
+  if (!pass.scopeRevisionDigest) return undefined;
+  try {
+    const target = await referenceLocation(input.repositoryRoot, input.home, pass.flowId, pass.scopeRevisionDigest);
+    const reference = await readMutationJson14(target.file);
+    const record = scopeRevisionAuthority(reference.record, 'entrorove.scope-revision-authority/1.0');
+    if (reference.schemaVersion !== 'entrorove.scope-amendment-reference/1.0' || sha256(canonical(record)) !== pass.scopeRevisionDigest
+      || record.flowId !== pass.flowId || record.taskDigest !== pass.taskDigest || record.scope.keyId !== pass.memberScopeKeyId
+      || ['flowId', 'proposalId', 'proposalDigest'].some(field => reference.input[field] !== record[field])) amendmentFail('Stored refresh reference has another original authority');
+    return { command: 'npx @entrorove/skill scope-amend <absolute repositoryRoot>',
+      input: { ...reference.input, gatePassPath: input.gatePassPath }, resumeOriginalFlow: true, requiredBefore: 'mutation-settle' };
+  } catch {
+    return { operation: 'continue', input: { flowId: pass.flowId, operation: 'workflow-scope-status', payload: {} },
+      purpose: 'recover-original-scope-amendment-reference', requiredBefore: 'mutation-settle', grantsExecutionAuthority: false };
+  }
+}

package/scope-amendment-remote.mjs

@@ -0,0 +1,74 @@
+import { canonical } from './local-integrity.mjs';
+import { buildInvocation, invokeRemoteResult } from './remote-client.mjs';
+import { requestTransport, parseTransportResponse } from './remote-transport.mjs';
+import { ideClientHeaders } from './ide-presentation.mjs';
+import { acknowledgeAutomaticFeedback, queryAutomaticFeedback, verifyAutomaticFeedback } from './automatic-feedback-client.mjs';
+import { readInvocations } from './local-invocations.mjs';
+import { saveScopeAmendmentState } from './scope-amendment-state.mjs';
+import { amendmentFail } from './scope-amendment-wire.mjs';
+
+const unknown = requestId => Object.assign(new Error('Scope amendment outcome is unknown; recover the original request with GET only'),
+  { code: 'ENTROROVE_SCOPE_AMENDMENT_UNKNOWN', outcomeUnknown: true, requestId });
+async function recover(pending, dependencies) {
+  try {
+    const origin = dependencies.apiOrigin(), token = await dependencies.readCredential(dependencies.home);
+    const response = await requestTransport(origin, `/api/skill/status/${pending.requestId}`, {
+      headers: { authorization: `Bearer ${token}`, ...ideClientHeaders() } });
+    const result = parseTransportResponse(response, 'original scope amendment status');
+    if (result?.output?.requestId !== pending.requestId || response.status >= 500
+      || ['running', 'pending'].includes(result.output.status)) throw unknown(pending.requestId);
+    result.feedback ??= await queryAutomaticFeedback(pending.requestId, dependencies);
+    verifyAutomaticFeedback(result.feedback, pending.requestId, pending.requestId);
+    result.feedback = await acknowledgeAutomaticFeedback(result.feedback, origin, token, ideClientHeaders());
+    return { response, result };
+  } catch { throw unknown(pending.requestId); }
+}
+async function notSent(pending, home) {
+  try {
+    const rows = (await readInvocations(home)).filter(row => row.kind === 'remote' && row.requestId === pending.requestId);
+    return !rows.length || rows.at(-1).event === 'not-sent';
+  } catch (error) { return error.code === 'ENOENT'; }
+}
+export async function amendmentRemote(stage, operation, payload, state, location, dependencies) {
+  const input = { flowId: location.identity.flowId, operation, payload }, requestId = buildInvocation('continue', input).requestId;
+  let response, result;
+  if (state.pending) {
+    if (state.pending.stage !== stage || state.pending.requestId !== requestId || canonical(state.pending.input) !== canonical(input)) {
+      amendmentFail('Recover the original amendment request before another operation');
+    }
+    ({ response, result } = await recover(state.pending, dependencies));
+  } else {
