@entrorove/skill 0.1.6 → 0.1.22

package/AGREEMENT.md

@@ -1,6 +1,6 @@
 # entrorove 使用、隐私与广告信息协议
 
-版本：2026-09-29.2
+版本：2026-10-02.1
 
 本协议是首次使用 entrorove 技能时的合并告知与使用条款。只有用户明确选择“同意”后，技能请求才会发送。IDE 的“完全访问”权限只是本地权限，不代表同意本协议。
 
@@ -14,6 +14,7 @@
 
 - 安装包不会因安装本身自动扫描或上传项目文件。只有在发起技能调用时，才会向 entrorove API 发送 IDE 明确组装的请求负载。
 - 账号服务会处理登录邮箱、密钥哈希与前缀、加密保存的完整密钥、会话与安全记录、调用时间/数量，以及用户自愿提交的留言。已登录用户可再次复制自己的完整密钥。
+- 用户主动提交并明确同意公开的 IDE 评价会展示 IDE 名称、评分、评价文字和时间；公开列表最多展示最近 30 条。
 - 当前实现不将项目源文件或技能任务负载写入业务数据库，不出售个人信息。推广选择使用密钥的连续调用时长和调用次数判断展示时机，不分析项目内容或建立跨站画像。
 - 本地同意回执仅保存协议版本、同意结果和时间，不包含邮箱、项目内容或密钥。
 
@@ -40,12 +41,13 @@
 
 # entrorove Terms, Privacy and Advertising Notice
 
-Version: 2026-09-29.2
+Version: 2026-10-02.1
 
 This combined notice applies on first use. A skill request is sent only after an explicit **Accept** choice. Granting an IDE “full access” permission does not accept this agreement.
 
 - **Use and access.** entrorove acts only on tasks, context and permissions supplied by the user and IDE. Elevated permissions may permit file changes, command execution and external calls. Review scope, keep backups and separately confirm consequential actions.
 - **Data.** Installation alone does not scan or upload project files. The account service processes login email, key hashes and prefixes, an encrypted copy of the full key that a signed-in user can copy again, sessions and security records, invocation time/count, and messages submitted voluntarily. Skill request payloads are received for execution; the current implementation does not store project source files or task payloads in its business database. It does not sell personal information. Promotion timing uses consecutive invocation duration and count for the same key, without examining project content or building a cross-site profile.
+- **Public reviews.** An IDE review is published only after the user submits it and explicitly consents to public display; the public list may show the IDE name, rating, review text and timestamp, limited to the latest 30 entries.
 - **Advertising.** A configured message may appear beneath a long-running-task notice. Commercial content carries its configured category label as `【Category】` and includes an HTTPS link. Administrators set active dates, task-duration windows, selection weights and probability bounds. The service adjusts display probability using consecutive invocation duration and count, without inspecting task text or project files. Third-party links are governed by their operators.
 - **Risk.** The skill is provided as available without a guarantee that every result is correct, complete, uninterrupted or fit for a particular purpose. Review and test changes before production use. To the maximum extent permitted by applicable law, entrorove excludes indirect, incidental, special and consequential losses. Nothing excludes non-waivable liability, fraud, wilful misconduct or mandatory consumer rights.
 - **Choice.** Declining prevents the skill request from being sent. Material changes require a new explicit acceptance. Mandatory local laws may provide additional rights. Qualified counsel should review this notice before production release for the actual operating and user jurisdictions.

package/CAPABILITY-MAP.md

@@ -0,0 +1,18 @@
+# v2 capability map (AC-16)
+
+This is the operation-level inventory for the eight legacy domains. `equivalent` means the v2 operation preserves the contract; `narrower` means the operation is available behind a stricter v2 gate or with a smaller side-effect boundary; `uncovered` means the old operation remains intentionally unavailable and callers must receive an explicit unsupported result.
+
+| Legacy domain | Legacy operations | v2 mapping and semantics |
+| --- | --- | --- |
+| aimlock | capabilities, help, intake, classify, scope-contract, skill-route, propose-nodes, accept-nodes, snapshot-plan, mutate-gate, continuity-check, interrupt, keep-alive, delivery-doc, validate-json, snapshot-verify, run-status, chain-plan, chain-status, feedback | `capabilities/help/intake` → equivalent shared discovery; `classify/skill-route/scope-contract/propose-nodes/accept-nodes/continuity-check/validate-json` → equivalent through `task-describe/message-route`; `snapshot-plan/snapshot-verify/mutate-gate/interrupt/keep-alive/run-status/chain-plan/chain-status/feedback/delivery-doc` → narrower through persisted flow state, local guarded writes, cancellation, status, and evidence gates. |
+| blueprint | capabilities, help, intake, validate, compile-inline, acceptance-report | `capabilities/help/intake/validate/compile-inline/acceptance-report` → equivalent through `blueprint` runtime; acceptance evidence is caller supplied and cannot be self-promoted to verified. |
+| calctool | capabilities, help, intake, validate, compile-inline | `capabilities/help/intake/validate/compile-inline` → equivalent through `calctool`; `formula-evaluate/formula-graph/formula-final-gate` → local Decimal execution and final-gate evidence. |
+| swarm | capabilities, help, intake, org-chart, blueprint-bridge, dispatch, claim, report, accept, swarm-status, traffic-light, security-check, validate-json, heartbeat, reclaim | `capabilities/help/intake/org-chart/blueprint-bridge/dispatch/claim/report/accept/swarm-status/traffic-light/security-check/validate-json/heartbeat/reclaim` → narrower through server-routed coordination, bounded worker counts, leases, and persisted reported/verified states. |
+| validator | capabilities, help, intake, plan, validate-structure, security-scan, compliance-audit, functional-verify, verdict | All nine → equivalent through the `validator` runtime; `functional-verify` requires API-side receipt verification and `verdict` cannot turn reported evidence green. |
+| mergeguard | capabilities, help, intake, resolve-propose, ruleguard-scan, ruleguard-compile | All six → equivalent through `mergeguard`; `merge-verified` remains a local operation and fails closed without a valid baseline, evidence, and receipt. |
+| archguard | capabilities, help, intake, contract-create, contract-get, contract-update, template-list, checkpoint, rules-scan, complexity-report, drift-status, ledger-query | All twelve → equivalent through `archguard`; contract writes and ledger records are local and path/baseline bound. |
+| confirm-protocol | capabilities, help, interaction-request, interaction-answer, chat-render, memory-set, memory-list, memory-clear, batch-request, audit-query | All ten → equivalent for pure protocol operations; native/mobile notifier operations remain explicitly planned and are returned as unavailable. High-risk interaction keeps `default: null`, no memory, and no batch approval. |
+
+The local execution surface also covers `snapshot-plan`, `snapshot-verify`, `mutate-gate`, `gate-issue`, `gate-verify`, `guarded-write`, `budget-init`, `budget-context`, `budget-read`, `budget-status`, `budget-extend`, `budget-auto-renew-request`, `budget-auto-renew`, `budget-auto-renew-stop`, `peer-coordinate`, `spawn-bind`, `peer-complete`, `complete`, `lease-verify`, `evidence-sign`, `evidence-verify`, `merge-verified`, `rollback`, `final-gate`, `formula-evaluate`, `formula-graph`, `formula-final-gate`, `calculation-final-gate`, `run-approved-plan`, `branch-create`, `branch-list`, `branch-switch`, `diff-report`, `preflight`, `ledger-query`, `chain-init`, `chain-resume`, `chain-status`, `chain-answer`, `branch-create-virtual`, `chain-ledger-init`, `chain-ledger-status`, `chain-ledger-query`, `probe`, `reassess`, `task-describe`, `message-route`, `message-accept`, and `task-resume`. Local branch operations are virtual ledger records and never create Git branches or worktrees.
+
+The only intentionally uncovered legacy surface is an old notifier or an operation that would execute remote filesystem changes. These are represented as planned or narrowed behavior in capabilities; no adapter may silently substitute a different operation.

