@entrorove/skill 0.1.64 → 0.1.67

package/design-policy.mjs

@@ -0,0 +1,137 @@
+import { canonical, sha256 } from './local-integrity.mjs';
+import { designSchema } from './design-contracts.mjs';
+import { FRAMEWORK_DOC_HOSTS } from './design-frameworks.mjs';
+
+export function designFail(code, message) { throw Object.assign(new Error(message), { code: `ENTROROVE_DESIGN_${code}` }); }
+export const designDigest = value => sha256(canonical(value));
+export function validateDesignSite(raw) {
+  const site = designSchema('site', raw), pages = new Map(site.pages.map(page => [page.id, page]));
+  if (pages.size !== site.pages.length || new Set(site.edges.map(edge => edge.id)).size !== site.edges.length
+    || !site.pages.some(page => page.entry) || new Set(site.roles).size !== site.roles.length) designFail('FLOW', 'Whole-site roles, pages, edges and entry points must be unique');
+  for (const page of site.pages) {
+    if (page.roles.some(role => !site.roles.includes(role)) || !page.states.includes('default')
+      || new Set(page.states).size !== page.states.length || page.publicFields.some(field => page.internalFields.includes(field))) {
+      designFail('FLOW', 'Every page needs original roles, a default state and disjoint public/internal field contracts');
+    }
+  }
+  for (const edge of site.edges) if (!pages.has(edge.from) || !pages.has(edge.to)) designFail('FLOW', 'Every action must connect declared pages');
+  const reachable = new Set(site.pages.filter(page => page.entry).map(page => page.id));
+  for (let i = 0; i < pages.size; i++) for (const edge of site.edges) if (reachable.has(edge.from)) reachable.add(edge.to);
+  if (reachable.size !== pages.size) designFail('FLOW', 'Whole-site flow contains an unreachable page');
+  for (const page of site.pages) if (site.edges.some(edge => edge.from === page.id && ['save', 'delete'].includes(edge.kind))
+    && (!page.states.includes('error') || !site.edges.some(edge => edge.from === page.id && edge.kind === 'cancel'))) {
+    designFail('FLOW', 'Mutation pages require explicit failure and cancel paths');
+  }
+  return site;
+}
+export function designBaselineDigest(value) { const { baselineDigest, ...body } = value; return designDigest(body); }
+const imageKey = mockup => `${mockup.pageId}/${mockup.stateId}/${mockup.theme}/${mockup.viewport.width}x${mockup.viewport.height}`;
+function validateDesignSources(policy) {
+  for (const source of policy.sources) {
+    for (const value of [source.url, source.finalUrl]) {
+      let url; try { url = new URL(value); } catch { designFail('RESEARCH', 'Research needs actual public HTTPS references'); }
+      if (url.protocol !== 'https:' || url.username || url.password || url.hash || url.port && url.port !== '443'
+        || !/^[A-Za-z0-9.-]+\.[A-Za-z]{2,}$/.test(url.hostname)
+        || /(^|\.)(localhost|local|internal|test|invalid)$/.test(url.hostname)
+        || [...url.searchParams.keys()].some(key => /token|secret|password|key|signature|credential/i.test(key))) designFail('RESEARCH', 'Keep credentials and private references out of design evidence');
+    }
+    const retrieved = Date.parse(source.retrievedAt), recorded = Date.parse(policy.researchRecordedAt);
+    if (!Number.isFinite(retrieved) || retrieved > recorded || recorded - retrieved > 30 * 86400_000) designFail('RESEARCH_STALE', 'Current layout and framework documentation must be fetched before the research stage closes');
+  }
+  if (new Set(policy.frameworks.map(framework => framework.packageName)).size !== policy.frameworks.length) designFail('FRAMEWORK', 'Framework versions must be unambiguous');
+  for (const framework of policy.frameworks) if (!FRAMEWORK_DOC_HOSTS[framework.packageName]
+    || framework.officialUrls.some(url => !FRAMEWORK_DOC_HOSTS[framework.packageName].includes(new URL(url).hostname))) designFail('FRAMEWORK', 'Use the declared framework official documentation hosts');
+}
+export function validateDesignPolicy(raw) {
+  const policy = designSchema('policy', raw), { site, rules } = policy;
