@entrorove/skill 0.1.62 → 0.1.67

package/design-store.mjs

@@ -0,0 +1,116 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { inflateSync } from 'node:zlib';
+import { mutationRoot14, mutationStateRoot14, mutationTarget14, mutationRead14, privateMutationDirectory14, readMutationJson14,
+  writeMutationFile14, atomicMutationJson14, mutationId14 } from './local-mutation-files.mjs';
+import { regular } from './local-task-handoff-storage.mjs';
+import { sha256, canonical } from './local-integrity.mjs';
+import { designFail, validateDesignSite } from './design-policy.mjs';
+
+export async function designDirectory(input) {
+  const root = await mutationRoot14(input.repositoryRoot), state = await mutationStateRoot14(input);
+  mutationId14(input.flowId, 'flowId'); mutationId14(input.designId, 'designId');
+  if (!Number.isSafeInteger(input.revision) || input.revision < 1) designFail('INVALID', 'A positive design revision is required');
+  const directory = path.join(state, 'design', sha256(root).slice(0, 32), input.flowId, input.designId, `r${input.revision}`);
+  await privateMutationDirectory14(directory, { privateFrom: state });
+  return directory;
+}
+export async function designSave(directory, name, value) {
+  const file = path.join(directory, name);
+  await atomicMutationJson14(file, value);
+  return file;
+}
+export async function designLoad(directory, name) { return readMutationJson14(path.join(directory, name)); }
+export async function designArtifact(file, expected) {
+  const { bytes, stat } = await regular(file, 8_388_608);
+  if (stat.nlink !== 1 || stat.mode & 0o111 || expected && (sha256(bytes) !== expected.sha256 || bytes.length !== expected.bytes)) designFail('ARTIFACT_CHANGED', 'Design evidence must retain its exact non-executable, single-link bytes');
+  return bytes;
+}
+export async function designCopy(directory, name, file) {
+  const bytes = await designArtifact(file), target = path.join(directory, name);
+  await writeMutationFile14(target, bytes);
+  return { path: target, sha256: sha256(bytes), bytes: bytes.length };
+}
+function crc32(bytes) {
+  let crc = 0xffffffff;
+  for (const byte of bytes) { crc ^= byte; for (let i = 0; i < 8; i++) crc = crc & 1 ? 0xedb88320 ^ crc >>> 1 : crc >>> 1; }
+  return (crc ^ 0xffffffff) >>> 0;
+}
+export function designPng(bytes) {
+  if (!bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))) designFail('IMAGE', 'Generated design images must be complete PNG files');
+  let offset = 8, header, end = false, data = [];
+  while (offset + 12 <= bytes.length) {
+    const length = bytes.readUInt32BE(offset), type = bytes.toString('ascii', offset + 4, offset + 8), next = offset + length + 12;
+    if (next > bytes.length || crc32(bytes.subarray(offset + 4, next - 4)) !== bytes.readUInt32BE(next - 4)) designFail('IMAGE', 'PNG bounds or checksum failed');
+    if (offset === 8 && type !== 'IHDR' || type === 'IHDR' && (header || length !== 13)) designFail('IMAGE', 'PNG header is invalid');
+    if (type === 'IHDR') header = bytes.subarray(offset + 8, next - 4);
+    else if (type === 'IDAT') data.push(bytes.subarray(offset + 8, next - 4));
+    else if (type === 'IEND') { end = length === 0 && next === bytes.length; break; }
+    else if (/^[A-Z]/.test(type) && type !== 'PLTE') designFail('IMAGE', 'Unsupported critical PNG chunk');
+    offset = next;
+  }
+  const width = header?.readUInt32BE(0), height = header?.readUInt32BE(4), channels = { 0: 1, 2: 3, 4: 2, 6: 4 }[header?.[9]];
+  if (!end || !width || !height || width > 4096 || height > 4096 || header[8] !== 8 || !channels
+    || header[10] || header[11] || header[12] || !data.length) designFail('IMAGE', 'Unsupported or incomplete generated PNG; use non-interlaced 8-bit PNG');
+  let expanded;
+  try { expanded = inflateSync(Buffer.concat(data), { maxOutputLength: 68_000_000 }); }
+  catch { designFail('IMAGE', 'Generated PNG data cannot be decoded'); }
+  const row = width * channels + 1;
+  if (expanded.length !== row * height || Array.from({ length: height }, (_, i) => expanded[i * row]).some(filter => filter > 4)) designFail('IMAGE', 'Generated PNG scanlines are invalid');
+  return { width, height };
+}
+export function designMermaid(raw) {
+  const site = validateDesignSite(raw), ids = new Map(site.pages.map((page, index) => [page.id, `p${index}`]));
+  const label = value => `"${value.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\|/g, '&#124;').replace(/[\r\n]/g, ' ')}"`;
+  return ['flowchart TD', ...site.pages.map(page => `  ${ids.get(page.id)}[${label(`${page.title} (${page.id}) · ${page.roles.join('/')} · ${page.states.join('/')}`)}]`),
+    ...site.edges.map(edge => `  ${ids.get(edge.from)} -->|${label(`${edge.id}: ${edge.label} (${edge.kind})`)}| ${ids.get(edge.to)}`)].join('\n') + '\n';
+}
+export async function assertDesignArtifacts(policy, input) {
+  const directory = input ? await designDirectory({ ...input, designId: policy.designId, revision: policy.revision }) : path.dirname(policy.flow.path);
+  if (policy.flow.path !== path.join(directory, 'site-flow.mmd') || policy.mockups.some((mockup, index) =>
+    mockup.image.path !== path.join(directory, `mockup-${index}.png`)
+    || mockup.generation.receipt.path !== path.join(directory, `generation-${index}.json`))) designFail('ARTIFACT_LOCATION', 'Design evidence must remain in its original repository, flow and revision storage');
+  const diagram = await designArtifact(policy.flow.path, policy.flow);
+  if (diagram.toString('utf8') !== designMermaid(policy.site)) designFail('FLOW', 'The displayed whole-site diagram differs from its page/action inventory');
+  for (const [index, source] of policy.sourceBaseline.entries()) if (source.original) {
+    if (source.original.path !== path.join(directory, `source-${index}.original`)) designFail('ARTIFACT_LOCATION', 'Original UI bytes must remain in their approved design revision');
+    await designArtifact(source.original.path, source.original);
+  }
+  for (const mockup of policy.mockups) {
+    designPng(await designArtifact(mockup.image.path, mockup.image));
+    let receipt;
+    try { receipt = JSON.parse((await designArtifact(mockup.generation.receipt.path, mockup.generation.receipt)).toString('utf8')); }
+    catch { designFail('GENERATION', 'The original image generation record is unavailable or invalid'); }
+    if (Object.keys(receipt).sort().join('|') !== 'generatedAt|imageSha256|promptSha256|requestId|schemaVersion|tool') designFail('GENERATION', 'Image generation records contain only tool identity, prompt/image hashes and the actual generation time');
+    if (receipt.schemaVersion !== 'entrorove.image-generation-record/1.0' || receipt.tool !== mockup.generation.tool
+      || receipt.requestId !== mockup.generation.requestId || receipt.promptSha256 !== mockup.generation.promptSha256
+      || receipt.imageSha256 !== mockup.image.sha256 || !Number.isFinite(Date.parse(receipt.generatedAt))
+      || Date.parse(receipt.generatedAt) < Date.parse(policy.researchRecordedAt)
+      || Date.parse(receipt.generatedAt) > Date.parse(policy.mockupsRecordedAt)) designFail('GENERATION', 'Record the actual image/design tool result after research, bound to these image bytes');
+  }
+}
+export async function captureDesignSourceBaseline(input, directory, names) {
+  const baseline = [];
+  for (const [index, name] of names.entries()) {
+    const file = await mutationTarget14(input.repositoryRoot, name, true);
+    if (!file.exists) { baseline.push({ path: name, original: null }); continue; }
+    const { content } = await mutationRead14(input, input.repositoryRoot, name), target = path.join(directory, `source-${index}.original`);
+    if (content.length > 2_097_152) designFail('LINT_LIMIT', 'Split approved UI source inspection before capturing a source larger than 2 MiB');
+    await writeMutationFile14(target, content);
+    baseline.push({ path: name, original: { path: target, sha256: sha256(content), bytes: content.length } });
+  }
+  return baseline;
+}
+export async function designOriginalSource(policy, name) {
+  const source = policy.sourceBaseline.find(file => file.path === name);
+  if (!source) designFail('BASELINE', 'UI source has no original approved baseline');
+  return source.original ? (await designArtifact(source.original.path, source.original)).toString('utf8') : '';
+}
+export async function designSourceManifest(input, policy) {
+  const { mutationRead14 } = await import('./local-mutation-files.mjs');
+  const root = await mutationRoot14(input.repositoryRoot), files = [];
+  const paths = new Set([...policy.rules.verificationPaths, ...policy.frameworks.flatMap(f => [f.packagePath, f.lockPath])]);
+  for (const name of [...paths].sort()) files.push({ path: name, sha256: (await mutationRead14(input, root, name)).sha256 });
+  return files;
+}
+export const sameDesignBytes = (a, b) => canonical(a) === canonical(b);