+    state.pending = { stage, operation: 'continue', input, requestId };
+    await saveScopeAmendmentState(location, state);
+    try { ({ response, result } = await invokeRemoteResult({ operation: 'continue', input }, dependencies)); }
+    catch (error) {
+      if (await notSent(state.pending, dependencies.home)) {
+        delete state.pending; await saveScopeAmendmentState(location, state);
+        throw Object.assign(new Error('Scope amendment was not transmitted; repair its prerequisite and reuse the original input'),
+          { code: 'ENTROROVE_SCOPE_AMENDMENT_NOT_SENT', knownBeforeTransmission: true, requestId });
+      }
+      throw unknown(requestId);
+    }
+  }
+  if (!result?.output || result.output.requestId !== requestId) throw unknown(requestId);
+  const output = result.output;
+  if (result.feedback) state.feedback = result.feedback;
+  if (!response.ok || !['succeeded', 'needs-input'].includes(output.status)) {
+    state.rejection = { requestId, output, ...(result.feedback ? { feedback: result.feedback } : {}) };
+    delete state.pending; await saveScopeAmendmentState(location, state);
+    throw Object.assign(new Error('The original scope amendment was rejected; preserve its exact proposal and evidence'),
+      { code: output.code ?? 'ENTROROVE_SCOPE_AMENDMENT_REJECTED', requestId, output,
+        ...(result.feedback ? { feedback: result.feedback } : {}) });
+  }
+  const value = output.result ?? output;
+  state[stage] = value; delete state.pending;
+  await saveScopeAmendmentState(location, state); return value;
+}
+export async function scopeAmendmentStatus(flowId, dependencies) {
+  try {
+    const { response, result } = await invokeRemoteResult({ operation: 'continue',
+      input: { flowId, operation: 'workflow-scope-status', payload: {} } }, dependencies);
+    if (!response.ok || result?.output?.status !== 'succeeded') throw new Error();
+    return result.output.result ?? result.output;
+  } catch { amendmentFail('Current account cannot read its original live scope revision; no amendment mutation was sent'); }
+}

package/scope-amendment-state.mjs

@@ -0,0 +1,94 @@
+import { constants, promises as fs } from 'node:fs';
+import { createPrivateKey, createPublicKey } from 'node:crypto';
+import path from 'node:path';
+import { canonical, sha256 } from './local-integrity.mjs';
+import { scopeRoot, scopePath, scopeFail } from './local-scope-files.mjs';
+import { retainedScope } from './local-scope-state.mjs';
+import { mutationHome14, mutationFile14, privateMutationDirectory14,
+  readMutationJson14, atomicMutationJson14 } from './local-mutation-files.mjs';
+import { trustedOrigin } from './remote-transport.mjs';
+
+const fail = message => scopeFail('ENTROROVE_SCOPE_AMENDMENT_STATE', message);
+const maximumStateBytes = 1_000_000;
+async function privateItem(file, final = 'file') {
+  const value = await mutationFile14(file, { final });
+  if (process.getuid && value.stat.uid !== process.getuid()
+    || process.platform !== 'win32' && value.stat.mode & 0o077
+    || final === 'file' && (value.stat.nlink !== 1 || value.stat.size > maximumStateBytes)) {
+    fail('Scope amendment controls must be bounded private files owned by the current OS account');
+  }
+  return value;
+}
+async function privateText(file) {
+  const before = await privateItem(file), handle = await fs.open(file, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  try {
+    const opened = await handle.stat(), text = await handle.readFile('utf8'), after = await handle.stat();
+    const latest = await privateItem(file);
+    if ([opened, after, latest.stat].some(stat => ['dev', 'ino', 'size', 'mtimeMs', 'ctimeMs', 'mode']
+      .some(field => stat[field] !== before.stat[field]))) fail('Original scope signer changed while reading');
+    return text;
+  } finally { await handle.close(); }
+}
+const exact = (value, fields) => value && typeof value === 'object' && !Array.isArray(value)
+  && Object.keys(value).sort().join('\0') === [...fields].sort().join('\0');
+export async function scopeAmendmentLocation(repositoryRoot, input, dependencies) {