+  let preview; try { preview = new URL(rules.previewOrigin); } catch { designFail('PREVIEW', 'Preview must be an exact isolated local origin'); }
+  if (preview.href !== rules.previewOrigin || preview.hostname !== '127.0.0.1' || !preview.port) designFail('PREVIEW', 'Approve the exact isolated preview before UI implementation');
+  validateDesignSite(site);
+  if (policy.baselineDigest !== designBaselineDigest(policy) || policy.flowDigest !== designDigest(site)) designFail('BASELINE_CHANGED', 'Design bytes differ from the exact proposal baseline');
+  const times = [policy.flowRecordedAt, policy.researchRecordedAt, policy.mockupsRecordedAt].map(Date.parse);
+  if (times.some(t => !Number.isFinite(t) || t > Date.now() + 5000) || times[0] > times[1] || times[1] > times[2]) designFail('ORDER', 'Record whole-site flow, internet research, then mockups or prototypes in order');
+  validateDesignSources(policy);
+  const layouts = policy.sources.filter(source => source.purpose === 'layout');
+  if (new Set(layouts.map(source => new URL(source.finalUrl).hostname)).size < 2) designFail('RESEARCH', 'Use current layout references from at least two independent sites with suitability reasons');
+  for (const framework of policy.frameworks) for (const url of framework.officialUrls) {
+    if (!policy.sources.some(source => source.purpose === 'framework' && source.finalUrl === url)) designFail('FRAMEWORK', 'Every declared framework needs fetched official documentation');
+  }
+  if (!rules.uiPaths.includes(rules.tokenPath) || rules.stylePaths.some(p => !rules.uiPaths.includes(p))
+    || rules.uiPaths.some(p => !rules.verificationPaths.includes(p))) designFail('RULES', 'Verification covers every UI file; token and style sources belong to the approved UI paths');
+  if (new Set(policy.sourceBaseline.map(file => file.path)).size !== rules.uiPaths.length
+    || policy.sourceBaseline.length !== rules.uiPaths.length
+    || rules.uiPaths.some(name => !policy.sourceBaseline.some(file => file.path === name))) designFail('BASELINE', 'Every UI source needs its original existing or absent baseline before implementation');
+  const keys = policy.mockups.map(imageKey);
+  if (new Set(keys).size !== keys.length) designFail('MOCKUPS', 'Duplicate mockups cannot substitute for page and state coverage');
+  for (const mockup of policy.mockups) {
+    const page = site.pages.find(item => item.id === mockup.pageId);
+    if (!page?.states.includes(mockup.stateId)) designFail('MOCKUPS', 'Mockups must map to real flow pages and states');
+  }
+  for (const page of site.pages) for (const state of page.states) for (const theme of ['light', 'dark']) {
+    if (!policy.mockups.some(image => image.pageId === page.id && image.stateId === state && image.theme === theme)) designFail('MOCKUPS', `Missing mockup/prototype: ${page.id}/${state}/${theme}`);
+  }
+  validateDesignScenarios(policy);
+  return policy;
+}
+function validateDesignScenarios(policy) {
+  const { site, rules, mockups } = policy, used = new Set(), edges = new Set();
+  for (const scenario of rules.scenarios) {
+    if (!mockups[scenario.mockupIndex] || used.has(scenario.mockupIndex)) designFail('COVERAGE', 'Each mockup needs exactly one executable browser scenario');
+    used.add(scenario.mockupIndex);
+    const page = site.pages.find(item => item.id === scenario.entryPageId);
+    if (!page || !scenario.route.startsWith('/') || scenario.route.startsWith('//') || /[\\\r\n]/.test(scenario.route)) designFail('COVERAGE', 'Browser scenarios require a bounded local route');
+    const assertions = [...scenario.checks, ...scenario.steps.flatMap(step => [...step.checks, ...(step.readBack?.afterReload ?? [])])];
+    if (!assertions.some(check => check.kind === 'bounds') || !assertions.some(check => check.kind === 'style')) designFail('VISUAL', 'Each scenario needs frozen layout bounds and computed style checks');
+    for (const check of assertions) {
+      if (['text', 'value', 'style'].includes(check.kind) && typeof check.value !== 'string'
