@entrorove/skill 0.1.6 → 0.1.22

package/local-execution.mjs

@@ -0,0 +1,482 @@
+import { createHash, createPublicKey, generateKeyPairSync, sign, verify, randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { promises as fs } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { formulaFinalGateFile, formulaFinalGate, evaluateFormula, evaluateFormulaGraph, Decimal } from './local-formula.mjs';
+import { LOCAL_LEDGER_OPERATIONS, LOCAL_LEDGER_SCHEMAS, branchCreate, branchList, branchSwitch, diffReport, preflight, ledgerQuery, chainInit, chainResume, chainStatus, chainAnswer, appendLedgerRecord } from './local-ledger.mjs';
+import { verifyArchguardPreflight, verifyReceipt, verifySnapshotManifest, verifyTrustedEvidence } from './local-integrity.mjs';
+import { RUNNER_CAPABILITIES, runApprovedPlan } from './local-approved-plan.mjs';
+import { LOCAL_RENEWAL_OPERATIONS, LOCAL_RENEWAL_SCHEMAS, budgetAutoRenewRequest, budgetAutoRenew, budgetAutoRenewStop, consumeBudgetRenewal } from './local-budget-renewal.mjs';
+import { LOCAL_PROBE_OPERATIONS, LOCAL_PROBE_SCHEMAS, probe, reassess } from './local-probe.mjs';
+import { LOCAL_TASK_ROUTING_OPERATIONS, LOCAL_TASK_ROUTING_SCHEMAS, taskDescribe, messageRoute, messageAccept, taskResume } from './local-task-routing.mjs';
+import { withStateLock } from './local-state-lock.mjs';
+export const LOCAL_SCHEMA = 'entrorove.local-execution/1.0';
+export const SNAPSHOT_SCHEMA = 'entrorove.snapshot/1.0';
+export const RECEIPT_SCHEMA = 'entrorove.snapshot-receipt/1.0';
+export const PASS_SCHEMA = 'entrorove.mutation-pass/1.0';
+export const EVIDENCE_SCHEMA = 'entrorove.test-evidence/2.0';
+export const EVIDENCE_RECEIPT_SCHEMA = 'entrorove.runner-receipt/1.0';
+export const BUDGET_SCHEMA = 'entrorove.read-budget/1.0';
+export const COORDINATION_SCHEMA = 'entrorove.coordination/1.0';
+export const READ_BUDGETS = Object.freeze({
+  lock: Object.freeze({ maxFiles: 3, maxTokenEstimate: 12_000, maxDurationMs: 120_000 }),
+  probe: Object.freeze({ maxFiles: 10, maxTokenEstimate: 30_000, maxDurationMs: 480_000 }),
+  swarm: Object.freeze({ maxFiles: 30, maxTokenEstimate: 100_000, maxDurationMs: 3_600_000 }),
+});
+const ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+const SHA256 = /^[0-9a-f]{64}$/;
+const MISSING_SHA256 = sha256('entrorove.missing-file/1.0');
+export function sha256(value) {
+  return createHash('sha256').update(value).digest('hex');
+}
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(',')}]`;
+  if (value && typeof value === 'object') {
+    return `{${Object.keys(value).sort().map(key => `${JSON.stringify(key)}:${canonical(value[key])}`).join(',')}}`;
+  }
+  return JSON.stringify(value);
+}
+function fail(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  throw error;
+}
+function id(value, field) {
+  if (typeof value !== 'string' || !ID.test(value)) fail('ENTROROVE_ID_INVALID', `${field} must be a safe identifier`);
+  return value;
+}
+function safePath(value, field = 'path') {
+  if (typeof value !== 'string' || !value || value !== value.normalize('NFC') || path.isAbsolute(value)
+    || /^[A-Za-z]:/.test(value) || value.includes('\\') || /[\u0000-\u001f\u007f]/.test(value)
+    || value.split('/').some(part => !part || part === '.' || part === '..')) {
+    fail('ENTROROVE_PATH_UNSAFE', `${field} is unsafe`);
+  }
+  return value;
+}
+function homeRoot(home = os.homedir()) {
+  if (typeof home !== 'string' || !path.isAbsolute(home)) fail('ENTROROVE_HOME_INVALID', 'home must be an absolute path');
+  return path.join(home, '.entrorove');
+}
+async function privateDir(directory) {
+  await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+  const stat = await fs.lstat(directory);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) fail('ENTROROVE_STATE_INVALID', 'Entrorove state directory must be a real directory');
+  if (process.platform !== 'win32') await fs.chmod(directory, 0o700);
+  return directory;
+}
+async function atomicJson(file, value) {
+  await privateDir(path.dirname(file));
+  const temporary = `${file}.${randomUUID()}.tmp`;
+  await fs.writeFile(temporary, `${canonical(value)}\n`, { flag: 'wx', mode: 0o600 });
+  await fs.rename(temporary, file);
+  if (process.platform !== 'win32') await fs.chmod(file, 0o600);
+}
+async function readJson(file) {
+  await privateDir(path.dirname(file));
+  const stat = await fs.lstat(file);
+  if (!stat.isFile() || stat.isSymbolicLink()) fail('ENTROROVE_STATE_INVALID', 'State file must be a regular file');
+  const value = JSON.parse(await fs.readFile(file, 'utf8'));
+  if (!value || typeof value !== 'object' || Array.isArray(value)) fail('ENTROROVE_STATE_INVALID', 'State file must contain an object');
+  return value;
+}
+export async function repositoryRoot(value) {
+  if (typeof value !== 'string' || !value.trim() || !path.isAbsolute(path.resolve(value))) fail('ENTROROVE_ROOT_INVALID', 'repositoryRoot is required');
+  const resolved = path.resolve(value);
+  const stat = await fs.lstat(resolved);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) fail('ENTROROVE_ROOT_INVALID', 'repositoryRoot must be a real directory');
+  return fs.realpath(resolved);
+}
+function inside(root, target, field) {
+  const relative = path.relative(root, target);
+  if (relative === '' || (!path.isAbsolute(relative) && relative !== '..' && !relative.startsWith(`..${path.sep}`))) return;
+  fail('ENTROROVE_PATH_ESCAPE', `${field} escapes repositoryRoot`);
+}
+async function projectFile(root, relative, allowMissing = false) {
+  const normalized = safePath(relative);
+  const target = path.resolve(root, ...normalized.split('/'));
+  inside(root, target, normalized);
+  try {
+    const stat = await fs.lstat(target);
+    if (stat.isSymbolicLink() || !stat.isFile()) fail('ENTROROVE_FILE_INVALID', `${normalized} must be a regular file`);
+    inside(root, await fs.realpath(target), normalized);