package/design-ui.mjs

@@ -0,0 +1,24 @@
+import ts from 'typescript';
+
+const uiExtension = /\.(?:[jt]sx|vue|svelte|html?|xhtml|css|scss|sass|less|styl|wxml|wxss|axml|acss)$/i;
+export const designUiAsset = name => /\.(?:png|jpe?g|webp|avif|gif|ico|woff2?|ttf|otf)$/i.test(name);
+const markup = /<\/?(?:html|head|body|main|div|section|form|button|input|table|dialog|template|script|style|[A-Z][A-Za-z0-9]*)\b[^>]*>/;
+function scriptUi(source, name) {
+  const kind = /\.[cm]?ts$/i.test(name) ? ts.ScriptKind.TS : ts.ScriptKind.TSX;
+  const tree = ts.createSourceFile(name, source, ts.ScriptTarget.Latest, true, kind);
+  let found = false;
+  const walk = node => {
+    if (ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node) || ts.isJsxFragment(node)
+      || ts.isPropertyAccessExpression(node) && ['createElement', 'createRoot', 'innerHTML', 'outerHTML', 'insertAdjacentHTML',
+        'querySelector', 'querySelectorAll', 'getElementById', 'style'].includes(node.name.text)
+      || (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node) || ts.isTemplateHead(node)) && markup.test(node.text)) found = true;
+    if (!found) ts.forEachChild(node, walk);
+  };
+  walk(tree); return found;
+}
+export function designUiCandidate(name, before = '', after = '') {
+  if (uiExtension.test(name) || /\.svg$/i.test(name)
+    || /(?:^|\/)(?:public|assets|images|icons)\//i.test(name) && designUiAsset(name)) return true;
+  if (/\.(?:[cm]?[jt]s)$/i.test(name)) return Boolean(before || after) && (scriptUi(before, name) || scriptUi(after, name));
+  return /\.(?:php|txt)$/i.test(name) && markup.test(`${before}\n${after}`);
+}

package/ide-exit.mjs

@@ -1,26 +1,66 @@
 import os from 'node:os';
 import path from 'node:path';
-import { ideDirectory, ideDigest, ideError, ideGuardBinding, ideSession, readIdeJson, verifiedIdeGuards } from './ide-session.mjs';
+import { promises as fs } from 'node:fs';
+import { withStateLock } from './local-state-lock.mjs';
+import { ideDirectory, ideDigest, ideError, ideGuardBinding, readIdeJson, writeIdeJson, verifiedIdeGuards } from './ide-session.mjs';
 