+        || check.kind === 'count' && !Number.isInteger(check.count) || check.kind === 'bounds' && !check.bounds
+        || check.kind === 'style' && !check.property) designFail('CHECKS', 'Browser assertions require exact expected values');
+    }
+    let cursor = page.id;
+    for (const step of scenario.steps) {
+      const edge = site.edges.find(item => item.id === step.edgeId);
+      if (!edge || edge.from !== cursor) designFail('COVERAGE', 'Browser actions must follow the original whole-site page transitions');
+      cursor = edge.to;
+      edges.add(edge.id);
+      if (!['save', 'delete'].includes(edge.kind) && step.mutations.length) designFail('INTERACTION', 'Open, edit, input, navigation and cancel actions must not save data');
+      if (['save', 'delete'].includes(edge.kind)) validateReadBack(step, edge, site.pages.find(item => item.id === edge.to), policy);
+    }
+    if (cursor !== mockups[scenario.mockupIndex].pageId) designFail('COVERAGE', 'The final screen must correspond to its approved mockup');
+  }
+  if (used.size !== mockups.length || site.edges.some(edge => !edges.has(edge.id))) designFail('COVERAGE', 'Browser scenarios must cover every approved mockup and flow action');
+}
+function validateReadBack(step, edge, page, policy) {
+  const proof = step.readBack;
+  if (!proof || proof.kind === 'http' && (!step.mutations.length || !proof.path || !proof.statusBefore || !proof.statusAfter)
+    || proof.kind === 'local-storage' && (!proof.key || step.mutations.length)) designFail('STATE_PROOF', 'A save/delete needs actual HTTP or local storage state read-back and reload assertions');
+  if (proof.kind === 'http') {
+    const target = new URL(proof.path, policy.rules.previewOrigin);
+    if (target.origin !== new URL(policy.rules.previewOrigin).origin || /[\\\r\n]/.test(proof.path)) designFail('STATE_PROOF', 'Read-back stays inside the approved isolated preview');
+  }
+  const succeeded = proof.kind === 'local-storage' || step.mutations.some(item => item.status < 300);
+  if (succeeded === (canonical(proof.before) === canonical(proof.after))) designFail('STATE_PROOF', 'Successful commits must change the declared state; failed commits must preserve it');
+  for (const expected of [proof.before, proof.after]) if (expected && Object.keys(expected).some(key => !page.publicFields.includes(key))) designFail('STATE_PROOF', 'Only the original public field projection can be checked or rendered');
+  if (proof.after && Object.keys(proof.after).some(field => !proof.afterReload.some(check => check.field === field && ['text', 'value'].includes(check.kind)))
+    || !proof.after && !proof.afterReload.some(check => check.kind === 'hidden')) designFail('STATE_PROOF', 'Reload must verify every saved public field or the removed record');
+}
+export function validateDesignReport(raw, policy) {
+  const report = designSchema('report', raw), { reportDigest, ...body } = report;
+  validateDesignPolicy(policy);
+  if (designDigest(body) !== reportDigest || report.baselineDigest !== policy.baselineDigest
+    || report.results.length !== policy.rules.scenarios.length || !Number.isFinite(Date.parse(report.startedAt))
+    || !Number.isFinite(Date.parse(report.finishedAt)) || Date.parse(report.finishedAt) < Date.parse(report.startedAt)
+    || Date.parse(report.startedAt) < Date.parse(policy.mockupsRecordedAt)
+    || Date.parse(report.finishedAt) > Date.now() + 5000 || !/^playwright-core\/1\.64\.1 chromium\/[0-9]/.test(report.engine)) designFail('ACCEPTANCE', 'Browser report lost its exact design baseline or coverage');
+  const indexes = new Set();
+  for (const result of report.results) {
+    const scenario = policy.rules.scenarios.find(item => item.mockupIndex === result.mockupIndex);
+    const count = scenario && scenario.checks.length + scenario.steps.reduce((sum, step) => sum + step.checks.length, 0);
+    if (!scenario || indexes.has(result.mockupIndex) || result.failures.length || result.checks !== count
+      || result.steps !== scenario.steps.length
