@entrorove/skill 0.1.62 → 0.1.64

package/workflow-observation-remote.mjs

@@ -51,6 +51,18 @@ function cachedReportPrerequisite(result, pending, state, location) {
     && next.reuseOriginalInput === true && next.resumeRequestId === pending.requestId && next.preserveOriginalFlow === true
     && result.feedback?.acknowledgement?.stored === true && result.feedback.resultDigest === sha256(canonical(output));
 }
+function terminalRejection(result, pending) {
+  const output = result?.output, feedback = result?.feedback, ack = feedback?.acknowledgement;
+  try { verifyAutomaticFeedback(feedback, pending.requestId, pending.requestId); } catch { return null; }
+  if (output?.schemaVersion !== 'entrorove.skill.response/1.0' || output.requestId !== pending.requestId
+    || output.status !== 'failed' || feedback.resultDigest !== sha256(canonical(output))
+    || feedback.evaluation.operation !== pending.operation || feedback.evaluation.status !== 'failed'
+    || ack?.stored !== true || ack.requestId !== pending.requestId || ack.receiptId !== feedback.receiptId
+    || ack.generation !== (feedback.generation ?? 1)) return null;
+  return { operation: pending.operation, status: 'failed', receiptId: feedback.receiptId,
+    generation: feedback.generation ?? 1, acknowledged: true, effects: 'not-inferred',
+    ...(/^[a-z][a-z0-9-]{0,63}$/.test(output.error ?? '') ? { error: output.error } : {}) };
+}
 export async function observationRemote(stage, operation, input, state, location, dependencies) {
   const requestId = buildInvocation(operation, input).requestId;
   let response, result;
@@ -79,6 +91,17 @@ export async function observationRemote(stage, operation, input, state, location
       throw Object.assign(new Error(result.output.message ?? 'Original local observation prerequisite is unresolved'),
         { code: result.output.code, output: result.output });
     }
+    const rejection = terminalRejection(result, state.pending);
+    if (rejection) {
+      const failure = { ...state.pending, output: result.output, feedback: result.feedback };
+      if (canonical(state.failures?.at(-1) ?? null) !== canonical(failure)) state.failures = [...(state.failures ?? []), failure];
+      state.rejection = failure;
+      // Keep the original pending binding: a known failure grants no retry,
+      // no replacement admission and no second launch of a cached process.
+      await saveObservationState(location, state);
+      throw Object.assign(new Error('The original observation request failed and its receipt was acknowledged'),
+        { code: 'ENTROROVE_LOCAL_OBSERVATION_REJECTED', knownTerminalFailure: true, requestId, rejection });
+    }
     throw unknown(requestId);
   }
   state[stage] = result.output; delete state.pending; await saveObservationState(location, state);
@@ -91,9 +114,11 @@ export async function authorizeObservation(admission, dependencies, launching) {
   const status = parseTransportResponse(response, 'original local observation account');
   if (!response.ok || status?.schemaVersion !== 'entrorove.flow-status/1.0'
     || status.flow?.flowId !== admission.flowId || status.flow.ownerId !== admission.ownerId
-    || launching && (status.flow.stepId !== admission.stepId || status.flow.status !== 'running'
+    || launching && (status.flow.stepId !== admission.stepId && !memberProducerRepairStepMatches(status, admission)
+      || status.flow.status !== 'running'
       || status.workflow?.phase !== 'execute' || status.workflow.terminalAt
       || ['pending', 'declined'].includes(status.workflow.authorization))) {
     observationFail('Current account cannot confirm its original local observation task and execution step');
   }
 }
+import { memberProducerRepairStepMatches } from './member-producer-repair-authority.mjs';

package/workflow-observation-wire.mjs

@@ -10,9 +10,11 @@ export function observationExact(value, fields) {
     || canonical(Object.keys(value).sort()) !== canonical([...fields].sort())) observationFail('Local observation fields are invalid');
 }
 export function observationInput(input) {
-  const fields = Object.hasOwn(input ?? {}, 'settlementId') ? observationIdentityFields : observationReadOnlyIdentityFields;
+  const fields = [...(Object.hasOwn(input ?? {}, 'settlementId') ? observationIdentityFields : observationReadOnlyIdentityFields),
+    ...(Object.hasOwn(input ?? {}, 'dependencyRepairDigest') ? ['dependencyRepairDigest'] : [])];
   observationExact(input, fields);
-  for (const field of fields.filter(field => field !== 'generation')) mutationId14(input[field], field);
+  for (const field of fields.filter(field => !['generation', 'dependencyRepairDigest'].includes(field))) mutationId14(input[field], field);
+  if (Object.hasOwn(input, 'dependencyRepairDigest') && !/^[a-f0-9]{64}$/.test(input.dependencyRepairDigest)) observationFail('Dependency repair reference must be its exact accepted server digest');
   if (!Number.isSafeInteger(input.generation) || input.generation < 1) observationFail('Local observation generation is invalid');
   return input;
 }
@@ -53,7 +55,8 @@ export function observationAuthoritySignature(value) {
 }
 export function observationAdmission(value, input, { allowExpired = false } = {}) {
   const readOnly = !Object.hasOwn(input, 'settlementId');
-  const fields = readOnly ? observationReadOnlyIdentityFields : observationIdentityFields;
+  const fields = [...(readOnly ? observationReadOnlyIdentityFields : observationIdentityFields),
+    ...(Object.hasOwn(input, 'dependencyRepairDigest') ? ['dependencyRepairDigest'] : [])];
   observationExact(value, [...fields, 'schemaVersion', 'purpose', 'observationId', 'ownerId', 'taskDigest',
     'chainDigest', 'epoch', 'planId', 'planDigest', 'executionPlanSha256', 'repositoryDigest',
     ...(readOnly ? ['sourceKind'] : ['settlementDigest']), 'command',