 const exactExit = /^(?:(?:请)?(?:停止使用|退出)\s*\$?entrorove|(?:stop using|exit)\s+\$?entrorove)[.!。！]?$/iu;
 const naturalExit = /(?:^|[，,。；;！!\n])\s*(?:从现在开始|接下来|今后)?\s*(?:停止使用|不再使用|不使用)\s*(?:entrorove(?:\s*技能)?|(?:这个|该)?技能)\s*(?:(?:来)?(?:执行|处理|完成|继续)[^，,。；;！!\n]{0,40}(?:任务|工作))?[。！!]?\s*$/iu;
+const englishExit = /^(?:please[,:]?\s+)?(?:from\s+now\s+on[,:]?\s+)?(?:stop\s+using|do\s+not\s+use|no\s+longer\s+use|I\s+will\s+no\s+longer\s+use)\s+(?:\$?entrorove(?:\s+skill)?|(?:this|the)\s+skill)(?:\s+(?:for|to\s+(?:execute|perform|handle|complete|continue))\s+(?:the\s+)?(?:remaining\s+(?:tasks|work)|rest\s+of\s+the\s+(?:tasks|work)))?(?:\s+(?:from\s+now\s+on|anymore|any\s+longer))?[.!]?$/iu;
+export const IDE_EXIT_DECISIONS = Object.freeze({
+  zh: '用户明确决定：错误问题发送给技能修改人员，从现在开始不使用技能来执行剩余任务。仅结束本轮Entrorove治理；保留源码、原清单顺序、审批和全部失败记录，不代表剩余业务任务取消或完成。',
+  en: 'The user has explicitly decided: report the errors to the skill maintainers and stop using the skill for the remaining tasks from now on. End only the current Entrorove governance session; preserve the source code, the original task-list order, approvals, and all failure records. This does not mean that the remaining business tasks are cancelled or completed.',
+});
+const decisionKey = text => text.normalize('NFC').replace(/\s+/gu, '').toLowerCase();
+const decisionKeys = new Set(Object.values(IDE_EXIT_DECISIONS).map(decisionKey));
+const quotedOrConditional = /[`"'“”‘’「」『』<>?？]|如果|假如|假设|示例|截图|引用|\b(?:if|unless|whether|suppose|assuming|example|screenshot|quoted?|translate|translation)\b/iu;
 export function explicitIdeExit(prompt) {
-  if (exactExit.test(prompt)) return true;
-  return !/[`"'“”‘’「」『』<>]|如果|假如|假设|示例|截图|引用/u.test(prompt) && naturalExit.test(prompt);
+  if (typeof prompt !== 'string') return false;
+  const text = prompt.trim().replace(/\bdon['’]t\b/giu, 'do not');
+  if (quotedOrConditional.test(text)) return false;
+  return exactExit.test(text) || naturalExit.test(text) || englishExit.test(text) || decisionKeys.has(decisionKey(text));
+}
+export function ideExitNotice(prompt) {
+  return /\p{Script=Han}/u.test(prompt)
+    ? '用户明确退出本轮 Entrorove 管理；源码、原清单顺序、审批和全部失败记录均保留。剩余业务未取消或完成，未声明验收通过或评分为成功。'
+    : 'The user explicitly ended this Entrorove governance session. The source code, original task-list order, approvals, and all failure records are preserved. Remaining business work is neither cancelled nor completed, and no acceptance or success score is claimed.';
 }
 export function markIdeExited(state, source) {
   if (state.phase !== 'user-exited') state.exitPhase = state.phase;
   state.active = false; state.phase = 'user-exited';
   state.exitDecision = { source, observedAt: new Date().toISOString() };
 }
-export async function exitIdeSession({ home = os.homedir(), environment = process.env } = {}) {
+async function exitState(file, sessionId, cwd) {
+  let state;
+  try { state = await readIdeJson(file); }
+  catch { throw ideError('ENTROROVE_IDE_STORE', 'Current IDE exit state is not a readable private record'); }
+  if (state) {
+    if (state.schemaVersion !== 'entrorove.ide-session/1.0' || state.sessionId !== sessionId
+      || !path.isAbsolute(state.repositoryRoot ?? '')) throw ideError('ENTROROVE_IDE_IDENTITY', 'Exit cannot replace an invalid existing IDE session');
+    return state;
+  }
+  try {
+    await fs.lstat(file);
+    throw ideError('ENTROROVE_IDE_IDENTITY', 'Exit cannot replace an invalid existing IDE session');
+  } catch (cause) { if (cause.code !== 'ENOENT') throw cause; }
+  if (!path.isAbsolute(cwd ?? '')) throw ideError('ENTROROVE_IDE_IDENTITY', 'Exit requires the current physical repository directory');
+  let repositoryRoot;
+  try { repositoryRoot = await fs.realpath(cwd); if (!(await fs.stat(repositoryRoot)).isDirectory()) throw new Error(); }
+  catch { throw ideError('ENTROROVE_IDE_IDENTITY', 'Exit requires the current physical repository directory'); }
+  return { schemaVersion: 'entrorove.ide-session/1.0', sessionId, repositoryRoot, active: false,
+    phase: 'entry', seen: [], blockStreak: 0 };
+}
+export async function exitIdeSession({ home = os.homedir(), environment = process.env, cwd = process.cwd() } = {}) {
   const { host, sessionId } = ideGuardBinding(environment);
-  if (!Object.hasOwn(verifiedIdeGuards, host) || !sessionId) throw ideError('ENTROROVE_IDE_IDENTITY', 'Exit requires the current verified IDE session identity');
-  const directory = await ideDirectory(home), state = await readIdeJson(path.join(directory, `session-${ideDigest(sessionId)}.json`));
-  if (!state || state.sessionId !== sessionId) throw ideError('ENTROROVE_IDE_IDENTITY', 'Exit requires the existing current IDE session');
-  return ideSession({ session_id: sessionId, cwd: state.repositoryRoot }, current => {
+  if (!Object.hasOwn(verifiedIdeGuards, host) || !sessionId || !/^[A-Za-z0-9_-]{1,200}$/u.test(sessionId)) {
+    throw ideError('ENTROROVE_IDE_IDENTITY', 'Exit requires the current verified IDE session identity');
+  }
+  const directory = await ideDirectory(home, true), file = path.join(directory, `session-${ideDigest(sessionId)}.json`);
+  return withStateLock(file, async () => {
+    const current = await exitState(file, sessionId, cwd);
     markIdeExited(current, 'cli');
+    await writeIdeJson(file, { ...current, observedAt: new Date().toISOString() });
     return { schemaVersion: 'entrorove.ide-exit/1.0', status: 'user-exited', sessionId,
       offline: true, network: false, hook: 'not-required', originalFlowPreserved: true, claimsCompletion: false };
-  }, home);
+  });
 }

package/ide-hook.mjs

@@ -13,7 +13,7 @@ import { parseIdeResults, consumeIdeResults } from './ide-results.mjs';
 import { verifyIdeLocalAcceptance } from './ide-local-acceptance.mjs';
 import { registerIdeRequirement, ideQueueContext, unclassifiedIdeRequirements,
   advanceIdeQueue, checkQueuedStart, unfinishedIdeQueue } from './ide-queue.mjs';
-import { explicitIdeExit, markIdeExited } from './ide-exit.mjs';
+import { explicitIdeExit, ideExitNotice, markIdeExited } from './ide-exit.mjs';
 import { appliesIdeHook, hasIdeHookSelection, selectsIdeHook, ideUserPrompt as userPrompt } from './ide-selection.mjs';
 
