@entrorove/skill 0.1.61 → 0.1.64

package/scope-amendment-client.mjs

@@ -113,7 +113,7 @@ export async function runScopeAmend(repositoryRoot, input, dependencies) {
     return { schemaVersion, status: 'blocked', flowId: input?.flowId,
       code: error?.code?.startsWith('ENTROROVE_') ? error.code : 'ENTROROVE_SCOPE_AMENDMENT_PREREQUISITE',
       message: ['ENTROROVE_SCOPE_AMENDMENT_BINDING', 'ENTROROVE_SCOPE_AMENDMENT_STATE', 'ENTROROVE_SCOPE_AMENDMENT_UNKNOWN',
-        'ENTROROVE_SCOPE_AMENDMENT_NOT_SENT'].includes(error?.code) ? error.message
+        'ENTROROVE_SCOPE_AMENDMENT_NOT_SENT', 'ENTROROVE_SCOPE_AMENDMENT_MUTATION_PENDING'].includes(error?.code) ? error.message
         : 'Scope amendment stopped; preserve the original proposal, signer, journal and actual evidence.',
       ...(requestId ? { requestId } : {}), ...(error?.output ? { output: error.output } : {}),
       ...(error?.feedback ? { feedback: error.feedback } : {}),

package/scope-amendment-consumption.mjs

@@ -0,0 +1,32 @@
+import path from 'node:path';
+import { canonical, sha256 } from './local-integrity.mjs';
+import { withStateLock } from './local-state-lock.mjs';
+import { mutationFail14, privateMutationDirectory14 } from './local-mutation-files.mjs';
+import { preservedMutationConsumptionState, attestMutationConsumption14 } from './local-mutation-consumption.mjs';
+import { readMutationConnection } from './mutation-connection-state.mjs';
+
+export async function observeScopeMutationConsumption(location, state, pass) {
+  // A pending S keeps its exact old attestation and is recovered with GET. A
+  // new signed S challenge can observe the same physical writes afresh, but
+  // must not fork an unresolved settlement of that original M receipt.
+  if (state.pending || state.attestation) mutationFail14('ENTROROVE_SCOPE_AMENDMENT_MUTATION_PENDING',
+    'Recover the original pending scope request before observing its M consumption again');
+  const input = { repositoryRoot: location.root, home: location.home,
+    flowId: pass.flowId, taskId: pass.taskId, stepId: pass.stepId, gatePassPath: location.identity.gatePassPath };
+  const original = await preservedMutationConsumptionState(input), { binding } = original;
+  if (canonical(original.pass) !== canonical(pass)) mutationFail14('ENTROROVE_SCOPE_AMENDMENT_BINDING', 'Original mutation pass changed');
+  const directory = path.join(binding.directory, 'settlements');
+  await privateMutationDirectory14(directory, { privateFrom: binding.stateRoot });
+  const journal = { ...binding, file: path.join(directory, `${pass.passId}.json`) };
+  const identity = { flowId: pass.flowId, stepId: pass.stepId, passDigest: sha256(canonical(pass)),
+    repositoryRoot: binding.root, apiOrigin: location.identity.apiOrigin, mutationKeyId: binding.binding.keyId };
+  return withStateLock(journal.file, async () => {
+    const settlement = await readMutationConnection(journal, identity);
+    if (settlement.pending || settlement.settled) mutationFail14('ENTROROVE_SCOPE_AMENDMENT_MUTATION_PENDING',
+      'Recover the original mutation-settle request before a fresh scope observation; do not replace its receipt');
+    // Renewal re-reads every original target and protected file, verifies the
+    // old signature and write times, and archives the expired observation.
+    // The original pass, write ledger and their expiry remain unchanged.
+    return attestMutationConsumption14(input, { renewExpired: true });
+  });
+}

package/scope-amendment-mutation.mjs

@@ -1,12 +1,12 @@
 import { mutationPass14 } from './local-mutation-wire.mjs';
 import { readMutationJson14 } from './local-mutation-files.mjs';
-import { attestMutationConsumption14 } from './local-mutation-consumption.mjs';
+import { observeScopeMutationConsumption } from './scope-amendment-consumption.mjs';
 import { amendmentFail } from './scope-amendment-wire.mjs';
 import path from 'node:path';
 import { sha256 } from './local-integrity.mjs';
 