+      || result.stateChecks !== scenario.steps.filter(step => step.readBack).length * 2 + Number(scenario.steps.some(step => step.readBack))) designFail('ACCEPTANCE', 'Failed, incomplete or duplicate functional/visual evidence cannot pass');
+    indexes.add(result.mockupIndex);
+  }
+  if (new Set(report.sourceManifest.map(file => file.path)).size !== report.sourceManifest.length
+    || policy.rules.uiPaths.some(name => !report.sourceManifest.some(file => file.path === name))) designFail('ACCEPTANCE', 'Acceptance must bind every approved UI file');
+  return report;
+}

package/design-release.mjs

@@ -0,0 +1,25 @@
+export const DESIGN_GATE_SOURCE_FILES = [
+  "design-browser-checks.mjs",
+  "design-browser-identity.mjs",
+  "design-browser-state.mjs",
+  "design-browser.mjs",
+  "design-context.mjs",
+  "design-contracts.d.mts",
+  "design-contracts.mjs",
+  "design-declaration.mjs",
+  "design-frameworks.mjs",
+  "design-gate.mjs",
+  "design-lint.mjs",
+  "design-local-contracts.mjs",
+  "design-operations.mjs",
+  "design-policy.d.mts",
+  "design-policy.mjs",
+  "design-research.mjs",
+  "design-runner.mjs",
+  "design-store.mjs",
+  "design-ui.mjs",
+  "DESIGN-GATES.md",
+  "design-release.mjs"
+];
+export const designGateReleaseLabels = Object.fromEntries(DESIGN_GATE_SOURCE_FILES.map(file => [file,
+  { zh: "全站流程、设计确认与真实功能视觉验收门禁", en: "whole-site flow, design approval and actual functional/visual acceptance gates" }]));

package/design-research.mjs

@@ -0,0 +1,99 @@
+import https from 'node:https';
+import dns from 'node:dns/promises';
+import net from 'node:net';
+import path from 'node:path';
+import { parse as yaml } from 'yaml';
+import { mutationRead14, mutationTarget14 } from './local-mutation-files.mjs';
+import { sha256 } from './local-integrity.mjs';
+import { designFail } from './design-policy.mjs';
+
+import { FRAMEWORK_DOC_HOSTS } from './design-frameworks.mjs';
+export { FRAMEWORK_DOC_HOSTS } from './design-frameworks.mjs';
+export function researchUrl(value) {
+  let url; try { url = new URL(value); } catch { designFail('RESEARCH_URL', 'Research requires an absolute public HTTPS URL'); }
+  if (url.protocol !== 'https:' || url.username || url.password || url.port && url.port !== '443' || url.hash
+    || net.isIP(url.hostname) || /(^|\.)(localhost|local|internal|test|invalid)$/i.test(url.hostname)
+    || [...url.searchParams.keys()].some(key => /token|secret|password|key|signature|credential/i.test(key))) designFail('RESEARCH_URL', 'Research URLs must be public, credential-free HTTPS references');
+  return url;
+}
+function publicIp(address) {
+  if (net.isIP(address) !== 4) return false;
+  const [a, b, c] = address.split('.').map(Number);
+  return ![0, 10, 127].includes(a) && a < 224 && !(a === 169 && b === 254)
+    && !(a === 172 && b >= 16 && b <= 31) && !(a === 192 && (b === 168 || b === 0 && [0, 2].includes(c)))
+    && !(a === 198 && ([18, 19].includes(b) || b === 51 && c === 100)) && !(a === 203 && b === 0 && c === 113)
+    && !(a === 100 && b >= 64 && b <= 127);
+}
+export async function fetchDesignReference(value, redirects = 0) {
+  const url = researchUrl(value), addresses = await dns.lookup(url.hostname, { all: true, family: 4 });
+  if (!addresses.length || addresses.some(item => !publicIp(item.address))) designFail('RESEARCH_URL', 'Research hostname resolves outside the public internet');
+  const result = await new Promise((resolve, reject) => {
+    const req = https.get(url, { headers: { accept: 'text/html,text/plain,application/json', 'user-agent': 'Entrorove design research' },
+      lookup: (_host, options, callback) => callback(null, options.all ? [addresses[0]] : addresses[0].address, 4) }, response => {
+      const chunks = []; let bytes = 0;
+      response.on('data', chunk => { bytes += chunk.length; if (bytes > 2_097_152) req.destroy(Object.assign(new Error('Research response exceeds 2 MiB'), { code: 'ENTROROVE_DESIGN_RESEARCH_SIZE' })); else chunks.push(chunk); });
+      response.on('end', () => resolve({ status: response.statusCode, location: response.headers.location, type: response.headers['content-type'], body: Buffer.concat(chunks) }));