+    return { path: normalized, target, stat, exists: true };
+  } catch (error) {
+    if (!allowMissing || error.code !== 'ENOENT') throw error;
+    let parent = path.dirname(target);
+    while (parent !== root) {
+      try { inside(root, await fs.realpath(parent), normalized); break; } catch (cause) {
+        if (cause.code !== 'ENOENT') throw cause;
+        parent = path.dirname(parent);
+      }
+    }
+    return { path: normalized, target, stat: null, exists: false };
+  }
+}
+function repoKey(root) { return sha256(root).slice(0, 32); }
+function statePath(home, kind, root, idValue, suffix) {
+  return path.join(homeRoot(home), kind, repoKey(root), idValue, suffix);
+}
+async function audit(home, root, event, data = {}) {
+  const file = path.join(homeRoot(home), 'invocations.jsonl');
+  await privateDir(path.dirname(file));
+  const record = { schemaVersion: LOCAL_SCHEMA, at: new Date().toISOString(), event, repositoryDigest: repoKey(root), ...data };
+  await fs.appendFile(file, `${canonical(record)}\n`, { mode: 0o600 });
+  if (process.platform !== 'win32') await fs.chmod(file, 0o600);
+}
+function normalizePaths(paths) {
+  if (!Array.isArray(paths) || paths.length === 0) fail('ENTROROVE_PATHS_REQUIRED', 'paths must be a non-empty array');
+  const normalized = [...new Set(paths.map(item => safePath(item)))].sort();
+  if (normalized.length !== paths.length) fail('ENTROROVE_PATHS_DUPLICATE', 'paths must be unique');
+  return normalized;
+}
+async function keyPair(home, root) {
+  const directory = await privateDir(path.join(homeRoot(home), 'keys'));
+  const stem = repoKey(root);
+  const privatePath = path.join(directory, `${stem}.private.pem`);
+  const publicPath = path.join(directory, `${stem}.public.pem`);
+  try {
+    const [privateStat, publicStat] = await Promise.all([fs.lstat(privatePath), fs.lstat(publicPath)]);
+    if (privateStat.isSymbolicLink() || publicStat.isSymbolicLink() || !privateStat.isFile() || !publicStat.isFile()) fail('ENTROROVE_KEY_INVALID', 'local signing keys must be regular files');
+    const [privateKey, publicKey] = await Promise.all([fs.readFile(privatePath, 'utf8'), fs.readFile(publicPath, 'utf8')]);
+    const publicDer = createPublicKey(publicKey).export({ format: 'der', type: 'spki' });
+    return { privateKey, publicKey, publicDer, keyId: sha256(publicDer) };
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+    const pair = generateKeyPairSync('ed25519', { privateKeyEncoding: { type: 'pkcs8', format: 'pem' }, publicKeyEncoding: { type: 'spki', format: 'pem' } });
+    await fs.writeFile(privatePath, pair.privateKey, { flag: 'wx', mode: 0o600 });
+    await fs.writeFile(publicPath, pair.publicKey, { flag: 'wx', mode: 0o600 });
+    const publicDer = createPublicKey(pair.publicKey).export({ format: 'der', type: 'spki' });
+    return { privateKey: pair.privateKey, publicKey: pair.publicKey, publicDer, keyId: sha256(publicDer) };
+  }
+}
+async function fileDigest(file) { return file.exists ? sha256(await fs.readFile(file.target)) : MISSING_SHA256; }
+export async function snapshotPlan(input) {
+  const root = await repositoryRoot(input.repositoryRoot);
+  const flowId = id(input.flowId, 'flowId'); const stepId = id(input.stepId, 'stepId');
+  const paths = normalizePaths(input.paths);
+  const snapshotId = id(input.snapshotId ?? `snap-${randomUUID()}`, 'snapshotId');
+  const directory = path.dirname(statePath(input.home, 'snapshots', root, flowId, 'manifest.json'));
+  const snapshotRoot = path.join(directory, snapshotId);
+  await privateDir(snapshotRoot);
+  const files = [];
+  for (const relative of paths) {
+    const source = await projectFile(root, relative, true);
+    const digest = await fileDigest(source);
+    const target = path.join(snapshotRoot, relative);
+    if (source.exists) { await privateDir(path.dirname(target)); await fs.copyFile(source.target, target, constants.COPYFILE_EXCL); }
+    files.push({ path: relative, exists: source.exists, sha256: digest, mode: source.exists ? source.stat.mode & 0o777 : null });
+  }
+  const contractDigest = input.contractDigest ?? null;
+  if (contractDigest !== null && !SHA256.test(contractDigest)) fail('ENTROROVE_CONTRACT_DIGEST', 'contractDigest must be a lowercase SHA-256 digest');
+  const manifest = { schemaVersion: SNAPSHOT_SCHEMA, snapshotId, flowId, stepId, repositoryDigest: repoKey(root), paths, files, contractDigest,
+    createdAt: new Date().toISOString(), snapshotDigest: sha256(canonical({ snapshotId, flowId, stepId, paths, files, contractDigest })) };
+  const manifestPath = path.join(snapshotRoot, 'manifest.json');
+  await atomicJson(manifestPath, manifest);
+  await audit(input.home, root, 'snapshot-plan', { flowId, stepId, snapshotId });
+  return { schemaVersion: LOCAL_SCHEMA, snapshotId, snapshotRoot, manifestPath, paths, contractDigest, snapshotDigest: manifest.snapshotDigest, forbidGitBranch: true, forbidWorktree: true };
+}
+export async function snapshotVerify(input) {
+  const root = await repositoryRoot(input.repositoryRoot); const flowId = id(input.flowId, 'flowId'); const stepId = id(input.stepId, 'stepId');
+  const snapshotId = id(input.snapshotId, 'snapshotId');
+  const manifestPath = path.join(path.dirname(statePath(input.home, 'snapshots', root, flowId, 'manifest.json')), snapshotId, 'manifest.json');
+  const manifest = await readJson(manifestPath);
+  const integrity = verifySnapshotManifest(manifest, { snapshotId, flowId, stepId, repositoryDigest: repoKey(root) });
+  if (!integrity.verified) fail('ENTROROVE_SNAPSHOT_CORRUPT', integrity.reason ?? 'snapshot manifest is invalid');
+  const files = [];
+  for (const expected of manifest.files) {
+    const source = await projectFile(root, expected.path, true);
+    const actual = await fileDigest(source);
+    if (actual !== expected.sha256) fail('ENTROROVE_SNAPSHOT_CHANGED', `${expected.path} changed after snapshot`);