+  const root = await scopeRoot(repositoryRoot), home = await mutationHome14(dependencies.home);
+  const relative = path.relative(root, home);
+  if (!relative || relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative)) {
+    fail('Scope amendment controls must be outside the observed repository');
+  }
+  const apiOrigin = trustedOrigin(dependencies.apiOrigin()), stateRoot = path.join(home, '.entrorove');
+  const base = path.join(stateRoot, 'scope-runners', sha256(`${apiOrigin}:${input.flowId}:${root}`));
+  const controls = path.join(base, 'identity');
+  for (const directory of [stateRoot, path.dirname(base), base, controls]) await privateItem(directory, 'directory');
+  const binding = JSON.parse(await privateText(path.join(controls, 'binding.json')));
+  if (!exact(binding, ['schemaVersion', 'flowId', 'repositoryRoot', 'apiOrigin', 'targetPaths', 'importContexts',
+    'runnerId', 'repositoryId', 'publicKey', 'keyId']) || binding.schemaVersion !== 'entrorove.local-scope-binding/1.0'
+    || binding.flowId !== input.flowId || binding.repositoryRoot !== root || binding.apiOrigin !== apiOrigin
+    || !Array.isArray(binding.targetPaths) || !binding.targetPaths.length
+    || canonical(binding.targetPaths) !== canonical([...new Set(binding.targetPaths.map(scopePath))].sort())
+    || !Array.isArray(binding.importContexts)) fail('The original scope signer, entry paths or import contexts are unavailable');
+  for (const context of binding.importContexts) {
+    if (!exact(context, ['sourcePrefix', 'configPath'])) fail('Original import context is invalid');
+    scopePath(context.sourcePrefix); scopePath(context.configPath);
+  }
+  const signerConfigPath = path.join(controls, 'signer.json'), config = JSON.parse(await privateText(signerConfigPath));
+  if (!exact(config, ['schemaVersion', 'privateKeyPath', 'keyId', 'receiptTtlMs'])
+    || config.schemaVersion !== 'entrorove.scope-signer/1.0' || config.privateKeyPath !== path.join(controls, 'private.pem')
+    || config.keyId !== binding.keyId || !Number.isSafeInteger(config.receiptTtlMs)
+    || config.receiptTtlMs < 1 || config.receiptTtlMs > 300_000) fail('Original scope signer configuration changed');
+  let key;
+  try { key = createPrivateKey(await privateText(config.privateKeyPath)); }
+  catch (error) { if (error.code?.startsWith('ENTROROVE_')) throw error; fail('Original scope signing key is unavailable'); }
+  const der = createPublicKey(key).export({ type: 'spki', format: 'der' });
+  if (key.asymmetricKeyType !== 'ed25519' || der.toString('base64') !== binding.publicKey
+    || sha256(der) !== binding.keyId) fail('Original scope signing identity changed');
+  const originalStatePath = path.join(stateRoot, 'scope', sha256(root).slice(0, 32), input.flowId, 'state.json');
+  await privateItem(originalStatePath);
+  const saved = await readMutationJson14(originalStatePath);
+  const original = await retainedScope({ repositoryRoot: root, home, flowId: input.flowId,
+    stepId: saved.stepId, snapshotId: saved.originalSnapshot?.snapshotId }, root);
+  if (canonical(original.originalFacts.files.map(file => file.path)) !== canonical(binding.targetPaths)) {
+    fail('Original retained scope no longer matches its frozen entry paths');
+  }
+  const identity = { ...input, repositoryRoot: root, home, apiOrigin, localBindingDigest: sha256(canonical(binding)),
+    originalFactsDigest: original.originalFactsDigest, originalSnapshotDigest: original.originalSnapshot.digest };
+  const directory = path.join(base, 'amendments', sha256(canonical(input)));
+  await privateMutationDirectory14(directory, { privateFrom: stateRoot });
+  return { root, home, stateRoot, directory, file: path.join(directory, 'journal.json'), identity,
+    binding, key, signerConfigPath, original };
+}
+export async function readScopeAmendmentState(location) {
+  let value;
+  try { await privateItem(location.file); value = await readMutationJson14(location.file); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; }