+      response.on('error', reject);
+    });
+    req.setTimeout(15_000, () => req.destroy(Object.assign(new Error('Research fetch timed out'), { code: 'ENTROROVE_DESIGN_RESEARCH_TIMEOUT' })));
+    req.on('error', reject);
+  });
+  if ([301, 302, 303, 307, 308].includes(result.status)) {
+    if (!result.location || redirects >= 4) designFail('RESEARCH_REDIRECT', 'Research redirect did not resolve to a bounded public reference');
+    return fetchDesignReference(new URL(result.location, url).href, redirects + 1);
+  }
+  if (result.status !== 200 || !/^(text\/(html|plain)|application\/json)\b/i.test(result.type ?? '') || result.body.length < 80) designFail('RESEARCH_HTTP', 'Official and layout references must return actual readable documentation');
+  return { finalUrl: url.href, sha256: sha256(result.body), bytes: result.body.length, retrievedAt: new Date().toISOString() };
+}
+function lockedVersion(raw, lockPath, packageName, packagePath) {
+  if (path.basename(lockPath) === 'package-lock.json') {
+    const lock = JSON.parse(raw), prefix = path.posix.dirname(packagePath), base = prefix === '.' ? '' : `${prefix}/`;
+    return lock.packages?.[`${base}node_modules/${packageName}`]?.version ?? lock.packages?.[`node_modules/${packageName}`]?.version;
+  }
+  if (path.basename(lockPath) === 'pnpm-lock.yaml') {
+    const lock = yaml(raw), importer = lock.importers?.[path.posix.dirname(packagePath)], entry = importer?.dependencies?.[packageName] ?? importer?.devDependencies?.[packageName];
+    return String(entry?.version ?? '').replace(/\(.*/, '');
+  }
+  designFail('FRAMEWORK_LOCK', 'Resolve the declared framework from package-lock.json or pnpm-lock.yaml; unsupported locks stay unverified');
+}
+export async function frameworkBinding(input, framework) {
+  const hosts = FRAMEWORK_DOC_HOSTS[framework.packageName];
+  if (!hosts || !framework.officialUrls?.length || framework.officialUrls.some(value => !hosts.includes(researchUrl(value).hostname))) designFail('FRAMEWORK', 'Declared frameworks require recognized official documentation hosts');
+  const pkg = await mutationRead14(input, input.repositoryRoot, framework.packagePath), lock = await mutationRead14(input, input.repositoryRoot, framework.lockPath);
+  const declared = JSON.parse(pkg.content.toString('utf8'));
+  if (!(declared.dependencies?.[framework.packageName] ?? declared.devDependencies?.[framework.packageName])
+    || lockedVersion(lock.content.toString('utf8'), framework.lockPath, framework.packageName, framework.packagePath) !== framework.version) designFail('FRAMEWORK_VERSION', 'Official framework conventions must bind the exact version in the actual dependency lock');
+  return { ...framework, packageSha256: pkg.sha256, lockSha256: lock.sha256 };
+}
+export async function assertDeclaredDesignFrameworks(input, design) {
+  const checked = new Set(), declared = new Set(design.frameworks.map(framework => framework.packageName));
+  for (const source of design.rules.uiPaths) {
+    let directory = path.posix.dirname(source);
+    while (true) {
+      const name = directory === '.' ? 'package.json' : `${directory}/package.json`;
+      const file = await mutationTarget14(input.repositoryRoot, name, true);
+      if (file.exists) {
+        if (!checked.has(name)) {
+          const actual = JSON.parse((await mutationRead14(input, input.repositoryRoot, name)).content.toString('utf8'));
+          const packages = { ...actual.dependencies, ...actual.devDependencies };
+          if (Object.keys(packages).some(packageName => Object.hasOwn(FRAMEWORK_DOC_HOSTS, packageName) && !declared.has(packageName))) designFail('FRAMEWORK_MISSING', 'Research every actual declared framework in the nearest UI package using its official documentation and locked version');
+          checked.add(name);
+        }
+        break;
+      }
+      if (directory === '.') break;
+      directory = path.posix.dirname(directory);
+    }
+  }
+  for (const module of design.rules.componentModules) if (!module.module.startsWith('.')