 export async function scopeAmendmentMutation(location, state, challenge, facts) {
-  const changed = challenge.files.filter(file => file.access === 'write'
+  const changed = challenge.files.filter(file => file.access !== 'read-only'
     && facts.files.find(actual => actual.path === file.path)?.sha256 !== challenge.currentFiles.find(current => current.path === file.path)?.sha256);
   if (!changed.length || challenge.purpose !== 'scope-revision-refresh') return undefined;
   const gatePassPath = location.identity.gatePassPath;
@@ -20,7 +20,6 @@ export async function scopeAmendmentMutation(location, state, challenge, facts)
     || pass.memberScopeKeyId !== challenge.keyId || pass.memberScopeBindingDigest !== challenge.originalBindingDigest
     || pass.scopeRevisionDigest !== challenge.authorityRevisionDigest
     || changed.some(file => !pass.paths.includes(file.path))) amendmentFail('Scope refresh cannot replace its actual original mutation pass or approved write paths');
-  const observed = await attestMutationConsumption14({ repositoryRoot: location.root, home: location.home,
-    flowId: pass.flowId, taskId: pass.taskId, stepId: pass.stepId, gatePassPath }, { allowExpiredReplay: true });
+  const observed = await observeScopeMutationConsumption(location, state, pass);
   return { passId: pass.passId, consumptionReceipt: observed.consumptionReceipt };
 }

package/scope-amendment-observer.mjs

@@ -12,7 +12,9 @@ import { scopeAmendmentMutation } from './scope-amendment-mutation.mjs';
 async function inspectFiles(location, challenge) {
   const physical = new Set();
   for (const file of challenge.files) {
-    const target = await scopeTarget(location.root, file.path);
+    const target = await scopeTarget(location.root, file.path, file.access === 'create');
+    if (!target.exists && file.access === 'create') continue;
+    if (file.access === 'create' && challenge.purpose === 'scope-revision') amendmentFail('A create role requires an actually absent target before approval is applied');
     if (!target.stat.isFile()) amendmentFail('Scope amendment permits only exact existing ordinary files');
     const identity = `${target.stat.dev}:${target.stat.ino}`;
     if (physical.has(identity)) amendmentFail('Scope amendment roles cannot alias the same physical file');
@@ -25,7 +27,8 @@ export async function observeScopeAmendment(location, state) {
   if (!state.snapshotId) { state.snapshotId = `scope-amend-${randomUUID()}`; await saveScopeAmendmentState(location, state); }
   const input = { repositoryRoot: location.root, home: location.home, flowId: challenge.flowId, stepId: challenge.stepId,
     snapshotId: state.snapshotId, paths: challenge.files.map(file => file.path).sort(),
-    contractDigest: challenge.proposalDigest, importContexts: location.binding.importContexts };
+    contractDigest: challenge.proposalDigest, importContexts: location.binding.importContexts,
+    scopeCreatePaths: challenge.files.filter(file => file.access === 'create').map(file => file.path) };
   if (!state.snapshot) {
     if (!state.snapshotStarted) {
       state.snapshotStarted = true; await saveScopeAmendmentState(location, state);
@@ -43,7 +46,8 @@ export async function observeScopeAmendment(location, state) {
   facts.snapshotEvidence = await verifyFreshScopeSnapshot(input, location.root, facts);
   for (const file of challenge.files) {
     const actual = facts.files.find(item => item.path === file.path);
-    if (!actual?.exists || (challenge.purpose === 'scope-revision' || file.access === 'read-only') && actual.sha256 !== file.sha256) {
+    if (!actual || file.access !== 'create' && !actual.exists
+      || (challenge.purpose === 'scope-revision' || file.access === 'read-only') && actual.sha256 !== file.sha256) {
       amendmentFail('Scope amendment bytes differ from the exact original approved roles');
     }
   }