+  if (!value) return { schemaVersion: 'entrorove.scope-amendment-state/1.0', identity: location.identity };
+  if (value.schemaVersion !== 'entrorove.scope-amendment-state/1.0'
+    || canonical(value.identity) !== canonical(location.identity)) fail('Scope amendment journal cannot replace its original task or signer');
+  if (value.attestation && value.attestationDigest !== sha256(canonical(value.attestation))) fail('Stored amendment proof changed');
+  return value;
+}
+export async function saveScopeAmendmentState(location, value) {
+  if (Buffer.byteLength(canonical(value)) > maximumStateBytes) fail('Scope amendment state exceeds its bounded private file limit');
+  return atomicMutationJson14(location.file, value, { privateFrom: location.stateRoot, replace: true });
+}

package/scope-amendment-wire.mjs

@@ -0,0 +1,83 @@
+import { createPublicKey, verify } from 'node:crypto';
+import { canonical, sha256 } from './local-integrity.mjs';
+import { scopePath, scopeFail } from './local-scope-files.mjs';
+import path from 'node:path';
+
+const identifier = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+const hash = /^[a-f0-9]{64}$/;
+export const amendmentFail = message => scopeFail('ENTROROVE_SCOPE_AMENDMENT_BINDING', message);
+export function amendmentExact(value, fields) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || Object.keys(value).sort().join('\0') !== [...fields].sort().join('\0')) amendmentFail('Scope amendment fields are invalid');
+}
+export function amendmentInput(input) {
+  amendmentExact(input, ['flowId', 'proposalId', 'proposalDigest', ...['gatePassPath'].filter(field => Object.hasOwn(input ?? {}, field))]);
+  if (!identifier.test(input.flowId) || !identifier.test(input.proposalId) || !hash.test(input.proposalDigest)) {
+    amendmentFail('Scope amendment requires its exact original flow and proposal identity');
+  }
+  if (Object.hasOwn(input, 'gatePassPath') && !path.isAbsolute(input.gatePassPath ?? '')) amendmentFail('Scope refresh requires its exact absolute original stored mutation pass');
+  return { ...input };
+}
+export function amendmentFiles(files, original) {
+  if (!Array.isArray(files) || !files.length || files.length > 512) amendmentFail('Scope amendment requires a bounded complete exact role list');
+  const requirements = new Set(original?.requirements?.length ? original.requirements.map(item => item.id) : ['task-goal']);
+  for (const file of files) {
+    amendmentExact(file, ['path', 'sha256', 'access', 'requirementRefs', 'reason']); scopePath(file.path);
+    if (!hash.test(file.sha256) || !['write', 'read-only'].includes(file.access)
+      || typeof file.reason !== 'string' || !file.reason.trim() || file.reason.length > 2000
+      || !Array.isArray(file.requirementRefs) || !file.requirementRefs.length || file.requirementRefs.length > 512
+      || new Set(file.requirementRefs).size !== file.requirementRefs.length
+      || file.requirementRefs.some(id => !identifier.test(id) || !requirements.has(id))) amendmentFail('Scope amendment role or original requirement changed');
+  }
+  if (new Set(files.map(file => file.path)).size !== files.length) amendmentFail('Scope amendment file roles must be unique');
+  return files;
+}
+export function scopeRevisionAuthority(value, schemaVersion) {
+  if (!value || typeof value !== 'object' || Array.isArray(value) || value.schemaVersion !== schemaVersion) {
+    amendmentFail('Scope amendment requires its signed server authority');
+  }
+  const { authorityReceipt: receipt, ...core } = value, bytes = Buffer.from(canonical(core));
+  let key, der;
+  try {
+    const encoded = process.env.ENTROROVE_WORKFLOW_PLAN_PUBLIC_KEY;
+    der = Buffer.from(encoded ?? '', 'base64'); key = createPublicKey({ key: der, format: 'der', type: 'spki' });
+    if (key.asymmetricKeyType !== 'ed25519' || key.export({ type: 'spki', format: 'der' }).toString('base64') !== encoded) throw new Error();
+  } catch { amendmentFail('Pinned workflow public authority is unavailable'); }
+  amendmentExact(receipt, ['schemaVersion', 'keyId', 'payloadDigest', 'signature']);