+    const snapshotTarget = path.join(path.dirname(manifestPath), expected.path);
+    const snapshotDigest = expected.exists ? sha256(await fs.readFile(snapshotTarget)) : MISSING_SHA256;
+    if (snapshotDigest !== expected.sha256) fail('ENTROROVE_SNAPSHOT_CORRUPT', `${expected.path} snapshot copy is invalid`);
+    files.push({ path: expected.path, sourceHash: actual, snapshotHash: expected.sha256 });
+  }
+  const core = { schemaVersion: RECEIPT_SCHEMA, snapshotId, flowId, stepId, repositoryDigest: repoKey(root), snapshotDigest: manifest.snapshotDigest, contractDigest: manifest.contractDigest ?? null, paths: manifest.paths, fileManifestDigest: sha256(canonical(files)) };
+  const receipt = { ...core, receiptDigest: sha256(canonical(core)) };
+  await audit(input.home, root, 'snapshot-verify', { flowId, stepId, snapshotId, receiptDigest: receipt.receiptDigest });
+  return { schemaVersion: LOCAL_SCHEMA, verified: true, receipt };
+}
+async function loadReceipt(input) {
+  const receipt = input.receipt;
+  if (!receipt || receipt.schemaVersion !== RECEIPT_SCHEMA || !SHA256.test(receipt.snapshotDigest) || !SHA256.test(receipt.receiptDigest)
+    || !Array.isArray(receipt.paths) || receipt.receiptDigest !== sha256(canonical({ schemaVersion: receipt.schemaVersion, snapshotId: receipt.snapshotId,
+    flowId: receipt.flowId, stepId: receipt.stepId, repositoryDigest: receipt.repositoryDigest, snapshotDigest: receipt.snapshotDigest,
+      contractDigest: receipt.contractDigest ?? null, paths: receipt.paths, fileManifestDigest: receipt.fileManifestDigest }))) fail('ENTROROVE_RECEIPT_INVALID', 'snapshot receipt is invalid');
+  return receipt;
+}
+async function snapshotAuthority(input, root, receipt) {
+  const manifestPath = path.join(path.dirname(statePath(input.home, 'snapshots', root, receipt.flowId, 'manifest.json')), receipt.snapshotId, 'manifest.json'); const manifest = await readJson(manifestPath);
+  const check = verifySnapshotManifest(manifest, { snapshotId: receipt.snapshotId, flowId: receipt.flowId, stepId: receipt.stepId, repositoryDigest: repoKey(root) });
+  if (!check.verified || manifest.snapshotDigest !== receipt.snapshotDigest || canonical(manifest.paths) !== canonical(receipt.paths) || (manifest.contractDigest ?? null) !== (receipt.contractDigest ?? null)) fail('ENTROROVE_SNAPSHOT_BINDING', check.reason ?? 'snapshot receipt does not match its manifest');
+  return { manifest, manifestPath };
+}
+export async function mutateGate(input) {
+  if (input.accepted !== true) return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', allowed: false, code: 'ENTROROVE_MUTATE_NOT_ACCEPTED' };
+  id(input.flowId, 'flowId'); id(input.stepId, 'stepId');
+  const receipt = await loadReceipt(input); const root = await repositoryRoot(input.repositoryRoot);
+  if (receipt.flowId !== input.flowId || receipt.stepId !== input.stepId || receipt.repositoryDigest !== repoKey(root)) return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', allowed: false, code: 'ENTROROVE_RECEIPT_SCOPE' };
+  await snapshotAuthority(input, root, receipt);
+  if (input.paths && canonical(normalizePaths(input.paths)) !== canonical(normalizePaths(receipt.paths))) return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', allowed: false, code: 'ENTROROVE_RECEIPT_PATHS' };
+  if (input.coordinationRequired === true) {
+    try { await verifyCoordinationLease({ ...input, paths: receipt.paths }); } catch (error) { return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', allowed: false, code: error.code ?? 'ENTROROVE_LEASE_INVALID' }; }
+  }
+  return { schemaVersion: LOCAL_SCHEMA, status: 'verified', allowed: true, snapshotId: receipt.snapshotId, receiptDigest: receipt.receiptDigest, paths: receipt.paths, coordinationRequired: input.coordinationRequired === true };
+}
+export async function issueMutationPass(input) {
+  const gate = await mutateGate(input); if (!gate.allowed) return gate;
+  const root = await repositoryRoot(input.repositoryRoot); const authority = await keyPair(input.home, root); const now = Date.now();
+  const ttlSeconds = input.ttlSeconds ?? 300;
+  if (!Number.isInteger(ttlSeconds) || ttlSeconds < 1 || ttlSeconds > 300) fail('ENTROROVE_PASS_TTL_INVALID', 'ttlSeconds must be 1..300');
+  const pass = { schemaVersion: PASS_SCHEMA, passId: `pass-${randomUUID()}`, flowId: input.flowId, stepId: input.stepId,
+    repositoryDigest: repoKey(root), snapshotId: gate.snapshotId, snapshotReceiptDigest: gate.receiptDigest, snapshotReceipt: input.receipt, paths: gate.paths, coordinationRequired: gate.coordinationRequired,
+    issuedAt: new Date(now).toISOString(), expiresAt: new Date(now + ttlSeconds * 1000).toISOString(), keyId: authority.keyId, nonce: randomUUID() };
+  const signature = sign(null, Buffer.from(canonical(pass)), authority.privateKey).toString('base64url');
+  const signedPass = { ...pass, signature }; const file = statePath(input.home, 'gates', root, input.flowId, `${pass.passId}.json`);
+  await atomicJson(file, signedPass); await audit(input.home, root, 'mutation-pass-issued', { flowId: input.flowId, stepId: input.stepId, passId: pass.passId });
+  return { schemaVersion: LOCAL_SCHEMA, gatePassPath: file, pass: signedPass };
+}
+async function verifyPass(input) {
+  id(input.flowId, 'flowId'); id(input.stepId, 'stepId');
+  const root = await repositoryRoot(input.repositoryRoot); const gateDirectory = path.dirname(statePath(input.home, 'gates', root, input.flowId, 'pass.json'));
+  const gatePath = path.resolve(input.gatePassPath ?? ''); inside(gateDirectory, gatePath, 'gatePassPath');
+  const pass = await readJson(gatePath); const authority = await keyPair(input.home, root);
+  const target = safePath(input.targetPath, 'targetPath'); const paths = Array.isArray(pass.paths) ? pass.paths : [];
+  const valid = pass.schemaVersion === PASS_SCHEMA && pass.repositoryDigest === repoKey(root) && pass.flowId === input.flowId && pass.stepId === input.stepId