package/scope-amendment-remote.mjs

@@ -6,6 +6,7 @@ import { acknowledgeAutomaticFeedback, queryAutomaticFeedback, verifyAutomaticFe
 import { readInvocations } from './local-invocations.mjs';
 import { saveScopeAmendmentState } from './scope-amendment-state.mjs';
 import { amendmentFail } from './scope-amendment-wire.mjs';
+import { retireMissingChallenge } from './scope-amendment-retirement.mjs';
 
 const unknown = requestId => Object.assign(new Error('Scope amendment outcome is unknown; recover the original request with GET only'),
   { code: 'ENTROROVE_SCOPE_AMENDMENT_UNKNOWN', outcomeUnknown: true, requestId });
@@ -15,13 +16,16 @@ async function recover(pending, dependencies) {
     const response = await requestTransport(origin, `/api/skill/status/${pending.requestId}`, {
       headers: { authorization: `Bearer ${token}`, ...ideClientHeaders() } });
     const result = parseTransportResponse(response, 'original scope amendment status');
+    if (response.status === 404 && result?.error === 'request-not-found') {
+      throw Object.assign(unknown(pending.requestId), { requestNotFound: true });
+    }
     if (result?.output?.requestId !== pending.requestId || response.status >= 500
       || ['running', 'pending'].includes(result.output.status)) throw unknown(pending.requestId);
     result.feedback ??= await queryAutomaticFeedback(pending.requestId, dependencies);
     verifyAutomaticFeedback(result.feedback, pending.requestId, pending.requestId);
     result.feedback = await acknowledgeAutomaticFeedback(result.feedback, origin, token, ideClientHeaders());
     return { response, result };
-  } catch { throw unknown(pending.requestId); }
+  } catch (error) { throw error?.requestNotFound ? error : unknown(pending.requestId); }
 }
 async function notSent(pending, home) {
   try {
@@ -36,7 +40,13 @@ export async function amendmentRemote(stage, operation, payload, state, location
     if (state.pending.stage !== stage || state.pending.requestId !== requestId || canonical(state.pending.input) !== canonical(input)) {
       amendmentFail('Recover the original amendment request before another operation');
     }
-    ({ response, result } = await recover(state.pending, dependencies));
+    if (state.challengeRetirement) await retireMissingChallenge(state, location, dependencies, recover, notSent);
+    try { ({ response, result } = await recover(state.pending, dependencies)); }
+    catch (error) {
+      if (!error?.requestNotFound || stage !== 'challenged') throw error;
+      await retireMissingChallenge(state, location, dependencies, recover, notSent);
+      ({ response, result } = await recover(state.pending, dependencies));
+    }
   } else {
     state.pending = { stage, operation: 'continue', input, requestId };
     await saveScopeAmendmentState(location, state);