package/CHANGELOG.md

@@ -1,5 +1,85 @@
 # Changelog
 
+## 0.1.22 — 2026-10-04
+
+- 完整补齐隔离检测、运行时生成、基线契约、云任务取消与事件流、能力覆盖映射及隐私告知。
+- Completed isolation detection, reproducible runtime generation, baseline contracts, cloud cancellation and event streaming, capability coverage mapping, and privacy notices.
+
+## 0.1.21 — 2026-10-04
+
+- 更新了本地执行闸门与预算。
+- Updated local execution gates and budgets.
+
+## 0.1.20 — 2026-10-04
+
+- 更新了本地状态并发锁、本地执行闸门与预算、执行与链路台账。
+- Updated local state concurrency lock, local execution gates and budgets, execution and chain ledger.
+
+## 0.1.19 — 2026-10-04
+
+- 更新了安装包配置、自动版本与更新日志、本地状态并发锁、本地执行闸门与预算、预算续期确认、本地任务路由。
+- Updated package configuration, automatic versioning and changelog, local state concurrency lock, local execution gates and budgets, budget renewal confirmation, local task routing.
+
+## 0.1.18 — 2026-10-04
+
+- 更新了冻结计划执行器。
+- Updated frozen plan runner.
+
+## 0.1.17 — 2026-10-04
+
+- 更新了本地执行命令、冻结计划执行器。
+- Updated local execution command, frozen plan runner.
+
+## 0.1.16 — 2026-10-04
+
+- 更新了远端恢复客户端。
+- Updated remote recovery client.
+
+## 0.1.15 — 2026-10-04
+
+- 更新了IDE 工作流程说明。
+- Updated IDE workflow instructions.
+
+## 0.1.14 — 2026-10-02
+
+- 更新了本地执行闸门与预算。
+- Updated local execution gates and budgets.
+
+## 0.1.13 — 2026-10-02
+
+- 更新了执行与链路台账、预算续期确认、本地任务路由。
+- Updated execution and chain ledger, budget renewal confirmation, local task routing.
+
+## 0.1.12 — 2026-10-02
+
+- 更新了远端恢复客户端。
+- Updated remote recovery client.
+
+## 0.1.11 — 2026-10-02
+
+- 更新了本地执行闸门与预算。
+- Updated local execution gates and budgets.
+
+## 0.1.10 — 2026-10-02
+
+- 更新了本地执行闸门与预算。
+- Updated local execution gates and budgets.
+
+## 0.1.9 — 2026-10-02
+
+- 更新了自动版本与更新日志、本地执行闸门与预算、证据与回执验签、执行与链路台账、冻结计划执行器。
+- Updated automatic versioning and changelog, local execution gates and budgets, evidence and receipt verification, execution and chain ledger, frozen plan runner.
+
+## 0.1.8 — 2026-10-02
+
+- 恢复本地执行层与质量闭环：快照隔离、签名写入、预算、协作、验证回执、公式和任务路由。
+- Restored the local execution and quality workflow: snapshots, signed writes, budgets, coordination, receipts, formulas, and task routing.
+
+## 0.1.7 — 2026-10-02
+
+- 恢复统一技能全集、本地执行层与安全复制流程。
+- Restored the complete unified skill set, local execution layer, and secure copy flow.
+
 ## 0.1.6 — 2026-09-29
 
 - 配置密钥前检查凭据目录，拒绝符号链接目录，避免密钥写入非预期位置。

package/SKILL.md

@@ -5,7 +5,7 @@ description: An engineering skill that understands a task, chooses a fitting wor
 
 # entrorove · 熵巡
 
-Version: 0.1.6.
+Version: 0.1.22.
 
 Read the user's goal and repository instructions first. Preserve the original task through planning, execution and verification. Use the workflow only where it helps; a small, low-risk edit can proceed directly. Never claim a reported step is a verified result.
 
@@ -13,18 +13,28 @@ Install or update the managed copy with `npx @entrorove/skill install`. The inst
 
 Register or sign in by email at https://entrorove.com. Enter the account key once with `npx @entrorove/skill configure` and `{"token":"..."}` on standard input. The credential persists in the current OS user's restricted local store across skill upgrades. Before asking again, use the stored credential; a missing or invalid credential must be reported explicitly. Never place the key in arguments, URLs, project files or logs. entrorove accounts and keys are independent of other services.
 
-On first use or after a material agreement revision, the CLI returns a Confirm Protocol-compatible agreement interaction. Render it with the IDE's native confirmation UI, or show its `chatFallback` text when no adapter exists. The user must explicitly accept with `npx @entrorove/skill agreement` and JSON `{"version":"2026-09-29.2","answer":"accept"}` on standard input before retrying the skill request. A full-access IDE permission never counts as agreement acceptance. The combined terms, privacy and advertising notice is installed as `AGREEMENT.md`.
+On first use or after a material agreement revision, the CLI returns a Confirm Protocol-compatible agreement interaction. Render it with the IDE's native confirmation UI, or show its `chatFallback` text when no adapter exists. The user must explicitly accept with `npx @entrorove/skill agreement` and JSON `{"version":"2026-10-02.1","answer":"accept"}` on standard input before retrying the skill request. A full-access IDE permission never counts as agreement acceptance. The combined terms, privacy and advertising notice is installed as `AGREEMENT.md`.
 