+    && paths.includes(target) && pass.keyId === authority.keyId && typeof pass.signature === 'string'
+    && verify(null, Buffer.from(canonical(Object.fromEntries(Object.entries(pass).filter(([key]) => key !== 'signature')))), authority.publicKey, Buffer.from(pass.signature, 'base64url'))
+    && Date.parse(pass.issuedAt) <= Date.now() && Date.parse(pass.expiresAt) > Date.now();
+  if (!valid) fail('ENTROROVE_PASS_INVALID', 'mutation pass is forged, expired, or outside its scope');
+  if (!pass.snapshotReceipt || pass.snapshotReceipt.receiptDigest !== pass.snapshotReceiptDigest) fail('ENTROROVE_PASS_INVALID', 'mutation pass has no bound snapshot receipt');
+  const receipt = await loadReceipt({ receipt: pass.snapshotReceipt });
+  await snapshotAuthority(input, root, receipt);
+  if (receipt.flowId !== pass.flowId || receipt.stepId !== pass.stepId || receipt.repositoryDigest !== pass.repositoryDigest || receipt.snapshotId !== pass.snapshotId) fail('ENTROROVE_PASS_INVALID', 'mutation pass snapshot scope is invalid');
+  if (pass.coordinationRequired === true) await verifyCoordinationLease({ ...input, paths: [target] });
+  return { root, pass, target };
+}
+export async function verifyMutationPass(input) { const verified = await verifyPass(input); return { schemaVersion: LOCAL_SCHEMA, verified: true, pass: verified.pass, targetPath: verified.target }; }
+export async function guardedWrite(input) {
+  const verified = await verifyPass(input);
+  const lockFile = path.join(homeRoot(input.home), 'write-locks', repoKey(verified.root), `${sha256(verified.target)}.lock`);
+  return withStateLock(lockFile, async () => {
+    const target = await projectFile(verified.root, verified.target, true);
+    const { manifest } = await snapshotAuthority(input, verified.root, verified.pass.snapshotReceipt); const baseline = manifest.files.find(item => item.path === verified.target);
+    if (!baseline) fail('ENTROROVE_WRITE_SCOPE', 'target is absent from the snapshot manifest');
+    if (await fileDigest(target) !== baseline.sha256) fail('ENTROROVE_WRITE_BASELINE', 'target changed after the snapshot');
+    const expected = input.expectedSha256 ?? null;
+    if (expected && (!SHA256.test(expected) || await fileDigest(target) !== expected)) fail('ENTROROVE_WRITE_BASELINE', 'target does not match the expected snapshot hash');
+    const content = typeof input.content === 'string' ? input.content : JSON.stringify(input.content);
+    if (typeof content !== 'string') fail('ENTROROVE_CONTENT_INVALID', 'content must be text or JSON');
+    await privateDir(path.dirname(target.target)); const temporary = path.join(path.dirname(target.target), `.${path.basename(target.target)}.${randomUUID()}.tmp`);
+    await fs.writeFile(temporary, content, { flag: 'wx', mode: target.exists ? target.stat.mode & 0o777 : 0o600 }); await fs.rename(temporary, target.target);
+    await audit(input.home, verified.root, 'guarded-write', { flowId: input.flowId, stepId: input.stepId, targetPath: verified.target });
+    await appendLedgerRecord({ home: input.home, repositoryRoot: verified.root }, 'guarded-write', { flowId: input.flowId, stepId: input.stepId, targetPath: verified.target, sha256: sha256(content) });
+    return { schemaVersion: LOCAL_SCHEMA, status: 'verified', written: true, targetPath: verified.target, sha256: sha256(content) };
+  });
+}
+function enforced(context) {
+  if (!context || typeof context !== 'object' || Array.isArray(context)) fail('ENTROROVE_CONTEXT_REQUIRED', 'executionContext is required');
+  if (Object.keys(context).length === 1 && context.executionIsolation === 'local') return false;
+  if (Object.keys(context).length !== 2 || !['direct', 'sandbox'].includes(context.executionIsolation) || typeof context.cloudSandboxEnabled !== 'boolean') fail('ENTROROVE_CONTEXT_INVALID', 'executionContext is invalid');
+  if (context.executionIsolation === 'sandbox' && context.cloudSandboxEnabled !== true) fail('ENTROROVE_CONTEXT_INVALID', 'sandbox requires cloudSandboxEnabled=true');
+  return context.executionIsolation === 'sandbox';
+}
+async function budgetFile(input) { const root = await repositoryRoot(input.repositoryRoot); const flowId = id(input.flowId, 'flowId'); return { root, file: statePath(input.home, 'budgets', root, flowId, 'budget.json') }; }
+function budgetView(state, now = Date.now()) {
+  const elapsedMs = state.enforced ? state.elapsedMs + now - Date.parse(state.startedAt) : state.elapsedMs;
+  return { ...state, elapsedMs, remainingFiles: state.enforced ? Math.max(0, state.maxFiles - state.files.length) : null,
+    remainingTokenEstimate: state.enforced && state.maxTokenEstimate !== null ? Math.max(0, state.maxTokenEstimate - state.tokenEstimate) : null,
+    remainingDurationMs: state.enforced ? Math.max(0, state.maxDurationMs - elapsedMs) : null,
+    enforcement: state.enforced ? 'cloud-sandbox' : 'continuous' };
+}
+export async function budgetInit(input) {
+  const mode = input.mode; if (!READ_BUDGETS[mode]) fail('ENTROROVE_MODE_INVALID', 'mode must be lock, probe, or swarm');
+  const { root, file } = await budgetFile(input); const limits = READ_BUDGETS[mode]; const isEnforced = enforced(input.executionContext);
+  return withStateLock(file, async () => {
+    try { const existing = await readJson(file); if (existing.schemaVersion !== BUDGET_SCHEMA || existing.flowId !== input.flowId || existing.repositoryDigest !== repoKey(root) || existing.mode !== mode || canonical(existing.executionContext) !== canonical(input.executionContext)) fail('ENTROROVE_BUDGET_REINITIALIZE', 'budget is already initialized with a different scope'); return budgetView(existing); } catch (error) { if (error.code !== 'ENOENT') throw error; }
+    const state = { schemaVersion: BUDGET_SCHEMA, flowId: input.flowId, repositoryDigest: repoKey(root), mode, executionContext: input.executionContext,