 const output = (event, extra = {}) => ({ hookSpecificOutput: { hookEventName: event, ...extra } });
@@ -251,7 +251,7 @@ export async function runIdeHook(event, { home } = {}) {
     if (name === 'PreToolUse') state.enforcement = 'enforced';
     if (name === 'UserPromptSubmit' && explicitIdeExit(userPrompt(event))) {
       markIdeExited(state, 'user-prompt');
-      return output(name, { additionalContext: '用户明确退出 Entrorove 管理；原任务仍保留，未验收、未评分为成功。' });
+      return output(name, { additionalContext: ideExitNotice(userPrompt(event)) });
     }
     if (selected) {
       state.active = true;

package/install-identity.mjs

@@ -0,0 +1,16 @@
+import { createHash } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+export async function installPackageIdentity(directory, metadata) {
+  const files = [...new Set(['package.json', ...metadata.files])].sort(), digest = createHash('sha256');
+  for (const name of files) {
+    if (typeof name !== 'string' || path.isAbsolute(name) || name.includes('\\')
+      || name.split('/').some(part => !part || part === '.' || part === '..')) throw new Error('Invalid packaged source inventory');
+    const file = path.join(directory, name), stat = await fs.lstat(file);
+    if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('Packaged source identity requires regular files');
+    const bytes = await fs.readFile(file);
+    digest.update(`${name}\0${createHash('sha256').update(bytes).digest('hex')}\n`);
+  }
+  return digest.digest('hex');
+}

package/local-cli.mjs

@@ -25,6 +25,7 @@ import { ARCHGUARD_LOCAL_OPERATIONS } from './local-archguard-operations.mjs';
 import { LOCAL_BUDGET_HANDOFF_OPERATIONS } from './local-budget-handoff.mjs';
 import { LOCAL_CHAIN_OPERATIONS } from './local-chain-operations.mjs';
 import { DISCIPLINE_LOCAL_OPERATIONS } from './local-discipline-operations.mjs';
+import { DESIGN_LOCAL_OPERATIONS } from './design-operations.mjs';
 import { assertIdeExecution, settleBreakGlassSession } from './ide-session.mjs';
 import { runManagedWorkflowLocalStep } from './workflow-local-client.mjs';
 import { localErrorEnvelope } from './local-error.mjs';
@@ -47,6 +48,7 @@ const operations = {
   'mutation-consumption-attest': attestMutationConsumption14,
   'mutation-delegate-prepare': preparePreservedMutationSigner,
   ...DISCIPLINE_LOCAL_OPERATIONS,
+  ...DESIGN_LOCAL_OPERATIONS,
   'snapshot-plan': snapshotPlan, 'snapshot-verify': snapshotVerify, 'mutation-snapshot-attest': attestMutationSnapshot14, 'mutate-gate': mutateGate,
   'gate-issue': issueMutationPass, 'gate-verify': verifyMutationPass, 'guarded-write': guardedWrite,
   'budget-init': budgetInit, 'budget-context': budgetContext, 'budget-read': budgetRead, 'budget-status': budgetStatus,
@@ -87,7 +89,7 @@ function capabilitiesFor(group) {
 async function checkedLocalInput(operation, input) {
   try {
     const validated = validateLocalInput(operation, input);
-    if (['mutation-snapshot-attest', 'mutation-consumption-attest', 'workflow-run-step', 'mutate-gate', 'gate-issue', 'gate-verify', 'guarded-write', 'guarded-delete', 'guarded-move', 'discipline-review', 'discipline-check'].includes(operation)) await hydrateCloudMutationAuthority(input.home, new URL(apiUrl).origin);
+    if (['mutation-snapshot-attest', 'mutation-consumption-attest', 'workflow-run-step', 'design-verify', 'mutate-gate', 'gate-issue', 'gate-verify', 'guarded-write', 'guarded-delete', 'guarded-move', 'discipline-review', 'discipline-check'].includes(operation)) await hydrateCloudMutationAuthority(input.home, new URL(apiUrl).origin);
     return validated;
   }
   catch (cause) {

package/local-contracts.mjs

@@ -9,6 +9,7 @@ import { WORKFLOW_LOCAL_OPERATION_SCHEMA } from './workflow-local-contracts.mjs'
 import { HANDOFF_WRITE_PASS_SCHEMA, HANDOFF_PROVISIONAL_LEASE_SCHEMA, HANDOFF_SNAPSHOT_CANDIDATE_SCHEMA } from './local-task-handoff-contracts.mjs';
 import { LOCAL_CHAIN_OPERATION_SCHEMAS } from './local-chain-contracts.mjs';
 import { DISCIPLINE_DECLARATION_SCHEMA } from './local-discipline-contracts.mjs';
+import { DESIGN_LOCAL_OPERATION_SCHEMAS } from './design-local-contracts.mjs';
 import { array, binding, change, confirmation, enumeration, evidence, evidenceArray, executionContext, executionPlan,
   formula, formulaDefinitions, formulaEntry, decimalValues, identifier, integer, ledgerIdentifier, modes, nullable, object, paths, record, relativePath, sha256, text } from './local-contract-types.mjs';
 