package/scope-amendment-retirement.mjs

@@ -0,0 +1,54 @@
+import { canonical, sha256 } from './local-integrity.mjs';
+import { buildInvocation, invokeRemoteResult } from './remote-client.mjs';
+import { scopeRevisionAuthority, amendmentFail } from './scope-amendment-wire.mjs';
+import { saveScopeAmendmentState } from './scope-amendment-state.mjs';
+
+export async function retireMissingChallenge(state, location, dependencies, recover, notSent) {
+  const original = state.pending;
+  if (original.stage !== 'challenged' || original.input.operation !== 'workflow-scope-challenge') {
+    amendmentFail('Only the original missing challenge preparation has a retirement path');
+  }
+  const input = { requestId: original.requestId, flowId: original.input.flowId, payload: original.input.payload };
+  const call = buildInvocation('scope-challenge-retire', input);
+  let attempt = state.challengeRetirement;
+  if (attempt && (attempt.requestId !== call.requestId || canonical(attempt.input) !== canonical(input))) {
+    amendmentFail('Challenge retirement must retain its original preparation envelope');
+  }
+  if (!attempt) {
+    attempt = state.challengeRetirement = { requestId: call.requestId, input, state: 'pending' };
+    await saveScopeAmendmentState(location, state);
+    try {
+      const { result } = await invokeRemoteResult({ operation: 'scope-challenge-retire', input }, dependencies);
+      attempt.output = result.output; attempt.feedback = result.feedback; attempt.state = 'completed';
+      await saveScopeAmendmentState(location, state);
+    } catch (error) {
+      if (await notSent(attempt, dependencies.home)) {
+        attempt.state = 'not-sent'; await saveScopeAmendmentState(location, state);
+      }
+      throw error;
+    }
+  } else if (attempt.state !== 'completed') {
+    // A retirement with an uncertain outcome has its own original GET. Neither
+    // the original challenge nor the retirement is retransmitted here.
+    if (attempt.state === 'not-sent') {
+      delete state.challengeRetirement; await saveScopeAmendmentState(location, state);
+      return retireMissingChallenge(state, location, dependencies, recover, notSent);
+    }
+    const { result } = await recover(attempt, dependencies);
+    attempt.output = result.output; attempt.feedback = result.feedback; attempt.state = 'completed';
+    await saveScopeAmendmentState(location, state);
+  }
+  const output = attempt.output;
+  if (output?.requestId !== call.requestId) amendmentFail('Retirement lost its original request identity');
+  if (output.status === 'blocked' && output.result?.reason === 'original-admission-already-recorded') return;
+  if (output.status !== 'succeeded' || output.result?.retired !== true) amendmentFail('The server did not retire this original missing preparation');
+  const receipt = scopeRevisionAuthority(output.result.retirement, 'entrorove.scope-challenge-retirement/1.0');
+  if (receipt.purpose !== 'scope-challenge-retirement' || receipt.requestId !== original.requestId
+    || receipt.retirementRequestId !== call.requestId || receipt.flowId !== input.flowId
+    || receipt.proposalId !== input.payload.proposalId || receipt.proposalDigest !== input.payload.proposalDigest
+    || receipt.receiverId !== input.payload.receiverId || receipt.attemptId !== input.payload.attemptId
+    || receipt.originalInputDigest !== sha256(canonical(original.input)) || receipt.outcome !== 'retired-before-admission'
+    || ['claimsOriginalExecution', 'grantsExecutionAuthority', 'grantsWriteAuthority', 'claimsCompletion'].some(key => receipt[key] !== false)) {
+    amendmentFail('Challenge retirement changed its exact original preparation or authority boundary');
+  }
+}

package/scope-amendment-state.mjs

@@ -10,11 +10,14 @@ import { trustedOrigin } from './remote-transport.mjs';
 
 const fail = message => scopeFail('ENTROROVE_SCOPE_AMENDMENT_STATE', message);
 const maximumStateBytes = 1_000_000;
-async function privateItem(file, final = 'file') {
+// A journal retains the challenge, S proof, original pending request and full
+// signed response together. Each signed authority retains its own 1 MB bound.
+const maximumJournalBytes = 8_000_000;
+async function privateItem(file, final = 'file', maximumBytes = maximumStateBytes) {
   const value = await mutationFile14(file, { final });
   if (process.getuid && value.stat.uid !== process.getuid()
     || process.platform !== 'win32' && value.stat.mode & 0o077
-    || final === 'file' && (value.stat.nlink !== 1 || value.stat.size > maximumStateBytes)) {
+    || final === 'file' && (value.stat.nlink !== 1 || value.stat.size > maximumBytes)) {
     fail('Scope amendment controls must be bounded private files owned by the current OS account');
   }
   return value;
@@ -80,7 +83,7 @@ export async function scopeAmendmentLocation(repositoryRoot, input, dependencies
 }
 export async function readScopeAmendmentState(location) {
   let value;
-  try { await privateItem(location.file); value = await readMutationJson14(location.file); }
+  try { await privateItem(location.file, 'file', maximumJournalBytes); value = await readMutationJson14(location.file); }
   catch (error) { if (error.code !== 'ENOENT') throw error; }
   if (!value) return { schemaVersion: 'entrorove.scope-amendment-state/1.0', identity: location.identity };
   if (value.schemaVersion !== 'entrorove.scope-amendment-state/1.0'
@@ -89,6 +92,6 @@ export async function readScopeAmendmentState(location) {
   return value;
 }
 export async function saveScopeAmendmentState(location, value) {
-  if (Buffer.byteLength(canonical(value)) > maximumStateBytes) fail('Scope amendment state exceeds its bounded private file limit');
+  if (Buffer.byteLength(canonical(value)) + 1 > maximumJournalBytes) fail('Scope amendment state exceeds its bounded private file limit');
   return atomicMutationJson14(location.file, value, { privateFrom: location.stateRoot, replace: true });
 }