+      enforced: isEnforced, startedAt: new Date().toISOString(), elapsedMs: 0, ...limits, files: [], readCalls: 0, tokenEstimate: 0, extensions: [] };
+    await atomicJson(file, state); await audit(input.home, root, 'budget-init', { flowId: input.flowId, mode }); return budgetView(state);
+  });
+}
+export async function budgetContext(input) {
+  const { root, file } = await budgetFile(input);
+  return withStateLock(file, async () => {
+    const state = await readJson(file); const isEnforced = enforced(input.executionContext); if (state.enforced && !isEnforced) fail('ENTROROVE_BUDGET_DOWNGRADE', 'an enforced sandbox budget cannot be downgraded');
+    const updated = { ...state, executionContext: input.executionContext, enforced: isEnforced }; await atomicJson(file, updated); return budgetView(updated);
+  });
+}
+export async function budgetStatus(input) { const { file } = await budgetFile(input); return budgetView(await readJson(file)); }
+export async function budgetRead(input) {
+  const { root, file } = await budgetFile(input);
+  return withStateLock(file, async () => {
+    const relative = safePath(input.path); const originalState = await readJson(file); const state = await consumeBudgetRenewal({ file, state: originalState }); const before = budgetView(state);
+    const source = await projectFile(root, relative); const bytes = source.stat.size; const tokens = Math.ceil(bytes / 4); const fresh = !state.files.includes(relative);
+    if (state.enforced && fresh && before.remainingFiles <= 0) fail('ENTROROVE_BUDGET_EXHAUSTED', 'read file budget exhausted');
+    if (state.enforced && before.remainingTokenEstimate !== null && tokens > before.remainingTokenEstimate) fail('ENTROROVE_BUDGET_EXHAUSTED', 'read token budget exhausted');
+    if (state.enforced && before.remainingDurationMs <= 0) fail('ENTROROVE_BUDGET_EXHAUSTED', 'read duration budget exhausted');
+    const updated = { ...state, files: fresh ? [...state.files, relative] : state.files, readCalls: state.readCalls + 1, tokenEstimate: state.tokenEstimate + tokens };
+    await atomicJson(file, updated); await audit(input.home, root, 'budget-read', { flowId: input.flowId, path: relative, tokens });
+    return { schemaVersion: LOCAL_SCHEMA, path: relative, content: await fs.readFile(source.target, 'utf8'), budget: budgetView(updated) };
+  });
+}
+export async function budgetExtend(input) {
+  const { root, file } = await budgetFile(input);
+  return withStateLock(file, async () => {
+    const state = await readJson(file); if (!state.enforced) fail('ENTROROVE_BUDGET_NOT_APPLICABLE', 'budget extension applies only to a cloud sandbox');
+    const confirmation = input.confirmation; const additions = input.additions;
+    if (confirmation?.answer !== 'approve' || typeof confirmation.requestId !== 'string') fail('ENTROROVE_CONFIRMATION_REQUIRED', 'explicit budget confirmation is required');
+    if (!additions || !Number.isSafeInteger(additions.files) || !Number.isSafeInteger(additions.tokenEstimate) || !Number.isSafeInteger(additions.durationMs)
+      || additions.files < 0 || additions.tokenEstimate < 0 || additions.durationMs < 0 || additions.files + additions.tokenEstimate + additions.durationMs === 0) fail('ENTROROVE_EXTENSION_INVALID', 'budget additions must be positive integers');
+    if (state.extensions.some(item => item.requestId === confirmation.requestId)) fail('ENTROROVE_CONFIRMATION_REPLAYED', 'budget confirmation was already applied');
+    const updated = { ...state, maxFiles: state.maxFiles + additions.files, maxTokenEstimate: state.maxTokenEstimate === null ? additions.tokenEstimate : state.maxTokenEstimate + additions.tokenEstimate,
+      maxDurationMs: state.maxDurationMs + additions.durationMs, extensions: [...state.extensions, { requestId: confirmation.requestId, additions, at: new Date().toISOString() }] };
+    await atomicJson(file, updated); await audit(input.home, root, 'budget-extend', { flowId: input.flowId, requestId: confirmation.requestId }); return budgetView(updated);
+  });
+}
+async function coordinationState(input, create = false) {
+  const root = await repositoryRoot(input.repositoryRoot); const flowId = id(input.flowId, 'flowId'); const file = statePath(input.home, 'coordination', root, flowId, 'state.json');
+  if (create) { try { return { root, file, state: await readJson(file) }; } catch (error) { if (error.code !== 'ENOENT') throw error; const state = { schemaVersion: COORDINATION_SCHEMA, flowId, repositoryDigest: repoKey(root), workers: [], leases: [], events: [] }; await atomicJson(file, state); return { root, file, state }; } }
+  return { root, file, state: await readJson(file) };
+}
+async function coordinateUnlocked(input) {
+  const workerCount = input.workerCount ?? 0; if (!Number.isSafeInteger(workerCount) || workerCount < 0 || workerCount > 50) fail('ENTROROVE_WORKER_LIMIT', 'workerCount must be between 0 and 50');
+  if (input.priority !== undefined && !['urgent', 'normal', 'dependency', 'background'].includes(input.priority)) fail('ENTROROVE_PRIORITY_INVALID', 'priority is invalid');
+  const authority = await coordinationState(input, true); const updated = { ...authority.state, maxWorkers: workerCount, priority: input.priority ?? 'normal', events: [...authority.state.events, { event: 'coordinate', at: new Date().toISOString() }] };
+  await atomicJson(authority.file, updated); await audit(input.home, authority.root, 'peer-coordinate', { flowId: input.flowId, workerCount }); return { schemaVersion: LOCAL_SCHEMA, status: 'verified', maxWorkers: workerCount, priority: updated.priority };
+}
+export async function peerCoordinate(input) {
+  const root = await repositoryRoot(input.repositoryRoot); const flowId = id(input.flowId, 'flowId');
+  return withStateLock(statePath(input.home, 'coordination', root, flowId, 'state.json'), () => coordinateUnlocked(input));
+}
+async function spawnUnlocked(input) {