@@ -38,7 +39,10 @@ const write = { ...step, taskId: identifier, generation: integer(1), executionAt
 add('gate-verify', write, ['repositoryRoot', 'flowId', 'stepId', 'gatePassPath', 'targetPath']);
 add('discipline-review|discipline-check', write, ['repositoryRoot', 'flowId', 'stepId', 'gatePassPath', 'targetPath']);
 add('guarded-delete|guarded-move', { ...write, declaration: DISCIPLINE_DECLARATION_SCHEMA }, ['repositoryRoot', 'flowId', 'stepId', 'gatePassPath', 'targetPath', 'declaration']);
-add('guarded-write', { ...write, content: {}, expectedSha256: nullable(sha256), declaration: DISCIPLINE_DECLARATION_SCHEMA }, ['repositoryRoot', 'flowId', 'stepId', 'gatePassPath', 'targetPath', 'content']);
+add('guarded-write', { ...write, content: {}, contentBase64: { type: 'string', maxLength: 16_000_000,
+  pattern: '^[A-Za-z0-9+/]*={0,2}$' }, expectedSha256: nullable(sha256), declaration: DISCIPLINE_DECLARATION_SCHEMA }, ['repositoryRoot', 'flowId', 'stepId', 'gatePassPath', 'targetPath']);
+schemas['guarded-write'].oneOf = [{ required: ['content'], not: { required: ['contentBase64'] } },
+  { required: ['contentBase64'], not: { required: ['content'] } }];
 schemas['guarded-write'] = { oneOf: [schemas['guarded-write'], object({ ...step, targetPath: relativePath, content: {},
   expectedSha256: nullable(sha256), handoffId: ledgerIdentifier, epoch: integer(1, 2147483647),
   handoffPass: HANDOFF_WRITE_PASS_SCHEMA, provisionalLease: HANDOFF_PROVISIONAL_LEASE_SCHEMA },
@@ -82,6 +86,7 @@ add('chain-resume', { ...chain, stepId: ledgerIdentifier, status: enumeration(['
 add('chain-status|chain-ledger-status', chain, ['repositoryRoot', 'chainId']);
 add('chain-answer', { ...chain, stepId: ledgerIdentifier, answer: { anyOf: [text, object({ id: text }, ['id'])] }, accepted: { type: 'boolean' }, actorId: nullable(text) }, ['repositoryRoot', 'chainId', 'answer']);
 Object.assign(schemas, LOCAL_CHAIN_OPERATION_SCHEMAS);
+Object.assign(schemas, DESIGN_LOCAL_OPERATION_SCHEMAS);
 const renewal = { ...flow, requestId: identifier, scope: object({ goal: text, allowedPaths: paths, forbiddenPaths: paths }, ['goal', 'allowedPaths']), policy: object({ intervalMs: integer(1), maxRenewals: integer(1, 100) }, ['intervalMs', 'maxRenewals']) };
 add('budget-auto-renew-request', renewal, ['repositoryRoot', 'flowId', 'requestId', 'scope', 'policy']);
 add('budget-auto-renew', { ...renewal, confirmation, grant: record }, ['repositoryRoot', 'flowId', 'requestId', 'scope', 'policy'], ['grant', 'confirmation']);

package/local-discipline-actions.mjs

@@ -9,6 +9,8 @@ import { assertDisciplineRepository } from './local-discipline-repository.mjs';
 import { saveMutationConsumption14 } from './local-mutation-pass-store.mjs';
 import { auditMutation14, withMutationAudit14 } from './local-mutation-audit.mjs';
 import { mutationFail14, removeMutationProjectFile14, moveMutationProjectFile14 } from './local-mutation-files.mjs';
+import { assertDesignWrite } from './design-gate.mjs';
+import { readSnapshotCopy14 } from './local-mutation-snapshot.mjs';
 
 function actionIntent(input, value, kind, review) {
   if (value.pass.writeDelegation) mutationFail14('ENTROROVE_MUTATION_DELEGATION_CHANGE', 'Preserved mutation forbids structural file actions');
@@ -38,6 +40,9 @@ async function perform(input, kind, original, state) {
     const review = await readDisciplineSnapshot(snapshot), intent = actionIntent(input, value, kind, review);
     await assertDisciplineRepository(input, binding.root, review, ledger);
     const source = snapshot.manifest.files.find(file => file.path === value.target);
+    const sourceBytes = (await readSnapshotCopy14(input, snapshot.snapshotRoot, snapshot.manifest, value.target)).content.toString('utf8');
+    await assertDesignWrite(input, pass, value.target, sourceBytes, kind === 'move' ? sourceBytes : '');
+    if (kind === 'move') await assertDesignWrite(input, pass, intent.destinationPath, '', sourceBytes);
     const at = new Date().toISOString();
     const writes = { ...ledger.writes, [value.target]: { status: 'pending', kind: 'delete', contentDigest: source.sha256, mode: source.mode, at } };
     let destination;

package/local-discipline-batch.mjs

@@ -3,6 +3,10 @@ import { mutationFail14 } from './local-mutation-files.mjs';
 import { disciplineWritePreflight } from './local-discipline-gate.mjs';
 import { readDisciplineSnapshot } from './local-discipline-snapshot.mjs';
 import { assertDisciplineRepository } from './local-discipline-repository.mjs';
+import { designUiCandidate } from './design-ui.mjs';
+import { archiveFormat } from './package-archive.mjs';
+import { assertRollbackCandidate, rememberMutationBaselines } from './rollback-history.mjs';
+import { readSnapshotCopy14 } from './local-mutation-snapshot.mjs';
 
 export async function disciplineBatchBefore(input, value, options, before, after, ledger) {
   const review = await readDisciplineSnapshot(value.snapshot);
@@ -11,14 +15,18 @@ export async function disciplineBatchBefore(input, value, options, before, after
   // by mutationBatchReceiptBinding14. It restores that known image, rather than
   // proposing a new definition or reusing a forward mutation permission.
   const restoration = options.contract?.schemaVersion === 'entrorove.merge-rollback-authorization/1.0';
-  if (restoration) return review;
+  if (restoration) { await rememberMutationBaselines(input, value, before); return review; }
   for (const file of after) {
     const original = before.find(item => item.path === file.path);
     if (canonical(original) === canonical(file)) continue;
     if (!file.exists) mutationFail14('ENTROROVE_DISCIPLINE_NEEDS_HUMAN', 'Forward batch deletion requires its separate guarded deletion declaration');
+    await assertRollbackCandidate(input, value.binding.root, file.path, original.sha256, file.sha256);
     const source = options.contents?.find(item => item.path === file.path);
     if (!source) {
-      if (/\.(?:[cm]?[jt]sx?|php|py|java|rs|vue|svelte|css)$/iu.test(file.path)) mutationFail14('ENTROROVE_DISCIPLINE_REVIEW_REQUIRED', 'Source batch needs actual candidate bytes before any write');
+      const bytes = original.exists ? (await readSnapshotCopy14(input, value.snapshot.snapshotRoot, value.snapshot.manifest, file.path)).content : Buffer.alloc(0);
+      if (designUiCandidate(file.path) || archiveFormat(file.path, bytes)
+        || /(?:^|\/)(?:package|manifest)\.json$/i.test(file.path)
+        || /\.(?:[cm]?[jt]sx?|php|py|java|rs|vue|svelte|css)$/iu.test(file.path)) mutationFail14('ENTROROVE_DISCIPLINE_REVIEW_REQUIRED', 'Source or package batch needs actual candidate bytes before any write');
       continue;
     }
     const bytes = Buffer.from(source.contentBase64, 'base64');
@@ -26,7 +34,8 @@ export async function disciplineBatchBefore(input, value, options, before, after
     const intent = value.pass.disciplinePolicy?.writes.find(write => write.targetPath === file.path);
     await disciplineWritePreflight({ ...input, targetPath: file.path,
       ...(intent ? { declaration: { ...intent, usageReviewDigest: value.snapshot.manifest.disciplineReviewDigest } } : {}) },
-    { ...value, target: file.path, ledger }, bytes.toString('utf8'));
+    { ...value, target: file.path, ledger }, bytes);
   }
+  await rememberMutationBaselines(input, value, before);
   return review;
 }