package/scope-amendment-wire.mjs

@@ -22,8 +22,9 @@ export function amendmentFiles(files, original) {
   if (!Array.isArray(files) || !files.length || files.length > 512) amendmentFail('Scope amendment requires a bounded complete exact role list');
   const requirements = new Set(original?.requirements?.length ? original.requirements.map(item => item.id) : ['task-goal']);
   for (const file of files) {
-    amendmentExact(file, ['path', 'sha256', 'access', 'requirementRefs', 'reason']); scopePath(file.path);
-    if (!hash.test(file.sha256) || !['write', 'read-only'].includes(file.access)
+    amendmentExact(file, ['path', 'sha256', 'access', 'requirementRefs', 'reason', ...(file.access === 'create' ? ['producerNodeRef'] : [])]); scopePath(file.path);
+    if (!hash.test(file.sha256) || !['write', 'read-only', 'create'].includes(file.access)
+      || file.access === 'create' && (!identifier.test(file.producerNodeRef) || file.sha256 !== sha256('entrorove.missing-file/1.0'))
       || typeof file.reason !== 'string' || !file.reason.trim() || file.reason.length > 2000
       || !Array.isArray(file.requirementRefs) || !file.requirementRefs.length || file.requirementRefs.length > 512
       || new Set(file.requirementRefs).size !== file.requirementRefs.length

package/task-entry-client.mjs

@@ -28,5 +28,6 @@ export async function routeTaskEntry(data, token, dependencies) {
   if (!task || typeof task.goal !== 'string') throw new Error('Task entry requires the original task goal');
   const ideTaskId = ideTaskIdentity(data.ideTaskId);
   return runCloudTask({ goal: task.goal, task,
+    ...(data.images === undefined ? {} : { images: data.images }),
     ...(ideTaskId ? { ideTaskId } : {}),...(choice ? { sandboxChoice: choice } : {}) },dependencies);
 }

package/workflow-observation-client.mjs

@@ -5,6 +5,7 @@ const safeId = value => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:-
 const safeRequest = value => typeof value === 'string' && /^[a-f0-9]{64}$/.test(value);
 const messages = {
   ENTROROVE_LOCAL_OBSERVATION_UNKNOWN: 'Original observation outcome is unknown; recover its original GET without repeating execution',
+  ENTROROVE_LOCAL_OBSERVATION_REJECTED: 'Original observation request failed and was acknowledged; repair its cause and read the original live task guidance',
   ENTROROVE_LOCAL_OBSERVATION_NOT_SENT: 'Observation was not transmitted; repair its local or discovery prerequisite and reuse the original input',
   ENTROROVE_LOCAL_OBSERVATION_PREREQUISITE: 'Local observation requires cloud sandbox disabled and its original live execution lease',
   ENTROROVE_SCOPE_RECEIPT_EXPIRED: 'Refresh the original scope evidence and reuse the original observation input',
@@ -24,6 +25,11 @@ function blocked(error, input) {
       'ENTROROVE_SCOPE_RUNNER_REQUIRED', 'ENTROROVE_SCOPE_SNAPSHOT_REQUIRED', 'ENTROROVE_SCOPE_AFTER_WRITE_REQUIRED'].includes(code));
   const reason = ['sandbox-enabled', 'cloud-sandbox-enabled', 'lease-expired', 'receipt-expired', 'after-write-observation-required'].includes(output?.reason)
     ? output.reason : undefined;
+  const rejected = code === 'ENTROROVE_LOCAL_OBSERVATION_REJECTED' && cause.knownTerminalFailure === true
+    && requestId && cause.rejection?.status === 'failed' && cause.rejection.acknowledged === true
+    && /^[a-f0-9-]{36}$/.test(cause.rejection.receiptId ?? '')
+    && Number.isSafeInteger(cause.rejection.generation) && cause.rejection.generation > 0
+    && ['member-observation-admit', 'member-observation-report'].includes(cause.rejection.operation);
   return { schemaVersion: 'entrorove.local-observation-connection/1.0', status: 'blocked',
     ...(safeId(input?.flowId) ? { flowId: input.flowId } : {}), independentValidation: 'pending', code,
     message: messages[code] ?? 'Local observation could not continue; its original command and result remain preserved',
@@ -33,6 +39,11 @@ function blocked(error, input) {
         ...(safeRequest(output.requestId) ? { resumeRequestId: output.requestId } : {}) } } } : {}),
     ...(cause.outcomeUnknown === true && requestId ? { outcomeUnknown: true, requestId, repeatPost: false,
       nextAction: { operation: 'workflow-observe-step', reuseOriginalInput: true, method: 'GET' } } : {}),
+    ...(rejected ? { outcomeUnknown: false, requestId, repeatPost: false, grantsExecutionAuthority: false,
+      rejection: { operation: cause.rejection.operation, status: 'failed', receiptId: cause.rejection.receiptId,
+        generation: cause.rejection.generation, acknowledged: true, effects: 'not-inferred' },
+      nextAction: { operation: 'task-resume', input: { flowId: input.flowId }, preserveOriginalFlow: true,
+        localProcessMayStart: false, originalRequestRetained: true } } : {}),
     ...(cause.knownBeforeTransmission === true && requestId ? { requestId, knownBeforeTransmission: true } : {}) };
 }
 export async function runWorkflowObserveStep(repositoryRoot, input, dependencies) {