 ## Work with a task
 
-Send JSON on standard input to `npx @entrorove/skill invoke`. Start with `operation: "start"` and an `input.task` containing the goal, work type, risk, difficulty and observed scope facts. Work types are `implementation`, `documentation`, `calculation`, `merge`, `review` and `decision`. Assess facts from the real task and repository; do not invent certainty. entrorove chooses the workflow. A small task may return `decision: "direct"`, meaning the IDE should do the work without another service call.
+Send JSON on standard input to `npx @entrorove/skill invoke`. Call `operation: "capabilities"` with `{}` first when an adapter needs the live operation and schema list. Adapters that expose the four-step task route can call `task-describe`, `message-route`, `message-accept` and `task-resume` in order; `start` remains the one-call workflow equivalent. Then start with `operation: "start"` and an `input.task` containing the goal, work type, risk, difficulty and observed scope facts. Work types are `implementation`, `documentation`, `calculation`, `merge`, `review`, `decision` and `diagnosis`. Assess facts from the real task and repository; do not invent certainty. entrorove chooses the workflow. A small task may return `decision: "direct"`, meaning the IDE should do the work without another service call. The public envelope is `entrorove.skill.request/2.0`; `requestId` is the SHA-256 digest of `operation + canonical(input)`. Version 1.0 remains accepted for older callers.
 
 ```json
 {"operation":"start","input":{"task":{"goal":"Update the checkout flow and verify it","workType":"implementation","risk":"medium","difficulty":"medium","crossModule":true,"parallel":false,"unclear":false,"architectureContract":false}}}
 ```
 
+For `workType: "merge"`, include `baselineRef` with the concrete branch, tag, commit, or review baseline used for comparison. The API rejects a merge plan without it, and the baseline must remain unchanged through verification. For `workType: "decision"`, include the structured `interaction`; elevated-risk decisions also require `riskDescription`.
+
+The v2 capability map is recorded in [`CAPABILITY-MAP.md`](CAPABILITY-MAP.md). It maps every legacy domain and operation to its v2 equivalent, narrower semantics, or an explicitly documented uncovered area; adapters must not silently substitute an uncovered operation.
+
 For a returned `flowId`, continue with `{"operation":"continue","input":{"flowId":"<returned ID>","operation":"<next operation>","payload":{}}}`. Fill `payload` with the next operation's required input. Keep the same task and evidence in the IDE. For later work, `input.task.phase` may be `plan`, `coordinate`, `architecture`, `verify`, `merge` or `decision`; it remains the same skill entry point. Never treat an unknown request outcome as permission to retry a paid or mutating action; query the original request ID when the workflow supports it.
 
+The v2 progress sequence is durable and ordered: the first runtime step reports `intake`, then the applicability `gate` is recorded and verified, then the selected contract or plan steps run. Every step can be `pending`, `running`, `reported`, `verified`, `blocked` or `failed`; only a completed verdict with trusted evidence is green.
+
 For a decision, include `input.task.interaction` with `type` (`confirm`, `choice`, `multi` or `input`), a `question`, `options` (two or more with unique `id` and `label`, or an empty array for input), and a `callback` containing its `operation` and `payload`. Medium- and high-risk decisions also need a `riskDescription`. The decision waits for an explicit answer; it never chooses a default on timeout.
 
+Use `npx @entrorove/skill status <requestId>` after a connection loss. It performs a read-only GET lookup and never resends a POST. Use `npx @entrorove/skill flows` to list recoverable flow steps. A v2 flow has its own `flowId` and progresses through `pending`, `running`, `reported`, `verified`, `blocked` or `failed`; a reported result is not a verified result.
+
+The local execution layer is available through `npx @entrorove/skill local <operation> [repositoryRoot]` with a JSON object on standard input. `local capabilities` lists the complete contract. Operations include `snapshot-plan`, `snapshot-verify`, `mutate-gate`, `gate-issue`, `gate-verify`, `guarded-write`, `budget-init`, `budget-context`, `budget-read`, `budget-status`, `budget-extend`, budget renewal confirmation, `peer-coordinate`, `spawn-bind`, `peer-complete`, `lease-verify`, `probe`, `reassess`, execution ledger and virtual branch records, `chain-init`, `chain-resume`, `chain-status`, `chain-answer`, `evidence-sign`, `evidence-verify`, `merge-verified`, `rollback`, `formula-evaluate`, `formula-graph`, `formula-final-gate`, `run-approved-plan` and `final-gate`. State is kept only under `~/.entrorove/`; snapshots never create Git branches or worktrees. Guarded writes require a short-lived Ed25519 pass bound to the flow, step, snapshot digest and path set. Local evidence uses `entrorove.test-evidence/2.0`; unsigned local evidence remains incomplete and verified delivery requires a trusted receipt. Approved plan execution requires a frozen plan, matching approval and unchanged files; without a configured runner signer it reports local evidence as incomplete.
+
 When the user gives an actual evaluation after using the skill, offer to publish that feedback. Only after they explicitly agree to public display, send their own words, IDE name and 1–5 rating as JSON on standard input to `npx @entrorove/skill review` with `publicConsent: true`. Never invent, rewrite or infer a review from task completion. The website reads accepted reviews directly from entrorove's independent database.

package/cli.mjs

@@ -6,24 +6,24 @@ import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { compareVersions } from './version.mjs';
-
+import { runLocal } from './local-cli.mjs';
+import { apiUrl, buildInvocation, invokeRemote, queryFlows, queryStatus } from './remote-client.mjs';
 const packageDir = path.dirname(fileURLToPath(import.meta.url));
-const apiUrl = 'https://entrorove.com/api/skill/invoke';
 const reviewUrl = 'https://entrorove.com/api/ide-reviews';
 const markerName = '.entrorove-managed.json';
 const installFiles = ['SKILL.md', 'AGREEMENT.md', 'manifest.json'];
 const markerSchema = 'entrorove.managed-install/1.0';
 const credentialSchema = 'entrorove.credential/1.0';
 const agreementSchema = 'entrorove.agreement-acceptance/1.0';
-const invocationTimeoutMs = 135_000;
 const installLockWaitMs = 10_000;
 const installLockStaleMs = 120_000;
-export const agreementVersion = '2026-09-29.2';
+export const agreementVersion = '2026-10-02.1';
 
 function sha256(content) {
   return createHash('sha256').update(content).digest('hex');
 }
 
+
 async function readJson(file) {
   const value = JSON.parse(await fs.readFile(file, 'utf8'));
   if (!value || typeof value !== 'object' || Array.isArray(value)) {
@@ -38,7 +38,7 @@ async function sourceBundle() {
   if (manifest.schemaVersion !== 'entrorove.skill-manifest/1.0'
     || manifest.name !== 'entrorove'
     || manifest.endpoint !== 'https://entrorove.com'
-    || manifest.requestSchemaVersion !== 'entrorove.skill.request/1.0'
+    || !['entrorove.skill.request/1.0', 'entrorove.skill.request/2.0'].includes(manifest.requestSchemaVersion)
     || !/^\d+\.\d+\.\d+$/.test(manifest.version)
     || packageMetadata.name !== '@entrorove/skill'
     || packageMetadata.version !== manifest.version) {
@@ -326,7 +326,7 @@ async function preparePrivateDirectory(parent) {
 }
 
 async function writeCredential(token, home) {
-  if (typeof token !== 'string' || !/^ent_[A-Za-z0-9_-]{16,256}$/.test(token)) {
+  if (typeof token !== 'string' || !/^ent_[A-Za-z0-9_-]{43}$/.test(token)) {
     throw new Error('Invalid entrorove key');
   }
   const file = credentialPath(home);
@@ -353,7 +353,7 @@ async function readCredential(home) {
   if (process.platform !== 'win32' && (stat.mode & 0o077) !== 0) throw new Error('Credential permissions must be 0600');
   const data = await readJson(file);
   if (data.schemaVersion !== credentialSchema || typeof data.token !== 'string'
-    || !/^ent_[A-Za-z0-9_-]{16,256}$/.test(data.token)) throw new Error('Invalid credential file');
+    || !/^ent_[A-Za-z0-9_-]{43}$/.test(data.token)) throw new Error('Invalid credential file');
   return data.token;
 }
 