package/local-discipline-contracts.mjs

@@ -1,6 +1,8 @@
 import Ajv from 'ajv';
 import { canonical, sha256 } from './local-integrity.mjs';
 import { object, array, text, identifier, relativePath, sha256 as shaSchema, integer } from './local-contract-types.mjs';
+import { DESIGN_POLICY_SCHEMA } from './design-contracts.mjs';
+import { assertDesignDeclaration } from './design-declaration.mjs';
 
 const refs = { ...array(identifier, 1), uniqueItems: true };
 const defect = object({ path: relativePath, line: integer(1) }, ['path', 'line']);
@@ -13,7 +15,7 @@ export const DISCIPLINE_WRITE_SCHEMA = object({ targetPath: relativePath,
 const approval = object({ interactionId: identifier, interactionDigest: shaSchema, auditId: identifier,
   proposalDigest: shaSchema }, ['interactionId', 'interactionDigest', 'auditId', 'proposalDigest']);
 const mutablePolicy = object({ schemaVersion: { const: 'entrorove.discipline-policy/1.0' },
-  requirementIds: refs, writes: array(DISCIPLINE_WRITE_SCHEMA, 1), approval,
+  requirementIds: refs, writes: array(DISCIPLINE_WRITE_SCHEMA, 1), approval, designApproval: approval, design: DESIGN_POLICY_SCHEMA,
   dataOperations: array(object({ operation: { enum: ['delete', 'migrate', 'rebuild'] }, target: text,
     reason: text, requirementRefs: refs, snapshotArtifactDigest: shaSchema }, ['operation', 'target', 'reason', 'requirementRefs', 'snapshotArtifactDigest'])),
 }, ['schemaVersion', 'requirementIds', 'writes']);
@@ -37,10 +39,14 @@ export function disciplinePolicy(value) {
   if (value.dataOperations?.some(action => action.requirementRefs.some(id => !requirements.has(id)))) {
     throw Object.assign(new Error('Data operations must reference original requirements'), { code: 'ENTROROVE_DISCIPLINE_POLICY_INVALID' });
   }
+  assertDesignDeclaration(value, value.writes.flatMap(write => [write.targetPath, ...(write.destinationPath ? [write.destinationPath] : [])]));
+  if (value.design && value.design.site.requirementIds.some(id => !requirements.has(id))) {
+    throw Object.assign(new Error('Design must retain its original task requirements'), { code: 'ENTROROVE_DESIGN_BINDING' });
+  }
   return structuredClone(value);
 }
 export function disciplineProposalDigest(value) {
-  const { approval, ...proposal } = disciplinePolicy(value);
+  const { approval, designApproval, ...proposal } = disciplinePolicy(value);
   return sha256(canonical(proposal));
 }
 export function disciplineHumanTriggers(value) {
@@ -50,11 +56,17 @@ export function disciplineHumanTriggers(value) {
     if (['delete', 'move'].includes(write.kind) || write.deletedSymbols?.length) triggers.add(write.kind === 'move' ? 'move' : 'delete');
   }
   if (policy.dataOperations?.length) triggers.add('existing-data');
+  if (policy.design) triggers.add('interface-design');
   return [...triggers].sort();
 }
 export function disciplineApprovedPolicy(value) {
   const policy = disciplinePolicy(value);
-  if (disciplineHumanTriggers(policy).length && (!policy.approval || policy.approval.proposalDigest !== disciplineProposalDigest(policy))) {
+  const triggers = disciplineHumanTriggers(policy), fullReview = triggers.some(trigger => trigger !== 'interface-design')
+    || Boolean(policy.design && !policy.designApproval);
+  if (policy.designApproval && (!policy.design || policy.designApproval.proposalDigest !== policy.design.baselineDigest)) {
+    throw Object.assign(new Error('The exact design revision needs its original human confirmation'), { code: 'ENTROROVE_DESIGN_APPROVAL_REQUIRED' });
+  }
+  if (fullReview && (!policy.approval || policy.approval.proposalDigest !== disciplineProposalDigest(policy))) {
     throw Object.assign(new Error('This exact change proposal needs the original persisted human approval'), { code: 'ENTROROVE_DISCIPLINE_NEEDS_HUMAN' });
   }
   return policy;

package/local-discipline-gate.mjs

@@ -6,6 +6,9 @@ import { disciplineRepositoryObservation, assertDisciplineRepository } from './l
 import { readDisciplineSnapshot } from './local-discipline-snapshot.mjs';
 import { readSnapshotCopy14 } from './local-mutation-snapshot.mjs';
 import { assertDelegatedSourceModification } from './local-delegated-modify-analysis.mjs';
+import { assertDesignWrite } from './design-gate.mjs';
+import { assertPackageReplacement } from './package-replacement.mjs';
+import { assertRollbackCandidate } from './rollback-history.mjs';
 