+  if (bytes.length > 1_000_000 || receipt.schemaVersion !== 'entrorove.workflow-authority-receipt/1.0'
+    || receipt.keyId !== sha256(der) || receipt.payloadDigest !== sha256(bytes)
+    || typeof receipt.signature !== 'string' || !/^[A-Za-z0-9_-]{86}$/.test(receipt.signature)
+    || Buffer.from(receipt.signature, 'base64url').toString('base64url') !== receipt.signature
+    || !verify(null, bytes, key, Buffer.from(receipt.signature, 'base64url'))) amendmentFail('Scope amendment authority signature changed');
+  return value;
+}
+export function scopeAmendmentChallenge(value, location, { allowExpired = false } = {}) {
+  const challenge = scopeRevisionAuthority(value, 'entrorove.scope-revision-challenge/1.0');
+  const refresh = challenge.purpose === 'scope-revision-refresh';
+  if (!refresh && challenge.purpose !== 'scope-revision') amendmentFail('Scope amendment challenge has another purpose');
+  const common = ['flowId', 'proposalId', 'proposalDigest'];
+  if (common.some(field => challenge[field] !== location.identity[field])
+    || challenge.runnerId !== location.binding.runnerId || challenge.repositoryId !== location.binding.repositoryId
+    || challenge.keyId !== location.binding.keyId || challenge.receiverId !== location.binding.runnerId
+    || challenge.taskDigest !== location.original.taskDigest || canonical(challenge.task) !== canonical(location.original.originalTask)
+    || !identifier.test(challenge.ownerId) || !identifier.test(challenge.stepId) || !identifier.test(challenge.challengeId)
+    || !identifier.test(challenge.challenge) || !Number.isSafeInteger(challenge.expectedRevision) || challenge.expectedRevision < 0
+    || ['previousDigest', 'originalBindingDigest', 'originalGateDigest', 'baseScopeArtifactDigest', 'chainDigest'].some(field => !hash.test(challenge[field]))) {
+    amendmentFail('Scope amendment challenge replaced its original task, signer or scope identity');
+  }
+  amendmentFiles(challenge.files, location.original.originalTask);
+  if (!Array.isArray(challenge.currentFiles) || challenge.currentFiles.length !== challenge.files.length
+    || !hash.test(challenge.currentScopeArtifactDigest)
+    || new Set(challenge.currentFiles.map(file => file.path)).size !== challenge.files.length) amendmentFail('Scope amendment current facts are invalid');
+  for (const current of challenge.currentFiles) {
+    amendmentExact(current, ['path', 'sha256']);
+    if (!challenge.files.some(file => file.path === current.path) || !hash.test(current.sha256)) amendmentFail('Scope amendment current facts replaced its exact roles');
+  }
+  if (location.binding.targetPaths.some(path => !challenge.files.some(file => file.path === path))) amendmentFail('Scope amendment omitted an original entry');
+  const issued = Date.parse(challenge.issuedAt), expires = Date.parse(challenge.expiresAt);
+  if (!Number.isFinite(issued) || !Number.isFinite(expires) || issued > Date.now() || !allowExpired && expires <= Date.now()
+    || expires <= issued || expires - issued > 90_000) amendmentFail('Scope amendment challenge is expired');
+  if (refresh && (!hash.test(challenge.authorityRevisionDigest) || challenge.authorityRevisionDigest !== challenge.previousDigest
+    || !Number.isSafeInteger(challenge.expectedFactRevision) || challenge.expectedFactRevision < 1)) amendmentFail('Scope proof refresh lost its unchanged authority revision');
+  return challenge;
+}

package/workflow-local-contracts.mjs

@@ -48,6 +48,7 @@ export const WORKFLOW_ACCEPTED_PLAN_SCHEMA = exact({ schemaVersion: { const: 'en
 WORKFLOW_ACCEPTED_PLAN_SCHEMA.properties.verificationMode = enumeration(['independent', 'member-local']);
 WORKFLOW_ACCEPTED_PLAN_SCHEMA.properties.memberScopeKeyId = sha256;
 WORKFLOW_ACCEPTED_PLAN_SCHEMA.properties.memberScopeBindingDigest = sha256;
+WORKFLOW_ACCEPTED_PLAN_SCHEMA.properties.scopeRevisionDigest = sha256;
 WORKFLOW_ACCEPTED_PLAN_SCHEMA.allOf = [{
   if: { properties: { verificationMode: { const: 'member-local' } }, required: ['verificationMode'] },