@@ -396,43 +396,17 @@ async function writeAgreementAcceptance(data, home) {
   return true;
 }
 
-export function buildInvocation(operation, input) {
-  if (operation !== 'start' && operation !== 'continue') throw new Error('Invalid entrorove operation');
-  if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('Input must be a JSON object');
-  const requestId = randomUUID();
-  return { url: apiUrl, requestId, body: { schemaVersion: 'entrorove.skill.request/1.0', requestId, operation, input } };
+export { buildInvocation };
+
+function remoteDependencies() {
+  return {
+    install, agreementAccepted, agreementRequired, readCredential, home: os.homedir(),
+    apiOrigin: () => new URL(apiUrl).origin,
+  };
 }
 
 async function invoke(data) {
-  await install();
-  if (!await agreementAccepted(os.homedir())) {
-    process.stdout.write(JSON.stringify(agreementRequired(os.homedir())) + '\n');
-    process.exitCode = 2;
-    return;
-  }
-  const call = buildInvocation(data.operation, data.input);
-  const token = await readCredential(os.homedir());
-  let response;
-  try {
-    response = await fetch(call.url, {
-      method: 'POST', redirect: 'error', signal: AbortSignal.timeout(invocationTimeoutMs),
-      headers: { 'content-type': 'application/json', authorization: `Bearer ${token}` },
-      body: JSON.stringify(call.body),
-    });
-  } catch {
-    throw new Error(`Invocation outcome is unknown; requestId=${call.requestId}. Do not automatically resend this request.`);
-  }
-  if (!response.ok) throw new Error(`entrorove invocation failed: HTTP ${response.status}; requestId=${call.requestId}`);
-  let result;
-  try {
-    result = await response.json();
-  } catch {
-    throw new Error(`Invocation outcome is unknown; requestId=${call.requestId}. Do not automatically resend this request.`);
-  }
-  if (result?.ok !== true || result.output?.requestId !== call.requestId) {
-    throw new Error(`Invalid entrorove response; requestId=${call.requestId}`);
-  }
-  process.stdout.write(JSON.stringify(result) + '\n');
+  return invokeRemote(data, remoteDependencies());
 }
 
 export function buildReview(data) {
@@ -486,11 +460,28 @@ async function main() {
     await invoke(await stdinJson());
   } else if (command === 'review' && args.length === 0) {
     await submitReview(await stdinJson());
+  } else if (command === 'status' && args.length === 1) {
+    await install();
+    if (!await agreementAccepted(os.homedir())) {
+      process.stdout.write(JSON.stringify(agreementRequired(os.homedir())) + '\n');
+      process.exitCode = 2;
+      return;
+    }
+    await queryStatus(args[0], remoteDependencies());
+  } else if (command === 'flows' && args.length === 0) {
+    await install();
+    if (!await agreementAccepted(os.homedir())) {
+      process.stdout.write(JSON.stringify(agreementRequired(os.homedir())) + '\n');
+      process.exitCode = 2;
+      return;
+    }
+    await queryFlows(remoteDependencies());
+  } else if (command === 'local') {
+    await runLocal(args);
   } else {
-    throw new Error('Usage: entrorove install | configure | agreement | invoke | review (JSON on stdin)');
+    throw new Error('Usage: entrorove install | configure | agreement | invoke | status <requestId> | flows | review | local (JSON on stdin)');
   }
 }
-
 if (process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) {
   main().catch((error) => {
     process.stderr.write(`${error.message}\n`);