+    && !design.frameworks.some(framework => module.module === framework.packageName || module.module.startsWith(`${framework.packageName}/`))) designFail('FRAMEWORK_MISSING', 'External component libraries require their own declared official framework documentation');
+  for (const module of design.rules.frameworkStyleImports ?? []) if (!design.frameworks.some(framework => module.startsWith(`${framework.packageName}/`))) designFail('FRAMEWORK_MISSING', 'Framework theme imports must belong to an approved, version-bound framework');
+  for (const name of design.rules.uiPaths) if (/\.vue$/i.test(name) && !declared.has('vue') || /\.svelte$/i.test(name) && !declared.has('svelte')) designFail('FRAMEWORK_MISSING', 'Framework-specific UI source cannot skip its official conventions');
+}
+export async function assertFrozenDesignFrameworks(input, design) {
+  await assertDeclaredDesignFrameworks(input, design);
+  for (const framework of design.frameworks) {
+    const bound = await frameworkBinding(input, framework);
+    if (bound.packageSha256 !== framework.packageSha256 || bound.lockSha256 !== framework.lockSha256) designFail('FRAMEWORK_CHANGED', 'Framework version or dependency bytes changed after design confirmation');
+  }
+}

package/design-runner.mjs

@@ -0,0 +1,31 @@
+import { mutationRead14, mutationTarget14 } from './local-mutation-files.mjs';
+import { assertDesignDeclaration } from './design-declaration.mjs';
+import { assertDesignWrite } from './design-gate.mjs';
+import { designUiCandidate } from './design-ui.mjs';
+import { designFail } from './design-policy.mjs';
+
+export async function designRunnerBefore(input, authority) {
+  const policy = authority.plan.policy.discipline, originals = new Map();
+  if (!policy || policy.access === 'read-only') return originals;
+  assertDesignDeclaration(policy, policy.writes.flatMap(write => [write.targetPath, ...(write.destinationPath ? [write.destinationPath] : [])]));
+  for (const write of policy.writes) {
+    const target = await mutationTarget14(authority.root, write.targetPath, true);
+    const source = target.exists ? (await mutationRead14(input, authority.root, write.targetPath)).content.toString('utf8') : '';
+    originals.set(write.targetPath, source);
+    if (designUiCandidate(write.targetPath, source)) await assertDesignWrite(input,
+      { flowId: input.flowId, disciplinePolicy: policy }, write.targetPath, source, source);
+  }
+  return originals;
+}
+export async function designRunnerAfter(input, authority, changed, originals) {
+  const policy = authority.plan.policy.discipline;
+  for (const name of changed) {
+    const target = await mutationTarget14(authority.root, name, true);
+    const source = target.exists && target.stat.size <= 2_097_152
+      ? (await mutationRead14(input, authority.root, name)).content.toString('utf8') : '';
+    const before = originals.get(name) ?? '';
+    if (!designUiCandidate(name, before, source) && !policy?.design?.rules.uiPaths.includes(name)) continue;
+    if (!policy?.writes.some(write => write.targetPath === name || write.destinationPath === name)) designFail('UNDECLARED_WRITE', 'Runner changed an undeclared UI source; preserve the failed run and its unknown effects');
+    await assertDesignWrite(input, { flowId: input.flowId, disciplinePolicy: policy }, name, before, source);
+  }
+}

package/design-store.mjs

@@ -0,0 +1,116 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { inflateSync } from 'node:zlib';
+import { mutationRoot14, mutationStateRoot14, mutationTarget14, mutationRead14, privateMutationDirectory14, readMutationJson14,
+  writeMutationFile14, atomicMutationJson14, mutationId14 } from './local-mutation-files.mjs';
+import { regular } from './local-task-handoff-storage.mjs';
+import { sha256, canonical } from './local-integrity.mjs';
+import { designFail, validateDesignSite } from './design-policy.mjs';
+
+export async function designDirectory(input) {
+  const root = await mutationRoot14(input.repositoryRoot), state = await mutationStateRoot14(input);