+  const paths = normalizePaths(input.paths); const priority = input.priority ?? 'normal'; if (!['urgent', 'normal', 'dependency', 'background'].includes(priority)) fail('ENTROROVE_PRIORITY_INVALID', 'priority is invalid');
+  const authority = await coordinationState(input, true); const active = authority.state.workers.filter(worker => worker.status === 'active'); if (active.length >= (authority.state.maxWorkers ?? 0)) fail('ENTROROVE_WORKER_LIMIT', 'coordination worker budget is exhausted');
+  if (input.parentWorkerId) fail('ENTROROVE_RECURSION_FORBIDDEN', 'derived workers cannot recursively spawn workers');
+  const workerId = id(input.workerId ?? `worker-${randomUUID()}`, 'workerId'); const leaseId = `lease-${randomUUID()}`; const expiresAt = new Date(Date.now() + 300_000).toISOString();
+  const worker = { workerId, leaseId, flowId: input.flowId, paths, priority, status: 'active', expiresAt, createdAt: new Date().toISOString() };
+  await atomicJson(authority.file, { ...authority.state, workers: [...authority.state.workers, worker], leases: [...authority.state.leases, worker], events: [...authority.state.events, { event: 'spawn-bind', workerId, at: new Date().toISOString() }] });
+  return { schemaVersion: LOCAL_SCHEMA, status: 'verified', workerId, leaseId, paths, expiresAt };
+}
+export async function spawnBind(input) {
+  const root = await repositoryRoot(input.repositoryRoot); const flowId = id(input.flowId, 'flowId');
+  return withStateLock(statePath(input.home, 'coordination', root, flowId, 'state.json'), () => spawnUnlocked(input));
+}
+async function completeUnlocked(input) {
+  const authority = await coordinationState(input); const worker = authority.state.workers.find(item => item.workerId === input.workerId && item.leaseId === input.leaseId && item.status === 'active'); if (!worker) fail('ENTROROVE_LEASE_INVALID', 'coordination lease is invalid');
+  if (Date.parse(worker.expiresAt) <= Date.now()) fail('ENTROROVE_LEASE_EXPIRED', 'coordination lease has expired');
+  const status = input.status ?? 'completed'; if (!['completed', 'failed', 'blocked'].includes(status)) fail('ENTROROVE_STATUS_INVALID', 'peer status is invalid');
+  const updatedWorker = { ...worker, status, completedAt: new Date().toISOString() }; const state = { ...authority.state, workers: authority.state.workers.map(item => item.workerId === worker.workerId ? updatedWorker : item), leases: authority.state.leases.map(item => item.workerId === worker.workerId ? updatedWorker : item) };
+  await atomicJson(authority.file, state); return { schemaVersion: LOCAL_SCHEMA, status: 'verified', workerId: worker.workerId, state: status };
+}
+export async function completePeer(input) {
+  const root = await repositoryRoot(input.repositoryRoot); const flowId = id(input.flowId, 'flowId');
+  return withStateLock(statePath(input.home, 'coordination', root, flowId, 'state.json'), () => completeUnlocked(input));
+}
+async function verifyEvidenceValue(evidence, input, requireBinding = false) {
+  const fields = ['schemaVersion', 'evidenceId', 'kind', 'runner', 'command', 'exitCode', 'durationMs', 'summary', 'artifactSha256', 'subject', 'subjectDigest', 'receipt', 'flowId', 'stepId'];
+  if (!evidence || Object.keys(evidence).some(field => !fields.includes(field)) || evidence.schemaVersion !== EVIDENCE_SCHEMA || typeof evidence.evidenceId !== 'string' || !evidence.evidenceId.trim() || evidence.evidenceId.length > 200 || !['test', 'build', 'lint', 'security', 'benchmark'].includes(evidence.kind)
+    || !['local', 'trusted-runner', 'sandbox'].includes(evidence.runner) || typeof evidence.command !== 'string' || evidence.command.trim().length === 0 || evidence.command.length > 2_000 || !Number.isInteger(evidence.exitCode) || evidence.exitCode < -128 || evidence.exitCode > 255
+    || !Number.isInteger(evidence.durationMs) || evidence.durationMs < 0 || evidence.durationMs > 86_400_000 || typeof evidence.summary !== 'string' || evidence.summary.trim().length === 0 || evidence.summary.length > 4_000 || !SHA256.test(evidence.artifactSha256)) return { verified: false, reason: 'evidence schema invalid' };
+  if (evidence.runner === 'local') return { verified: false, reason: 'local evidence is incomplete without a trusted receipt' };
+  const receipt = evidence.receipt; if (!receipt || ![EVIDENCE_RECEIPT_SCHEMA, 'validator.execution-receipt/1.0'].includes(receipt.schemaVersion)) return { verified: false, reason: 'signed evidence receipt is required' };
+  const binding = { flowId: input.flowId, stepId: input.stepId, snapshotDigest: input.snapshotDigest, contractDigest: input.contractDigest };
+  if (requireBinding) return verifyTrustedEvidence(evidence, binding);
+  const subject = Object.fromEntries(Object.entries(evidence).filter(([key]) => key !== 'receipt'));
+  try { if (receipt.schemaVersion === 'validator.execution-receipt/1.0') { if (typeof input.receiptPublicKey !== 'string' || receipt.subjectDigest !== evidence.subjectDigest || receipt.result?.runner !== 'trusted-runner' || receipt.result.exitCode !== evidence.exitCode || receipt.result.durationMs !== evidence.durationMs || receipt.result.summary !== evidence.summary) throw new Error('Trusted execution receipt is not bound'); const unsigned = Object.fromEntries(Object.entries(receipt).filter(([key]) => key !== 'signature')); verifyReceipt(receipt, unsigned, { schemaVersion: 'validator.execution-receipt/1.0', publicKey: input.receiptPublicKey }); } else verifyReceipt(receipt, subject); return { verified: true, evidence }; } catch (error) { return { verified: false, reason: error instanceof Error ? error.message : String(error) }; }
+}
+export async function verifyCoordinationLease(input) {
+  const authority = await coordinationState(input); const worker = authority.state.workers.find(item => item.workerId === input.workerId && item.leaseId === input.leaseId && item.status === 'active');