package/local-approved-plan.mjs

@@ -0,0 +1,81 @@
+import { createHash, createPrivateKey, createPublicKey, randomUUID, sign } from 'node:crypto';
+import { spawn } from 'node:child_process';
+import { promises as fs, constants } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { performance } from 'node:perf_hooks';
+
+export const RUNNER_SCHEMA = 'entrorove.validator-local-runner/1.0';
+export const PLAN_SCHEMA = 'validator.execution-plan/1.0';
+export const APPROVAL_SCHEMA = 'validator.runner-approval/1.0';
+export const SIGNER_SCHEMA = 'validator.runner-signer/1.0';
+export const RECEIPT_SCHEMA = 'validator.execution-receipt/1.0';
+export const RUNNER_LIMITS = Object.freeze({ maxFiles: 512, maxFileBytes: 16 * 1024 * 1024, maxControlBytes: 1024 * 1024, maxExecutableBytes: 256 * 1024 * 1024, maxTimeoutMs: 300_000, maxOutputBytes: 1024 * 1024, maxApprovalLifetimeMs: 86_400_000, maxReceiptLifetimeMs: 600_000 });
+const SHA256 = /^[0-9a-f]{64}$/; const ID = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/; const ENV = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function fail(code, message) { const error = new Error(message); error.code = code; throw error; }
+function digest(value) { return createHash('sha256').update(value).digest('hex'); }
+function canonical(value) { if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`; if (value && typeof value === 'object') return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}`; return JSON.stringify(value); }
+function safeRelative(value, label = 'path') { if (typeof value !== 'string' || !value || value !== value.normalize('NFC') || path.isAbsolute(value) || /^[A-Za-z]:/.test(value) || value.includes('\\') || /[\u0000-\u001f\u007f]/.test(value) || value.split('/').some(part => !part || part === '.' || part === '..')) fail('ENTROROVE_PATH_UNSAFE', `${label} must be a normalized relative path`); return value; }
+function inside(root, target, label) { const relative = path.relative(root, target); if (relative === '' || (!path.isAbsolute(relative) && relative !== '..' && !relative.startsWith(`..${path.sep}`))) return; fail('ENTROROVE_PATH_ESCAPE', `${label} escapes repositoryRoot`); }
+async function rootOf(value) { if (typeof value !== 'string' || !path.isAbsolute(value)) fail('ENTROROVE_ROOT_INVALID', 'repositoryRoot must be absolute'); const stat = await fs.lstat(value); if (!stat.isDirectory() || stat.isSymbolicLink()) fail('ENTROROVE_ROOT_INVALID', 'repositoryRoot must be a real directory'); return fs.realpath(value); }
+async function regular(file, max, privateFile = false) { const stat = await fs.lstat(file); if (!stat.isFile() || stat.isSymbolicLink() || stat.size > max) fail('ENTROROVE_FILE_INVALID', 'control file must be a bounded regular file'); if (privateFile && process.platform !== 'win32' && ((typeof process.getuid === 'function' && stat.uid !== process.getuid()) || (stat.mode & 0o777) !== 0o600 || stat.nlink !== 1)) fail('ENTROROVE_CONTROL_PERMISSIONS', 'control file must be owned and mode 0600'); return { bytes: await fs.readFile(file), sha256: digest(await fs.readFile(file)) }; }
+async function projectFile(root, relative) { const safe = safeRelative(relative); const target = path.resolve(root, ...safe.split('/')); inside(root, target, safe); const stat = await fs.lstat(target); if (!stat.isFile() || stat.isSymbolicLink() || await fs.realpath(target) !== target) fail('ENTROROVE_FILE_INVALID', `${safe} must be a regular file`); return { path: safe, target, stat, ...(await regular(target, RUNNER_LIMITS.maxFileBytes)) }; }
+async function externalFile(root, value, label) { if (typeof value !== 'string' || !path.isAbsolute(value)) fail('ENTROROVE_CONTROL_PATH', `${label} must be an absolute path`); const entry = await fs.lstat(value); if (!entry.isFile() || entry.isSymbolicLink()) fail('ENTROROVE_CONTROL_FILE', `${label} must be a regular non-symlink file`); const target = await fs.realpath(value); const relative = path.relative(root, target); if (relative === '' || (!path.isAbsolute(relative) && relative !== '..' && !relative.startsWith(`..${path.sep}`))) fail('ENTROROVE_PATH_ESCAPE', `${label} must be outside repositoryRoot`); return { path: target, ...(await regular(target, RUNNER_LIMITS.maxControlBytes, true)) }; }
+function exactObject(value, fields, label) { if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).sort().join('|') !== [...fields].sort().join('|')) fail('ENTROROVE_PLAN_FIELDS', `${label} has invalid fields`); return value; }
+function boundedInt(value, max, label) { if (!Number.isSafeInteger(value) || value <= 0 || value > max) fail('ENTROROVE_LIMIT_INVALID', `${label} must be a positive bounded integer`); }
+function planArtifact(files) { return digest(canonical(files)); }
+
+function validatePlan(plan) {
+  exactObject(plan, ['schemaVersion', 'frozen', 'planId', 'validationRunId', 'memberId', 'chainId', 'artifactSha256', 'files', 'tests', 'policy', 'goldenBaseline', 'contracts'], 'execution plan');
+  if (plan.schemaVersion !== PLAN_SCHEMA || plan.frozen !== true || !ID.test(plan.planId) || !ID.test(plan.validationRunId) || !ID.test(plan.memberId) || !ID.test(plan.chainId) || !SHA256.test(plan.artifactSha256) || !Array.isArray(plan.files) || plan.files.length === 0 || plan.files.length > RUNNER_LIMITS.maxFiles) fail('ENTROROVE_PLAN_INVALID', 'plan must be frozen and bounded');
+  for (let i = 0; i < plan.files.length; i += 1) { const file = exactObject(plan.files[i], ['path', 'sha256'], 'manifest entry'); safeRelative(file.path); if (!SHA256.test(file.sha256) || (i > 0 && plan.files[i - 1].path >= file.path)) fail('ENTROROVE_PLAN_MANIFEST', 'manifest paths must be sorted and unique'); }
+  if (planArtifact(plan.files) !== plan.artifactSha256) fail('ENTROROVE_PLAN_MANIFEST', 'artifact manifest digest mismatch');
+  const policy = exactObject(plan.policy, ['executable', 'executableSha256', 'args', 'environment', 'timeoutMs', 'maxOutputBytes', 'requiredExitCode'], 'execution policy');
+  if (typeof policy.executable !== 'string' || !path.isAbsolute(policy.executable) || !SHA256.test(policy.executableSha256) || !Array.isArray(policy.args) || policy.args.length > 128 || policy.args.some(value => typeof value !== 'string' || value.includes('\0') || value.length > 4096)) fail('ENTROROVE_POLICY_INVALID', 'executable and args are invalid');
+  if (!policy.environment || typeof policy.environment !== 'object' || Array.isArray(policy.environment) || Object.keys(policy.environment).length > 64 || Object.entries(policy.environment).some(([key, value]) => !ENV.test(key) || typeof value !== 'string' || value.includes('\0') || value.length > 16_384)) fail('ENTROROVE_POLICY_ENVIRONMENT', 'environment must be explicit bounded strings');
+  boundedInt(policy.timeoutMs, RUNNER_LIMITS.maxTimeoutMs, 'timeoutMs'); boundedInt(policy.maxOutputBytes, RUNNER_LIMITS.maxOutputBytes, 'maxOutputBytes'); if (policy.requiredExitCode !== 0) fail('ENTROROVE_POLICY_EXIT', 'requiredExitCode must be zero');
+  if (!Array.isArray(plan.tests) || plan.tests.length === 0 || plan.tests.length > RUNNER_LIMITS.maxFiles) fail('ENTROROVE_PLAN_TESTS', 'tests must be non-empty');
+  for (const test of plan.tests) { exactObject(test, ['testId', 'path'], 'test'); if (!ID.test(test.testId) || !plan.files.some(file => file.path === test.path) || !policy.args.includes(test.path)) fail('ENTROROVE_PLAN_TESTS', 'each test must be in the manifest and explicit in args'); }
+  if (plan.contracts?.archguard?.driftStatus === 'red') fail('ENTROROVE_ARCHGUARD_BLOCKED', 'ArchGuard red blocks execution'); return plan;
+}
+
+async function validateApproval(root, input, planSha256) {
+  const file = await externalFile(root, input.approvalPath, 'approvalPath'); let approval; try { approval = JSON.parse(file.bytes.toString('utf8')); } catch (cause) { fail('ENTROROVE_APPROVAL_INVALID', `approval JSON is invalid: ${cause.message}`); }
+  exactObject(approval, ['schemaVersion', 'repositoryRoot', 'planSha256', 'approvedBy', 'approvedAt', 'expiresAt'], 'runner approval'); const approvedAt = Date.parse(approval.approvedAt); const expiresAt = Date.parse(approval.expiresAt); let approvedRoot = null; try { approvedRoot = await fs.realpath(approval.repositoryRoot); } catch {}
+  if (approval.schemaVersion !== APPROVAL_SCHEMA || approvedRoot !== root || approval.planSha256 !== planSha256 || !ID.test(approval.approvedBy) || !Number.isFinite(approvedAt) || !Number.isFinite(expiresAt) || approvedAt > Date.now() || expiresAt <= Date.now() || expiresAt <= approvedAt || expiresAt - approvedAt > RUNNER_LIMITS.maxApprovalLifetimeMs) fail('ENTROROVE_APPROVAL_INVALID', 'approval is expired or does not match the frozen plan'); return { ...file, approval };