package/workflow-observation-connection.mjs

@@ -9,7 +9,8 @@ import { verifyWorkflowLocalAcceptance } from './workflow-local-acceptance.mjs';
 import { buildInvocation } from './remote-client.mjs';
 
 async function connect(input, state, location, dependencies) {
-  const fields = ['taskId', 'flowId', 'stepId', 'leaseId', 'generation', ...(Object.hasOwn(input, 'settlementId') ? ['settlementId'] : [])];
+  const fields = ['taskId', 'flowId', 'stepId', 'leaseId', 'generation', ...(Object.hasOwn(input, 'settlementId') ? ['settlementId'] : []),
+    ...(Object.hasOwn(input, 'dependencyRepairDigest') ? ['dependencyRepairDigest'] : [])];
   const original = Object.fromEntries(fields.map(key => [key, input[key]]));
   const admitted = state.admitted ?? await observationRemote('admitted', 'member-observation-admit', original, state, location, dependencies);
   const admission = observationAdmission(admitted.admission, input, { allowExpired: Boolean(state.result) });

package/workflow-observation-remote.mjs

@@ -51,6 +51,18 @@ function cachedReportPrerequisite(result, pending, state, location) {
     && next.reuseOriginalInput === true && next.resumeRequestId === pending.requestId && next.preserveOriginalFlow === true
     && result.feedback?.acknowledgement?.stored === true && result.feedback.resultDigest === sha256(canonical(output));
 }
+function terminalRejection(result, pending) {
+  const output = result?.output, feedback = result?.feedback, ack = feedback?.acknowledgement;
+  try { verifyAutomaticFeedback(feedback, pending.requestId, pending.requestId); } catch { return null; }
+  if (output?.schemaVersion !== 'entrorove.skill.response/1.0' || output.requestId !== pending.requestId
+    || output.status !== 'failed' || feedback.resultDigest !== sha256(canonical(output))
+    || feedback.evaluation.operation !== pending.operation || feedback.evaluation.status !== 'failed'
+    || ack?.stored !== true || ack.requestId !== pending.requestId || ack.receiptId !== feedback.receiptId
+    || ack.generation !== (feedback.generation ?? 1)) return null;
+  return { operation: pending.operation, status: 'failed', receiptId: feedback.receiptId,
+    generation: feedback.generation ?? 1, acknowledged: true, effects: 'not-inferred',
+    ...(/^[a-z][a-z0-9-]{0,63}$/.test(output.error ?? '') ? { error: output.error } : {}) };
+}
 export async function observationRemote(stage, operation, input, state, location, dependencies) {
   const requestId = buildInvocation(operation, input).requestId;
   let response, result;
@@ -79,6 +91,17 @@ export async function observationRemote(stage, operation, input, state, location
       throw Object.assign(new Error(result.output.message ?? 'Original local observation prerequisite is unresolved'),
         { code: result.output.code, output: result.output });
     }
+    const rejection = terminalRejection(result, state.pending);
+    if (rejection) {
+      const failure = { ...state.pending, output: result.output, feedback: result.feedback };
+      if (canonical(state.failures?.at(-1) ?? null) !== canonical(failure)) state.failures = [...(state.failures ?? []), failure];
+      state.rejection = failure;
+      // Keep the original pending binding: a known failure grants no retry,
+      // no replacement admission and no second launch of a cached process.
+      await saveObservationState(location, state);