 const needs = message => mutationFail14('ENTROROVE_DISCIPLINE_NEEDS_HUMAN', message);
 function declaredWrite(input, pass, baseline) {
@@ -71,11 +74,23 @@ function checkReuse(review, candidate, target, intent, parallelPaths) {
     empty: duplicates.length === 0, complete: review.scanComplete };
 }
 export async function disciplineWritePreflight(input, value, content) {
+  const candidateBytes = Buffer.from(content), candidateDigest = sha256(candidateBytes);
+  // Analyze decoded source bytes through the same original source checks.
+  // Binary assets remain in the exact-byte repository and M/S integrity chain.
+  if (Buffer.isBuffer(content)) {
+    try { content = new TextDecoder('utf-8', { ignoreBOM: true,
+      fatal: /\.(?:[cm]?[jt]sx?|php|py|java|rs|vue|svelte|css)$/i.test(value.target) }).decode(content); }
+    catch { mutationFail14('ENTROROVE_CONTENT_INVALID', 'Source content must contain valid UTF-8 bytes'); }
+  }
   const { pass, target, binding, snapshot, ledger } = value;
   const review = await readDisciplineSnapshot(snapshot), baseline = snapshot.manifest.files.find(file => file.path === target);
   await assertDisciplineRepository(input, binding.root, review, ledger);
   const intent = declaredWrite(input, pass, baseline);
-  const original = baseline.exists ? (await readSnapshotCopy14(input, snapshot.snapshotRoot, snapshot.manifest, target)).content.toString('utf8') : '';
+  const originalBytes = baseline.exists ? (await readSnapshotCopy14(input, snapshot.snapshotRoot, snapshot.manifest, target)).content : Buffer.alloc(0);
+  if (baseline.exists) assertPackageReplacement(target, originalBytes, candidateBytes);
+  await assertRollbackCandidate(input, binding.root, target, baseline.sha256, candidateDigest);
+  const original = originalBytes.toString('utf8');
+  await assertDesignWrite(input, pass, target, original, content);
   if (pass.writeDelegation?.purpose === 'planned-file-create') {
     if (baseline.exists || intent?.kind !== 'create' || !pass.newFilePaths.includes(target)) needs('Planned creation cannot overwrite an existing source or replace its create role');
   } else if (pass.writeDelegation?.purpose === 'preserved-existing-modify') assertDelegatedSourceModification({ path: target, before: original, after: content });
@@ -86,5 +101,5 @@ export async function disciplineWritePreflight(input, value, content) {
   const formatting = baseline.exists ? disciplineFormattingLines(original, content, target) : [];
   if (formatting.length) mutationFail14('ENTROROVE_DISCIPLINE_FORMAT_SCOPE', `Formatting touches lines without functional changes: ${target}:${formatting.join(',')}`);
   return { reviewDigest: snapshot.manifest.disciplineReviewDigest, declaredKind: baseline.exists ? 'modify' : 'create', removed, reuse,
-    candidateDigest: sha256(content), comparisonScope: review.comparison.scope };
+    candidateDigest, comparisonScope: review.comparison.scope };
 }

package/local-discipline-repository.mjs

@@ -27,7 +27,7 @@ function sourceLimit(relative, bytes, sources, used, required) {
     `Semantic inspection of "${relative}" (${bytes} bytes) exceeds ${reason}; limits are ${disciplineAnalysisLimits.fileBytes} bytes per file, ${disciplineAnalysisLimits.sourceBytes} total bytes and ${disciplineAnalysisLimits.files} files. Preserve the original flow and split its approved inspection before retrying`);
   return reason;
 }
-async function integrityOnlyFile(root, relative) {
+export async function repositoryIntegrityFile(root, relative) {
   // This path returns only an integrity digest. It never exposes source bytes or
   // contributes semantic facts outside the signed source-read scope.
   const before = await mutationTarget14(root, relative);
@@ -39,7 +39,9 @@ async function integrityOnlyFile(root, relative) {
     for await (const chunk of handle.createReadStream({ autoClose: false })) digest.update(chunk);
     const last = await handle.stat(), current = await mutationTarget14(root, relative);
     if (!sameFile(first, last) || !sameFile(last, current.stat)) mutationFail14('ENTROROVE_FILE_CHANGED', `${relative} changed during integrity observation`);
-    return { sha256: digest.digest('hex'), mode: last.mode & 0o777 };
+    return { sha256: digest.digest('hex'), mode: last.mode & 0o777,
+      identity: { dev: last.dev, ino: last.ino, nlink: last.nlink, birthtimeMs: last.birthtimeMs,
+        ctimeMs: last.ctimeMs, mtimeMs: last.mtimeMs, size: last.size } };
   } finally { await handle.close(); }
 }
 async function inventory(root, prefix = '') {
@@ -77,7 +79,7 @@ export async function disciplineRepositoryObservation(input, root, { analyze = f
     const allowed = !restricted || withinBudgetScope(relative, restricted);
     const bytes = overrides.has(relative) ? Buffer.byteLength(overrides.get(relative)) : stat.size;
     const limited = semantic && allowed ? sourceLimit(relative, bytes, sources, sourceBytes, required) : null;
-    const read = semantic && allowed && !limited ? await mutationRead14(input, root, relative) : await integrityOnlyFile(root, relative);
+    const read = semantic && allowed && !limited ? await mutationRead14(input, root, relative) : await repositoryIntegrityFile(root, relative);
     files.push({ path: relative, sha256: read.sha256, mode: read.mode, kind: 'file' });
     if (semantic && allowed && !limited) { sources.push({ path: relative, content: overrides.get(relative) ?? read.content.toString('utf8') }); sourceBytes += bytes; }
     else if (limited) unresolved.push({ path: relative, reason: limited, bytes });
@@ -124,7 +126,7 @@ export function disciplineRepositoryDifferences(before, after, authorized = new
   }
   return changed;
 }
-export async function assertDisciplineRepository(input, root, review, ledger) {
+export async function observeDisciplineRepositoryState(input, root, review, ledger) {
   const expected = new Map();
   for (const [relative, write] of Object.entries(ledger.writes ?? {})) {
     if (write.status !== 'written') mutationFail14('ENTROROVE_MUTATION_PASS_CONSUMED', 'Repository comparison found an unresolved physical action');
@@ -137,6 +139,10 @@ export async function assertDisciplineRepository(input, root, review, ledger) {
   }
   const current = await disciplineRepositoryObservation(input, root);
   const changed = disciplineRepositoryDifferences(review.comparison, current.comparison, expected);
+  return { comparison: current.comparison, changed };
+}
+export async function assertDisciplineRepository(input, root, review, ledger) {
+  const { comparison, changed } = await observeDisciplineRepositoryState(input, root, review, ledger);
   if (changed.length) mutationFail14('ENTROROVE_DISCIPLINE_REPOSITORY_DRIFT', `Whole-repository comparison differs outside completed declared actions: ${changed.join(', ')}`);
-  return current.comparison;
+  return comparison;
 }