+}
+async function signer(root, input, policy) {
+  if (input.signerConfigPath === null) return null; const file = await externalFile(root, input.signerConfigPath, 'signerConfigPath'); let config; try { config = JSON.parse(file.bytes.toString('utf8')); } catch (cause) { fail('ENTROROVE_SIGNER_INVALID', `signer JSON is invalid: ${cause.message}`); }
+  exactObject(config, ['schemaVersion', 'privateKeyPath', 'keyId', 'receiptTtlMs'], 'runner signer'); if (config.schemaVersion !== SIGNER_SCHEMA || !SHA256.test(config.keyId)) fail('ENTROROVE_SIGNER_INVALID', 'signer config is invalid'); boundedInt(config.receiptTtlMs, RUNNER_LIMITS.maxReceiptLifetimeMs, 'receiptTtlMs'); const privateFile = await externalFile(root, config.privateKeyPath, 'privateKeyPath');
+  let privateKey; try { privateKey = createPrivateKey(privateFile.bytes); if (privateKey.asymmetricKeyType !== 'ed25519' || digest(createPublicKey(privateKey).export({ format: 'der', type: 'spki' })) !== config.keyId) fail('ENTROROVE_SIGNER_INVALID', 'signer public key fingerprint mismatch'); } finally { privateFile.bytes.fill(0); }
+  if (JSON.stringify([policy.args, policy.environment]).includes(privateFile.path) || JSON.stringify([policy.args, policy.environment]).includes(file.path)) fail('ENTROROVE_SIGNER_SCOPE', 'signer path may not be passed to child'); return { config, file, privateKey };
+}
+
+async function authority(input) {
+  if (process.platform === 'win32' || typeof process.getuid !== 'function') fail('ENTROROVE_POSIX_REQUIRED', 'approved plan runner requires POSIX');
+  exactObject(input, ['repositoryRoot', 'planPath', 'approvalPath', 'signerConfigPath'], 'runner input'); const root = await rootOf(input.repositoryRoot); const planFile = await projectFile(root, input.planPath); if (planFile.bytes.length > RUNNER_LIMITS.maxControlBytes) fail('ENTROROVE_PLAN_SIZE', 'plan exceeds control limit');
+  let plan; try { plan = validatePlan(JSON.parse(planFile.bytes.toString('utf8'))); } catch (cause) { throw cause; } const approval = await validateApproval(root, input, planFile.sha256); const signing = await signer(root, input, plan.policy); const executable = await regular(plan.policy.executable, RUNNER_LIMITS.maxExecutableBytes); if (executable.sha256 !== plan.policy.executableSha256) fail('ENTROROVE_EXECUTABLE_HASH', 'executable SHA-256 mismatch');
+  for (const file of plan.files) { const actual = await projectFile(root, file.path); if (actual.sha256 !== file.sha256) fail('ENTROROVE_PLAN_FILE_HASH', `${file.path} changed before execution`); }
+  return { root, plan, planFile, approval, signing };
+}
+
+function runCommand(authority) {
+  return new Promise((resolve, reject) => {
+    const started = performance.now(); const { policy } = authority.plan; const child = spawn(policy.executable, policy.args, { cwd: authority.root, env: { ...policy.environment }, shell: false, detached: true, stdio: ['ignore', 'pipe', 'pipe'] });
+    const stdout = []; const stderr = []; let bytes = 0; let dropped = 0; let timedOut = false; let terminating = false; let timer; const stdoutHash = createHash('sha256'); const stderrHash = createHash('sha256');
+    const terminate = () => { if (terminating) return; terminating = true; try { process.kill(-child.pid, 'SIGTERM'); } catch {} setTimeout(() => { try { process.kill(-child.pid, 'SIGKILL'); } catch {} }, 250).unref(); };
+    const consume = (target, hash, chunk) => { const data = Buffer.from(chunk); hash.update(data); const keep = Math.max(0, Math.min(data.length, policy.maxOutputBytes - bytes)); if (keep) target.push(data.subarray(0, keep)); bytes += keep; dropped += data.length - keep; if (dropped) terminate(); };
+    child.stdout.on('data', chunk => consume(stdout, stdoutHash, chunk)); child.stderr.on('data', chunk => consume(stderr, stderrHash, chunk)); child.once('error', reject); timer = setTimeout(() => { timedOut = true; terminate(); }, policy.timeoutMs);
+    child.once('close', (exitCode, signal) => { clearTimeout(timer); resolve({ schemaVersion: RUNNER_SCHEMA, status: exitCode === 0 && signal === null && !timedOut && !dropped ? 'succeeded' : 'failed', exitCode, signal, timedOut, outputLimitExceeded: dropped > 0, durationMs: Math.max(0, Math.round(performance.now() - started)), stdout: Buffer.concat(stdout).toString('utf8'), stderr: Buffer.concat(stderr).toString('utf8'), stdoutSha256: stdoutHash.digest('hex'), stderrSha256: stderrHash.digest('hex'), capturedBytes: bytes, droppedBytes: dropped }); });
+  });
+}
+function subject(authority, result) { return { schemaVersion: 'validator.validation-subject/1.0', artifactSha256: authority.plan.artifactSha256, memberId: authority.plan.memberId, chainId: authority.plan.chainId, executedAt: new Date().toISOString(), files: authority.plan.files, validationRunId: authority.plan.validationRunId, planId: authority.plan.planId, tests: authority.plan.tests, policy: { command: [authority.plan.policy.executable, ...authority.plan.policy.args].map(value => JSON.stringify(value)).join(' '), requiredExitCode: 0, executionPlanSha256: authority.planFile.sha256 }, goldenBaseline: authority.plan.goldenBaseline, contracts: authority.plan.contracts, execution: { exitCode: result.exitCode, signal: result.signal, timedOut: result.timedOut, outputLimitExceeded: result.outputLimitExceeded } }; }
+function evidence(authority, result, sub) { const summary = result.timedOut ? 'Approved validation command exceeded its deadline' : result.outputLimitExceeded ? 'Approved validation command exceeded its output limit' : result.signal ? `Approved validation command ended on signal ${result.signal}` : `Approved validation command exited with code ${result.exitCode}`; const base = { schemaVersion: 'entrorove.test-evidence/2.0', evidenceId: `${authority.plan.validationRunId}:process`, kind: 'test', runner: authority.signing ? 'trusted-runner' : 'local', command: [authority.plan.policy.executable, ...authority.plan.policy.args].map(value => JSON.stringify(value)).join(' '), exitCode: result.exitCode, durationMs: result.durationMs, summary, artifactSha256: authority.plan.artifactSha256, subject: sub, subjectDigest: digest(canonical(sub)) };
+  if (!authority.signing || !Number.isInteger(result.exitCode)) return base; const privateKey = authority.signing.privateKey; const receiptCore = { schemaVersion: RECEIPT_SCHEMA, keyId: authority.signing.config.keyId, subjectDigest: base.subjectDigest, nonce: randomUUID(), issuedAt: new Date().toISOString(), expiresAt: new Date(Date.now() + authority.signing.config.receiptTtlMs).toISOString(), result: { runner: 'trusted-runner', passed: result.status === 'succeeded', exitCode: result.exitCode, durationMs: result.durationMs, summary } }; const receipt = { ...receiptCore, signature: sign(null, Buffer.from(canonical(receiptCore)), privateKey).toString('base64url') }; return { ...base, receipt };
+}
+
+export async function runApprovedPlan(input) { const owner = await authority(input); const result = await runCommand(owner); try { const after = await authority(input); if (after.planFile.sha256 !== owner.planFile.sha256) fail('ENTROROVE_PLAN_CHANGED', 'plan changed during execution'); } catch (cause) { const execution = { schemaVersion: RUNNER_SCHEMA, status: 'failed', error: cause.message, process: result, evidence: [] }; const error = new Error(cause.message); error.code = cause.code; error.execution = execution; throw error; }
+  const sub = subject(owner, result); const item = evidence(owner, result, sub); const status = !owner.signing && result.status === 'succeeded' ? 'incomplete' : result.status; return { schemaVersion: RUNNER_SCHEMA, status, planSha256: owner.planFile.sha256, approvalSha256: owner.approval.sha256, approvedBy: owner.approval.approval.approvedBy, subject: sub, process: result, evidence: [item], receipt: item.receipt ?? null, ...(owner.signing ? { receiptPublicKey: createPublicKey(owner.signing.privateKey).export({ format: 'der', type: 'spki' }).toString('base64') } : {}), signingBoundary: owner.signing ? 'configured-signature-only' : 'local-evidence-only' };
+}
+
+export const RUNNER_CAPABILITIES = Object.freeze({ schemaVersion: RUNNER_SCHEMA, operations: ['capabilities', 'run-approved-plan'], operationSchemas: { capabilities: { type: 'object', additionalProperties: false, required: [] }, 'run-approved-plan': { type: 'object', additionalProperties: false, required: ['repositoryRoot', 'planPath', 'approvalPath', 'signerConfigPath'] } }, limits: RUNNER_LIMITS, boundary: 'POSIX subprocess runner; external approval is required; local evidence remains incomplete without a configured signer.' });