+  if (!worker || Date.parse(worker.expiresAt) <= Date.now()) fail('ENTROROVE_LEASE_INVALID', 'coordination lease is invalid or expired');
+  const paths = normalizePaths(input.paths ?? []); if (paths.some(target => !worker.paths.some(scope => target === scope || target.startsWith(`${scope}/`)))) fail('ENTROROVE_LEASE_SCOPE', 'coordination lease does not cover target paths');
+  return { schemaVersion: LOCAL_SCHEMA, verified: true, workerId: worker.workerId, leaseId: worker.leaseId, paths: worker.paths, expiresAt: worker.expiresAt };
+}
+export async function signEvidence(input) {
+  const root = await repositoryRoot(input.repositoryRoot); const authority = await keyPair(input.home, root); const evidence = { ...input.evidence, schemaVersion: EVIDENCE_SCHEMA, runner: input.evidence?.runner ?? 'local' };
+  if (typeof evidence.evidenceId !== 'string' || !evidence.evidenceId.trim() || evidence.evidenceId.length > 200) fail('ENTROROVE_EVIDENCE_ID', 'evidenceId must be a non-empty string up to 200 characters');
+  if (!SHA256.test(evidence.artifactSha256)) fail('ENTROROVE_EVIDENCE_ARTIFACT', 'artifactSha256 must be a lowercase SHA-256 digest');
+  const publicKey = createPublicKey(authority.publicKey).export({ format: 'der', type: 'spki' }).toString('base64');
+  const receipt = { schemaVersion: EVIDENCE_RECEIPT_SCHEMA, keyId: authority.keyId, publicKey,
+    signature: sign(null, Buffer.from(canonical(evidence)), authority.privateKey).toString('base64url') };
+  return { ...evidence, receipt };
+}
+export async function verifyEvidence(input) { return verifyEvidenceValue(input.evidence, input); }
+export async function mergeVerified(input) {
+  const root = await repositoryRoot(input.repositoryRoot); id(input.flowId, 'flowId'); id(input.stepId, 'stepId'); if (!input.sourceRef || !input.targetRef) fail('ENTROROVE_MERGE_REFS_REQUIRED', 'sourceRef and targetRef are required');
+  if (!input.snapshotReceipt) return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', code: 'ENTROROVE_SNAPSHOT_REQUIRED' };
+  const snapshotReceipt = await loadReceipt({ receipt: input.snapshotReceipt });
+  if (snapshotReceipt.flowId !== input.flowId || snapshotReceipt.stepId !== input.stepId || snapshotReceipt.repositoryDigest !== repoKey(root)) return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', code: 'ENTROROVE_SNAPSHOT_SCOPE' };
+  let manifest;
+  try { ({ manifest } = await snapshotAuthority(input, root, snapshotReceipt)); } catch (error) { return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', code: error.code ?? 'ENTROROVE_SNAPSHOT_BINDING' }; }
+  const binding = { flowId: input.flowId, stepId: input.stepId, snapshotDigest: snapshotReceipt.snapshotDigest, contractDigest: snapshotReceipt.contractDigest, receiptPublicKey: input.receiptPublicKey };
+  const preflight = verifyArchguardPreflight(input.preflight, binding);
+  if (!preflight.verified) return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', code: 'ENTROROVE_PREFLIGHT_BLOCKED', reason: preflight.reason };
+  if (!SHA256.test(binding.contractDigest ?? '')) return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', code: 'ENTROROVE_CONTRACT_DIGEST' };
+  if (!Array.isArray(input.evidence) || input.evidence.length === 0) return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', code: 'ENTROROVE_EVIDENCE_REQUIRED' };
+  const checks = await Promise.all(input.evidence.map(evidence => verifyEvidenceValue(evidence, binding, true))); if (checks.some(check => !check.verified) || input.evidence.some(evidence => evidence.exitCode !== 0)) return { schemaVersion: LOCAL_SCHEMA, status: 'blocked', code: 'ENTROROVE_EVIDENCE_UNVERIFIED', checks };
+  let written = 0; for (const change of input.changes ?? []) { await guardedWrite({ ...change, repositoryRoot: root, home: input.home, flowId: input.flowId, stepId: input.stepId }); written += 1; }
+  await audit(input.home, root, 'merge-verified', { flowId: input.flowId, stepId: input.stepId, sourceRef: input.sourceRef, targetRef: input.targetRef });
+  await appendLedgerRecord({ home: input.home, repositoryRoot: root }, 'merge-verified', { flowId: input.flowId, stepId: input.stepId, sourceRef: input.sourceRef, targetRef: input.targetRef, snapshotDigest: binding.snapshotDigest, contractDigest: binding.contractDigest });
+  return { schemaVersion: LOCAL_SCHEMA, status: 'verified', merged: true, changes: written, sourceRef: input.sourceRef, targetRef: input.targetRef, preflightKeyId: preflight.keyId };
+}
+export async function rollback(input) {
+  const root = await repositoryRoot(input.repositoryRoot); const flowId = id(input.flowId, 'flowId'); const snapshotId = id(input.snapshotId, 'snapshotId'); const manifestPath = path.join(path.dirname(statePath(input.home, 'snapshots', root, flowId, 'manifest.json')), snapshotId, 'manifest.json'); const manifest = await readJson(manifestPath);
+  const integrity = verifySnapshotManifest(manifest, { snapshotId, flowId, stepId: input.stepId ?? manifest.stepId, repositoryDigest: repoKey(root) });
+  if (!integrity.verified) fail('ENTROROVE_SNAPSHOT_CORRUPT', integrity.reason ?? 'snapshot manifest is invalid');
+  for (const entry of manifest.files) { const target = await projectFile(root, entry.path, true); const copy = path.join(path.dirname(manifestPath), entry.path); if (entry.exists) { if (sha256(await fs.readFile(copy)) !== entry.sha256) fail('ENTROROVE_SNAPSHOT_CORRUPT', `${entry.path} snapshot copy is invalid`); await privateDir(path.dirname(target.target)); await fs.copyFile(copy, target.target); } else if (target.exists) await fs.unlink(target.target); }
+  await audit(input.home, root, 'rollback', { flowId, stepId: input.stepId ?? null, snapshotId }); return { schemaVersion: LOCAL_SCHEMA, status: 'verified', rolledBack: true, snapshotId };
+}
+export async function finalGate(input) {
+  const checks = [input.audit, input.test, input.operations]; const passed = checks.every(check => check === true || ['passed', 'green', 'complete'].includes(check?.status));