package/local-error.mjs

@@ -17,9 +17,24 @@ export const LOCAL_ERROR_CODE_CATALOG = Object.freeze({
   ENTROROVE_MUTATION_DELEGATION_INVALID: Object.freeze({ disposition: 'terminal', stability: 'stable' }),
   ENTROROVE_IDE_GUARD_REQUIRED: Object.freeze({ disposition: 'needs-human', stability: 'stable' }),
   ENTROROVE_IDE_GUARD_UNSUPPORTED: Object.freeze({ disposition: 'terminal', stability: 'stable' }),
+  ENTROROVE_DESIGN_REQUIRED: Object.freeze({ disposition: 'needs-human', stability: 'stable' }),
+  ENTROROVE_DESIGN_APPROVAL_REQUIRED: Object.freeze({ disposition: 'needs-human', stability: 'stable' }),
+  ENTROROVE_DESIGN_LINT: Object.freeze({ disposition: 'terminal', stability: 'stable' }),
+  ENTROROVE_DESIGN_ACCEPTANCE: Object.freeze({ disposition: 'terminal', stability: 'stable' }),
+  ENTROROVE_PACKAGE_DOWNGRADE: Object.freeze({ disposition: 'needs-human', stability: 'stable' }),
+  ENTROROVE_PACKAGE_VERSION_CONFLICT: Object.freeze({ disposition: 'needs-human', stability: 'stable' }),
+  ENTROROVE_PACKAGE_VERSION_UNKNOWN: Object.freeze({ disposition: 'needs-human', stability: 'stable' }),
+  ENTROROVE_PACKAGE_IDENTITY_CHANGED: Object.freeze({ disposition: 'needs-human', stability: 'stable' }),
+  ENTROROVE_PACKAGE_PROVENANCE_REQUIRED: Object.freeze({ disposition: 'needs-human', stability: 'stable' }),
+  ENTROROVE_ROLLBACK_PROOF_REQUIRED: Object.freeze({ disposition: 'needs-human', stability: 'stable' }),
+  ENTROROVE_ROLLBACK_HISTORY_INVALID: Object.freeze({ disposition: 'needs-human', stability: 'stable' }),
 });
 
 const BLOCKED_CODES = new Set([
+  'ENTROROVE_PACKAGE_DOWNGRADE', 'ENTROROVE_PACKAGE_VERSION_CONFLICT', 'ENTROROVE_PACKAGE_VERSION_UNKNOWN',
+  'ENTROROVE_PACKAGE_IDENTITY_CHANGED', 'ENTROROVE_PACKAGE_PROVENANCE_REQUIRED', 'ENTROROVE_ROLLBACK_PROOF_REQUIRED', 'ENTROROVE_ROLLBACK_HISTORY_INVALID',
+  'ENTROROVE_DESIGN_REQUIRED', 'ENTROROVE_DESIGN_APPROVAL_REQUIRED', 'ENTROROVE_DESIGN_BASELINE_CHANGED',
+  'ENTROROVE_DESIGN_FRAMEWORK_MISSING', 'ENTROROVE_DESIGN_ARTIFACT_CHANGED', 'ENTROROVE_DESIGN_SCOPE',
   'ENTROROVE_DISCIPLINE_NEEDS_HUMAN', 'ENTROROVE_DISCIPLINE_USAGE_UNKNOWN', 'ENTROROVE_DISCIPLINE_REVIEW_REQUIRED',
   'ENTROROVE_DISCIPLINE_DATA_SNAPSHOT_REQUIRED', 'ENTROROVE_DISCIPLINE_REPOSITORY_DRIFT', 'ENTROROVE_DISCIPLINE_FORMAT_SCOPE',
   'ENTROROVE_DISCIPLINE_SPECULATIVE', 'ENTROROVE_DISCIPLINE_REVIEW_INVALID',
@@ -52,5 +67,7 @@ export function localErrorDisposition(code) {
 export function localErrorEnvelope(error, fallbackCode = 'ENTROROVE_LOCAL_FAILURE') {
   const code = typeof error?.code === 'string' && error.code ? error.code : fallbackCode;
   const message = typeof error?.message === 'string' && error.message ? error.message : 'Local operation failed';
-  return { schemaVersion: LOCAL_ERROR_SCHEMA, status: localErrorStatus({ ...error, code }), code, disposition: localErrorDisposition(code), message };
+  const report = /^ENTROROVE_DESIGN_/.test(code) && typeof error?.reportPath === 'string' && /^\//.test(error.reportPath)
+    && /^[a-f0-9]{64}$/.test(error.reportDigest ?? '') ? { reportPath: error.reportPath, reportDigest: error.reportDigest } : {};
+  return { schemaVersion: LOCAL_ERROR_SCHEMA, status: localErrorStatus({ ...error, code }), code, disposition: localErrorDisposition(code), message, ...report };
 }

package/local-execution.mjs

@@ -276,12 +276,13 @@ export async function finalGate(input) {
     guarantee: 'Original engine, frozen role plans and actual three-party checks are required' };
 }
 
-const LOCAL_OPERATION_GROUPS = Object.freeze(['core', 'budget', 'scope', 'merge', 'chain', 'handoff', 'archguard', 'calctool', 'swarm', 'validator', 'formula', 'evidence']);
+const LOCAL_OPERATION_GROUPS = Object.freeze(['core', 'budget', 'scope', 'merge', 'chain', 'handoff', 'archguard', 'calctool', 'swarm', 'validator', 'formula', 'evidence', 'design']);
 const PASS_REQUIRED_OPERATIONS = new Set(['mutation-snapshot-attest', 'mutation-consumption-attest', 'mutate-gate', 'gate-issue', 'gate-verify', 'guarded-write',
   'discipline-review', 'discipline-check', 'guarded-delete', 'guarded-move',
   'merge-verified', 'rollback', 'archguard-contract-create', 'archguard-contract-update', 'archguard-checkpoint', 'archguard-scope-request',
   'budget-handoff', 'budget-transition', 'spawn-bind', 'peer-complete', 'complete']);
 function operationGroup(operation) {
+  if (operation.startsWith('design-')) return 'design';
   if (operation.startsWith('archguard-')) return 'archguard';
   if (operation.startsWith('calctool-')) return 'calctool';
   if (operation.includes('handoff')) return 'handoff';