package/local-budget-renewal.mjs

@@ -0,0 +1,37 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { withStateLock } from './local-state-lock.mjs';
+
+const ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+function fail(code, message) { const error = new Error(message); error.code = code; throw error; }
+function digest(value) { return createHash('sha256').update(value).digest('hex'); }
+function canonical(value) { if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`; if (value && typeof value === 'object') return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}`; return JSON.stringify(value); }
+function rootHome(home = os.homedir()) { if (typeof home !== 'string' || !path.isAbsolute(home)) fail('ENTROROVE_HOME_INVALID', 'home must be absolute'); return path.join(home, '.entrorove'); }
+async function privateDir(directory) { await fs.mkdir(directory, { recursive: true, mode: 0o700 }); const stat = await fs.lstat(directory); if (!stat.isDirectory() || stat.isSymbolicLink()) fail('ENTROROVE_STATE_INVALID', 'state directory must be a real directory'); if (process.platform !== 'win32') await fs.chmod(directory, 0o700); }
+async function repo(value) { if (typeof value !== 'string' || !path.isAbsolute(value)) fail('ENTROROVE_ROOT_INVALID', 'repositoryRoot must be absolute'); const stat = await fs.lstat(value); if (!stat.isDirectory() || stat.isSymbolicLink()) fail('ENTROROVE_ROOT_INVALID', 'repositoryRoot must be a real directory'); return fs.realpath(value); }
+function statePath(home, root, flowId) { return path.join(rootHome(home), 'budgets', digest(root).slice(0, 32), flowId, 'budget.json'); }
+async function load(input) { const root = await repo(input.repositoryRoot); if (typeof input.flowId !== 'string' || !ID.test(input.flowId)) fail('ENTROROVE_ID_INVALID', 'flowId must be a safe identifier'); const file = statePath(input.home, root, input.flowId); await privateDir(path.dirname(file)); const stat = await fs.lstat(file); if (!stat.isFile() || stat.isSymbolicLink()) fail('ENTROROVE_STATE_INVALID', 'budget state must be a regular file'); const state = JSON.parse(await fs.readFile(file, 'utf8')); if (state.flowId !== input.flowId || state.repositoryDigest !== digest(root).slice(0, 32)) fail('ENTROROVE_BUDGET_SCOPE', 'budget state does not match repository and flow'); return { root, file, state }; }
+async function save(file, state) { await privateDir(path.dirname(file)); const temp = `${file}.${randomUUID()}.tmp`; await fs.writeFile(temp, `${canonical(state)}\n`, { flag: 'wx', mode: 0o600 }); await fs.rename(temp, file); if (process.platform !== 'win32') await fs.chmod(file, 0o600); }
+export async function consumeBudgetRenewal({ file, state, now = Date.now() }) {
+  if (!state.enforced || !state.autoRenew || state.autoRenew.status !== 'authorized') return state;
+  const elapsed = state.elapsedMs + now - Date.parse(state.startedAt); const used = state.autoRenew.renewalsUsed ?? 0;
+  if (elapsed < state.maxDurationMs || used >= state.autoRenew.policy.maxRenewals) return state;
+  const updated = { ...state, startedAt: new Date(now).toISOString(), elapsedMs: 0, autoRenew: { ...state.autoRenew, renewalsUsed: used + 1, lastRenewedAt: new Date(now).toISOString() } };
+  await save(file, updated); return updated;
+}
+function scope(input) { if (!input.scope || typeof input.scope.goal !== 'string' || !Array.isArray(input.scope.allowedPaths) || !input.scope.allowedPaths.length) fail('ENTROROVE_RENEWAL_SCOPE', 'renewal scope must include goal and allowedPaths'); return { goal: input.scope.goal, allowedPaths: [...new Set(input.scope.allowedPaths)].sort() }; }
+function policy(input) { if (!input.policy || !Number.isSafeInteger(input.policy.intervalMs) || input.policy.intervalMs < 1 || !Number.isSafeInteger(input.policy.maxRenewals) || input.policy.maxRenewals < 1 || input.policy.maxRenewals > 100) fail('ENTROROVE_RENEWAL_POLICY', 'renewal policy must have bounded intervalMs and maxRenewals'); return { intervalMs: input.policy.intervalMs, maxRenewals: input.policy.maxRenewals }; }
+async function renewalRequestUnlocked(input) { const current = await load(input); const requested = scope(input); const renewalPolicy = policy(input); if (!input.requestId || typeof input.requestId !== 'string' || !ID.test(input.requestId)) fail('ENTROROVE_REQUEST_ID', 'requestId must be a safe identifier'); if (current.state.autoRenew?.status === 'authorized') fail('ENTROROVE_RENEWAL_EXISTS', 'this budget already has an immutable renewal authorization'); const record = { requestId: input.requestId, chainId: input.flowId, scope: requested, scopeDigest: digest(canonical(requested)), policy: renewalPolicy, status: 'pending', createdAt: new Date().toISOString() }; const state = { ...current.state, autoRenew: record }; await save(current.file, state); return { schemaVersion: 'entrorove.local-execution/1.0', status: 'waiting', interaction: { schemaVersion: 'confirm.interaction/1.0', interactionId: `renew-${randomUUID()}`, risk: 'medium', question: `Allow automatic read-time renewal for chain ${input.flowId}?`, options: [{ id: 'approve', label: 'Approve' }, { id: 'reject', label: 'Reject' }], default: null, expiresAt: new Date(Date.now() + 300_000).toISOString(), callback: { operation: 'budget-auto-renew', requestId: input.requestId } }, requestId: input.requestId, scope: requested, policy: renewalPolicy }; }
+export async function budgetAutoRenewRequest(input) { const current = await load(input); return withStateLock(current.file, () => renewalRequestUnlocked(input)); }
+async function renewalUnlocked(input) { const current = await load(input); const pending = current.state.autoRenew; const requested = scope(input); const renewalPolicy = policy(input); const confirmation = input.confirmation; if (!pending || pending.requestId !== input.requestId || pending.status !== 'pending' || confirmation?.answer !== 'approve' || confirmation.requestId !== input.requestId || pending.scopeDigest !== digest(canonical(requested)) || canonical(pending.policy) !== canonical(renewalPolicy)) return { schemaVersion: 'entrorove.local-execution/1.0', status: 'blocked', allowed: false, code: 'ENTROROVE_CONFIRMATION_BINDING' }; const state = { ...current.state, autoRenew: { ...pending, status: 'authorized', approvedAt: new Date().toISOString(), renewalsUsed: 0 } }; await save(current.file, state); return { schemaVersion: 'entrorove.local-execution/1.0', status: 'verified', allowed: true, chainId: input.flowId, requestId: input.requestId, scope: requested, policy: renewalPolicy, renewalsUsed: 0 }; }
+export async function budgetAutoRenew(input) { const current = await load(input); return withStateLock(current.file, () => renewalUnlocked(input)); }
+async function renewalStopUnlocked(input) { const current = await load(input); const reason = input.reason; if (!['revoked', 'completed'].includes(reason)) fail('ENTROROVE_RENEWAL_REASON', 'reason must be revoked or completed'); if (!current.state.autoRenew || current.state.autoRenew.status !== 'authorized') return { schemaVersion: 'entrorove.local-execution/1.0', status: 'verified', stopped: false, reason }; const state = { ...current.state, autoRenew: { ...current.state.autoRenew, status: 'stopped', stoppedAt: new Date().toISOString(), stopReason: reason } }; await save(current.file, state); return { schemaVersion: 'entrorove.local-execution/1.0', status: 'verified', stopped: true, reason, renewalsUsed: state.autoRenew.renewalsUsed ?? 0 }; }
+export async function budgetAutoRenewStop(input) { const current = await load(input); return withStateLock(current.file, () => renewalStopUnlocked(input)); }
+export const LOCAL_RENEWAL_OPERATIONS = Object.freeze({ 'budget-auto-renew-request': budgetAutoRenewRequest, 'budget-auto-renew': budgetAutoRenew, 'budget-auto-renew-stop': budgetAutoRenewStop });
+export const LOCAL_RENEWAL_SCHEMAS = Object.freeze({
+  'budget-auto-renew-request': { type: 'object', additionalProperties: false, required: ['repositoryRoot', 'flowId', 'requestId', 'scope', 'policy'] },
+  'budget-auto-renew': { type: 'object', additionalProperties: false, required: ['repositoryRoot', 'flowId', 'requestId', 'scope', 'policy', 'confirmation'] },
+  'budget-auto-renew-stop': { type: 'object', additionalProperties: false, required: ['repositoryRoot', 'flowId', 'reason'] },
+});