+  const evidence = Array.isArray(input.evidence) ? input.evidence : [];
+  const bound = input.preflight !== undefined || input.snapshotDigest !== undefined || input.contractDigest !== undefined;
+  const binding = { flowId: input.flowId, stepId: input.stepId, snapshotDigest: input.snapshotDigest, contractDigest: input.contractDigest, receiptPublicKey: input.receiptPublicKey };
+  const preflight = bound ? verifyArchguardPreflight(input.preflight, binding) : { verified: true };
+  const validation = evidence.length ? await Promise.all(evidence.map(item => verifyEvidenceValue(item, bound ? binding : input, bound))) : [];
+  const trusted = evidence.length > 0 && preflight.verified && validation.every(item => item.verified) && evidence.every(evidenceItem => evidenceItem.exitCode === 0);
+  const complete = passed && trusted;
+  if (input.repositoryRoot) {
+    const root = await repositoryRoot(input.repositoryRoot);
+    await appendLedgerRecord({ home: input.home, repositoryRoot: root }, 'final-gate', { flowId: input.flowId ?? null, stepId: input.stepId ?? null, status: complete ? 'complete' : 'blocked', evidenceCount: evidence.length });
+  }
+  return { schemaVersion: LOCAL_SCHEMA, status: complete ? 'complete' : 'blocked', authority: 'trusted-local-runner', checks: { audit: Boolean(passed && checks[0]), test: Boolean(passed && checks[1]), operations: Boolean(passed && checks[2]) }, evidenceCount: evidence.length, guarantee: complete ? 'local-completion-gate-green' : 'local-completion-gate-blocked', preflight: preflight.verified ? 'verified' : 'blocked' };
+}
+export const LOCAL_OPERATION_SCHEMAS = Object.fromEntries([
+  ['capabilities', []], ['snapshot-plan', ['repositoryRoot', 'flowId', 'stepId', 'paths']], ['snapshot-verify', ['repositoryRoot', 'flowId', 'stepId', 'snapshotId']],
+  ['mutate-gate', ['repositoryRoot', 'flowId', 'stepId', 'accepted', 'receipt']], ['gate-issue', ['repositoryRoot', 'flowId', 'stepId', 'accepted', 'receipt']],
+  ['gate-verify', ['repositoryRoot', 'flowId', 'stepId', 'gatePassPath', 'targetPath']], ['guarded-write', ['repositoryRoot', 'flowId', 'stepId', 'gatePassPath', 'targetPath', 'content']],
+  ['budget-init', ['repositoryRoot', 'flowId', 'mode', 'executionContext']], ['budget-context', ['repositoryRoot', 'flowId', 'executionContext']], ['budget-read', ['repositoryRoot', 'flowId', 'path']], ['budget-status', ['repositoryRoot', 'flowId']], ['budget-extend', ['repositoryRoot', 'flowId', 'confirmation', 'additions']],
+  ['peer-coordinate', ['repositoryRoot', 'flowId']], ['coordinate', ['repositoryRoot', 'flowId']], ['spawn-bind', ['repositoryRoot', 'flowId', 'paths']], ['peer-complete', ['repositoryRoot', 'flowId', 'workerId', 'leaseId']], ['complete', ['repositoryRoot', 'flowId', 'workerId', 'leaseId']], ['lease-verify', ['repositoryRoot', 'flowId', 'workerId', 'leaseId', 'paths']],
+  ['evidence-sign', ['repositoryRoot', 'evidence']], ['evidence-verify', ['repositoryRoot', 'evidence']], ['merge-verified', ['repositoryRoot', 'flowId', 'stepId', 'sourceRef', 'targetRef', 'snapshotReceipt', 'evidence', 'preflight']], ['rollback', ['repositoryRoot', 'flowId', 'snapshotId']], ['final-gate', ['repositoryRoot', 'audit', 'test', 'operations', 'evidence']],
+  ['formula-evaluate', ['formula']], ['formula-graph', ['formulas']], ['formula-final-gate', ['engine']], ['calculation-final-gate', ['engine']],
+  ['run-approved-plan', ['repositoryRoot', 'planPath', 'approvalPath', 'signerConfigPath']],
+].map(([operation, required]) => [operation, { type: 'object', additionalProperties: false, required }]));
+Object.assign(LOCAL_OPERATION_SCHEMAS, LOCAL_LEDGER_SCHEMAS);
+Object.assign(LOCAL_OPERATION_SCHEMAS, LOCAL_RENEWAL_SCHEMAS, LOCAL_PROBE_SCHEMAS);
+Object.assign(LOCAL_OPERATION_SCHEMAS, LOCAL_TASK_ROUTING_SCHEMAS);
+Object.freeze(LOCAL_OPERATION_SCHEMAS);
+export const LOCAL_CAPABILITIES = Object.freeze({ schemaVersion: LOCAL_SCHEMA, operations: Object.freeze([
+  'capabilities', 'snapshot-plan', 'snapshot-verify', 'mutate-gate', 'gate-issue', 'gate-verify', 'guarded-write',
+  'budget-init', 'budget-context', 'budget-read', 'budget-status', 'budget-extend', 'peer-coordinate', 'spawn-bind',
+  'peer-complete', 'complete', 'lease-verify', 'evidence-sign', 'evidence-verify', 'merge-verified', 'rollback', 'final-gate',
+  'formula-evaluate', 'formula-graph', 'formula-final-gate', 'calculation-final-gate', 'run-approved-plan',
+  ...Object.keys(LOCAL_LEDGER_OPERATIONS),
+  ...Object.keys(LOCAL_RENEWAL_OPERATIONS), ...Object.keys(LOCAL_PROBE_OPERATIONS),
+  ...Object.keys(LOCAL_TASK_ROUTING_OPERATIONS),
+]), operationSchemas: LOCAL_OPERATION_SCHEMAS, stateDirectory: '~/.entrorove', forbidGitBranch: true, forbidWorktree: true, evidenceSchema: EVIDENCE_SCHEMA, budgets: READ_BUDGETS, validatorRunner: RUNNER_CAPABILITIES });
+export function capabilities() { return LOCAL_CAPABILITIES; }
+export const guardedWriteFile = guardedWrite;
+export const verifyMutationPassFile = verifyMutationPass;
+export const initializeReadBudget = budgetInit;
+export const configureReadBudgetContext = budgetContext;
+export const readFileWithinBudget = budgetRead;
+export const readBudgetStatus = budgetStatus;
+export const extendReadBudget = budgetExtend;
+export const runLocalFinalGate = finalGate;
+export { Decimal, evaluateFormula, evaluateFormulaGraph, formulaFinalGate, formulaFinalGateFile, runApprovedPlan };
+export { LOCAL_LEDGER_OPERATIONS };
+export { LOCAL_RENEWAL_OPERATIONS, LOCAL_PROBE_OPERATIONS };
+export { branchCreate, branchList, branchSwitch, diffReport, preflight, ledgerQuery, appendLedgerRecord, chainInit, chainResume, chainStatus, chainAnswer };
+export { budgetAutoRenewRequest, budgetAutoRenew, budgetAutoRenewStop, probe, reassess };
+export { LOCAL_TASK_ROUTING_OPERATIONS, taskDescribe, messageRoute, messageAccept, taskResume };