   then: { properties: { runnerKeyId: { type: 'null' } }, required: ['memberScopeKeyId', 'memberScopeBindingDigest'] },
@@ -63,6 +64,7 @@ export const WORKFLOW_LOCAL_LEASE_SCHEMA = exact({ schemaVersion: { const: 'entr
   verifiedDependencies: { ...boundedArray(exact({ stepId: id, evidenceDigest: sha256 }), 0, 128), uniqueItems: true }, authorityReceipt,
 });
 WORKFLOW_LOCAL_LEASE_SCHEMA.properties.localDependencies = { ...boundedArray(exact({ stepId: id, acceptanceDigest: sha256 }), 0, 128), uniqueItems: true };
+WORKFLOW_LOCAL_LEASE_SCHEMA.properties.scopeRevisionDigest = sha256;
 WORKFLOW_LOCAL_LEASE_SCHEMA.allOf = [{ if: { required: ['localDependencies'] },
   then: { properties: { verifiedDependencies: { type: 'array', maxItems: 0 } } } }];
 export const WORKFLOW_LOCAL_OPERATION_SCHEMA = object({ repositoryRoot: absolutePath, home: absolutePath,

package/workflow-local-runner.mjs

@@ -64,7 +64,7 @@ function lifetime(start, end, max, now, permitExpired = false) {
 }
 function validatePlan(plan) {
   exact(plan, ['schemaVersion', 'planId', 'flowId', 'ownerId', 'taskDigest', 'chainDigest', 'chainRevision', 'acceptedAt', 'expiresAt', 'runnerKeyId', 'steps',
-    ...['verificationMode', 'memberScopeKeyId', 'memberScopeBindingDigest'].filter(field => Object.hasOwn(plan, field)),
+    ...['verificationMode', 'memberScopeKeyId', 'memberScopeBindingDigest', 'scopeRevisionDigest'].filter(field => Object.hasOwn(plan, field)),
     ...(plan.blueprintBinding ? ['blueprintBinding'] : [])], 'ENTROROVE_WORKFLOW_PLAN_FIELDS', 'accepted plan');
   if (plan.blueprintBinding) {
     const binding = exact(plan.blueprintBinding, ['schemaVersion', 'blueprintId', 'revision', 'blueprintSha256', 'machineTasksDigest'],
@@ -80,6 +80,7 @@ function validatePlan(plan) {
     : (plan.verificationMode === undefined || plan.verificationMode === 'independent') && SHA.test(plan.runnerKeyId ?? '')
       && !Object.hasOwn(plan, 'memberScopeKeyId') && !Object.hasOwn(plan, 'memberScopeBindingDigest');
   if (plan.schemaVersion !== WORKFLOW_LOCAL_PLAN_SCHEMA || !SHA.test(plan.taskDigest) || !SHA.test(plan.chainDigest)
+    || Object.hasOwn(plan, 'scopeRevisionDigest') && !SHA.test(plan.scopeRevisionDigest)
     || !validRole || !positive(plan.chainRevision) || !Array.isArray(plan.steps) || !plan.steps.length || plan.steps.length > 128) fail('ENTROROVE_WORKFLOW_PLAN_FIELDS', 'accepted plan contract is invalid');
   for (const field of ['planId', 'flowId', 'ownerId']) safeId(plan[field], field);
   const seen = new Set();
@@ -97,11 +98,12 @@ function validatePlan(plan) {
 }
 function validateLease(lease, plan, stepId) {
   exact(lease, ['schemaVersion', 'leaseId', 'planId', 'planDigest', 'flowId', 'ownerId', 'taskDigest', 'chainDigest', 'chainRevision',
-    'stepId', 'sequence', 'generation', 'issuedAt', 'expiresAt', 'verifiedDependencies'], 'ENTROROVE_WORKFLOW_BINDING', 'local lease');
+    'stepId', 'sequence', 'generation', 'issuedAt', 'expiresAt', 'verifiedDependencies',
+    ...['scopeRevisionDigest'].filter(field => Object.hasOwn(lease, field))], 'ENTROROVE_WORKFLOW_BINDING', 'local lease');
   safeId(lease.leaseId, 'leaseId'); safeId(stepId, 'stepId');
   const step = plan.steps.find(item => item.stepId === stepId);
   if (!step || lease.schemaVersion !== WORKFLOW_LOCAL_LEASE_SCHEMA || lease.stepId !== stepId || lease.sequence !== step.sequence
-    || lease.planDigest !== sha(canonical(plan)) || !positive(lease.generation)
+    || lease.planDigest !== sha(canonical(plan)) || !positive(lease.generation) || lease.scopeRevisionDigest !== plan.scopeRevisionDigest
     || ['planId', 'flowId', 'ownerId', 'taskDigest', 'chainDigest', 'chainRevision'].some(key => lease[key] !== plan[key])) fail('ENTROROVE_WORKFLOW_BINDING', 'lease does not match the exact original plan, task, chain, owner and step');
   if (!Array.isArray(lease.verifiedDependencies) || lease.verifiedDependencies.length !== step.dependsOn.length) fail('ENTROROVE_WORKFLOW_DEPENDENCY', 'cloud verified dependency receipts are required');
   const dependencies = lease.verifiedDependencies.map(item => {