package/local-cli.mjs

@@ -0,0 +1,58 @@
+import {
+  LOCAL_CAPABILITIES, budgetContext, budgetExtend, budgetInit, budgetRead, budgetStatus,
+  completePeer, finalGate, guardedWrite, issueMutationPass, mergeVerified, mutateGate,
+  peerCoordinate, rollback, signEvidence, snapshotPlan, snapshotVerify, spawnBind,
+  verifyCoordinationLease, verifyEvidence, verifyMutationPass,
+  evaluateFormula, evaluateFormulaGraph, formulaFinalGate, formulaFinalGateFile, runApprovedPlan,
+  LOCAL_LEDGER_OPERATIONS,
+  LOCAL_RENEWAL_OPERATIONS, LOCAL_PROBE_OPERATIONS,
+  LOCAL_TASK_ROUTING_OPERATIONS,
+} from './local-execution.mjs';
+
+async function stdinJson() {
+  let raw = '';
+  for await (const chunk of process.stdin) raw += chunk;
+  if (!raw.trim()) return {};
+  const value = JSON.parse(raw);
+  if (!value || typeof value !== 'object' || Array.isArray(value)) throw new Error('local input must be a JSON object');
+  return value;
+}
+
+const operations = {
+  'snapshot-plan': snapshotPlan, 'snapshot-verify': snapshotVerify, 'mutate-gate': mutateGate,
+  'gate-issue': issueMutationPass, 'gate-verify': verifyMutationPass, 'guarded-write': guardedWrite,
+  'budget-init': budgetInit, 'budget-context': budgetContext, 'budget-read': budgetRead, 'budget-status': budgetStatus,
+  'budget-extend': budgetExtend, 'peer-coordinate': peerCoordinate, coordinate: peerCoordinate,
+  'spawn-bind': spawnBind, 'peer-complete': completePeer, complete: completePeer,
+  'lease-verify': verifyCoordinationLease,
+  'evidence-sign': signEvidence, 'evidence-verify': verifyEvidence, 'merge-verified': mergeVerified,
+  rollback, 'final-gate': finalGate,
+  'formula-evaluate': input => ({ schemaVersion: 'entrorove.local-execution/1.0', status: 'verified', value: evaluateFormula(input.formula, input.values ?? {}).toString() }),
+  'formula-graph': input => ({ schemaVersion: 'entrorove.local-execution/1.0', status: 'verified', values: evaluateFormulaGraph(input.formulas, input.inputs ?? {}) }),
+  'formula-final-gate': input => formulaFinalGate(input.engine), 'calculation-final-gate': formulaFinalGateFile,
+  'run-approved-plan': runApprovedPlan,
+  ...LOCAL_LEDGER_OPERATIONS,
+  ...LOCAL_RENEWAL_OPERATIONS, ...LOCAL_PROBE_OPERATIONS,
+  ...LOCAL_TASK_ROUTING_OPERATIONS,
+};
+
+export const LOCAL_OPERATIONS = Object.freeze(operations);
+
+export async function runLocal(args = []) {
+  const operation = args[0];
+  if (operation === 'capabilities' || operation === 'help') { process.stdout.write(`${JSON.stringify(LOCAL_CAPABILITIES)}\n`); return; }
+  const handler = operations[operation];
+  if (!handler) throw new Error(`Usage: entrorove local <${['capabilities', ...Object.keys(operations)].join('|')}> [repositoryRoot]`);
+  const input = await stdinJson();
+  if (args[1] && input.repositoryRoot === undefined) input.repositoryRoot = args[1];
+  const output = await handler(input);
+  process.stdout.write(`${JSON.stringify(output)}\n`);
+  if (output?.status === 'blocked' || output?.status === 'failed' || output?.status === 'incomplete') process.exitCode = 2;
+}
+
+export async function runLocalInput(operation, input) {
+  if (operation === 'capabilities' || operation === 'help') return LOCAL_CAPABILITIES;
+  const handler = operations[operation];
+  if (!handler) throw new Error(`Unsupported local operation: ${operation}`);
+  return handler(input);
+}