+      throw Object.assign(new Error('The original observation request failed and its receipt was acknowledged'),
+        { code: 'ENTROROVE_LOCAL_OBSERVATION_REJECTED', knownTerminalFailure: true, requestId, rejection });
+    }
     throw unknown(requestId);
   }
   state[stage] = result.output; delete state.pending; await saveObservationState(location, state);
@@ -91,9 +114,11 @@ export async function authorizeObservation(admission, dependencies, launching) {
   const status = parseTransportResponse(response, 'original local observation account');
   if (!response.ok || status?.schemaVersion !== 'entrorove.flow-status/1.0'
     || status.flow?.flowId !== admission.flowId || status.flow.ownerId !== admission.ownerId
-    || launching && (status.flow.stepId !== admission.stepId || status.flow.status !== 'running'
+    || launching && (status.flow.stepId !== admission.stepId && !memberProducerRepairStepMatches(status, admission)
+      || status.flow.status !== 'running'
       || status.workflow?.phase !== 'execute' || status.workflow.terminalAt
       || ['pending', 'declined'].includes(status.workflow.authorization))) {
     observationFail('Current account cannot confirm its original local observation task and execution step');
   }
 }
+import { memberProducerRepairStepMatches } from './member-producer-repair-authority.mjs';

package/workflow-observation-wire.mjs

@@ -10,9 +10,11 @@ export function observationExact(value, fields) {
     || canonical(Object.keys(value).sort()) !== canonical([...fields].sort())) observationFail('Local observation fields are invalid');
 }
 export function observationInput(input) {
-  const fields = Object.hasOwn(input ?? {}, 'settlementId') ? observationIdentityFields : observationReadOnlyIdentityFields;
+  const fields = [...(Object.hasOwn(input ?? {}, 'settlementId') ? observationIdentityFields : observationReadOnlyIdentityFields),
+    ...(Object.hasOwn(input ?? {}, 'dependencyRepairDigest') ? ['dependencyRepairDigest'] : [])];
   observationExact(input, fields);
-  for (const field of fields.filter(field => field !== 'generation')) mutationId14(input[field], field);
+  for (const field of fields.filter(field => !['generation', 'dependencyRepairDigest'].includes(field))) mutationId14(input[field], field);
+  if (Object.hasOwn(input, 'dependencyRepairDigest') && !/^[a-f0-9]{64}$/.test(input.dependencyRepairDigest)) observationFail('Dependency repair reference must be its exact accepted server digest');
   if (!Number.isSafeInteger(input.generation) || input.generation < 1) observationFail('Local observation generation is invalid');
   return input;
 }
@@ -53,7 +55,8 @@ export function observationAuthoritySignature(value) {
 }
 export function observationAdmission(value, input, { allowExpired = false } = {}) {
   const readOnly = !Object.hasOwn(input, 'settlementId');
-  const fields = readOnly ? observationReadOnlyIdentityFields : observationIdentityFields;
+  const fields = [...(readOnly ? observationReadOnlyIdentityFields : observationIdentityFields),
+    ...(Object.hasOwn(input, 'dependencyRepairDigest') ? ['dependencyRepairDigest'] : [])];
   observationExact(value, [...fields, 'schemaVersion', 'purpose', 'observationId', 'ownerId', 'taskDigest',
     'chainDigest', 'epoch', 'planId', 'planDigest', 'executionPlanSha256', 'repositoryDigest',
     ...(readOnly ? ['sourceKind'] : ['settlementDigest']), 'command',