+  mutationId14(input.flowId, 'flowId'); mutationId14(input.designId, 'designId');
+  if (!Number.isSafeInteger(input.revision) || input.revision < 1) designFail('INVALID', 'A positive design revision is required');
+  const directory = path.join(state, 'design', sha256(root).slice(0, 32), input.flowId, input.designId, `r${input.revision}`);
+  await privateMutationDirectory14(directory, { privateFrom: state });
+  return directory;
+}
+export async function designSave(directory, name, value) {
+  const file = path.join(directory, name);
+  await atomicMutationJson14(file, value);
+  return file;
+}
+export async function designLoad(directory, name) { return readMutationJson14(path.join(directory, name)); }
+export async function designArtifact(file, expected) {
+  const { bytes, stat } = await regular(file, 8_388_608);
+  if (stat.nlink !== 1 || stat.mode & 0o111 || expected && (sha256(bytes) !== expected.sha256 || bytes.length !== expected.bytes)) designFail('ARTIFACT_CHANGED', 'Design evidence must retain its exact non-executable, single-link bytes');
+  return bytes;
+}
+export async function designCopy(directory, name, file) {
+  const bytes = await designArtifact(file), target = path.join(directory, name);
+  await writeMutationFile14(target, bytes);
+  return { path: target, sha256: sha256(bytes), bytes: bytes.length };
+}
+function crc32(bytes) {
+  let crc = 0xffffffff;
+  for (const byte of bytes) { crc ^= byte; for (let i = 0; i < 8; i++) crc = crc & 1 ? 0xedb88320 ^ crc >>> 1 : crc >>> 1; }
+  return (crc ^ 0xffffffff) >>> 0;
+}
+export function designPng(bytes) {
+  if (!bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))) designFail('IMAGE', 'Generated design images must be complete PNG files');
+  let offset = 8, header, end = false, data = [];
+  while (offset + 12 <= bytes.length) {
+    const length = bytes.readUInt32BE(offset), type = bytes.toString('ascii', offset + 4, offset + 8), next = offset + length + 12;
+    if (next > bytes.length || crc32(bytes.subarray(offset + 4, next - 4)) !== bytes.readUInt32BE(next - 4)) designFail('IMAGE', 'PNG bounds or checksum failed');
+    if (offset === 8 && type !== 'IHDR' || type === 'IHDR' && (header || length !== 13)) designFail('IMAGE', 'PNG header is invalid');
+    if (type === 'IHDR') header = bytes.subarray(offset + 8, next - 4);
+    else if (type === 'IDAT') data.push(bytes.subarray(offset + 8, next - 4));
+    else if (type === 'IEND') { end = length === 0 && next === bytes.length; break; }
+    else if (/^[A-Z]/.test(type) && type !== 'PLTE') designFail('IMAGE', 'Unsupported critical PNG chunk');
+    offset = next;
+  }
+  const width = header?.readUInt32BE(0), height = header?.readUInt32BE(4), channels = { 0: 1, 2: 3, 4: 2, 6: 4 }[header?.[9]];
+  if (!end || !width || !height || width > 4096 || height > 4096 || header[8] !== 8 || !channels
+    || header[10] || header[11] || header[12] || !data.length) designFail('IMAGE', 'Unsupported or incomplete generated PNG; use non-interlaced 8-bit PNG');
+  let expanded;
+  try { expanded = inflateSync(Buffer.concat(data), { maxOutputLength: 68_000_000 }); }
+  catch { designFail('IMAGE', 'Generated PNG data cannot be decoded'); }
+  const row = width * channels + 1;
+  if (expanded.length !== row * height || Array.from({ length: height }, (_, i) => expanded[i * row]).some(filter => filter > 4)) designFail('IMAGE', 'Generated PNG scanlines are invalid');
+  return { width, height };
+}
+export function designMermaid(raw) {
+  const site = validateDesignSite(raw), ids = new Map(site.pages.map((page, index) => [page.id, `p${index}`]));
+  const label = value => `"${value.replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\|/g, '&#124;').replace(/[\r\n]/g, ' ')}"`;
+  return ['flowchart TD', ...site.pages.map(page => `  ${ids.get(page.id)}[${label(`${page.title} (${page.id}) · ${page.roles.join('/')} · ${page.states.join('/')}`)}]`),
+    ...site.edges.map(edge => `  ${ids.get(edge.from)} -->|${label(`${edge.id}: ${edge.label} (${edge.kind})`)}| ${ids.get(edge.to)}`)].join('\n') + '\n';
+}
+export async function assertDesignArtifacts(policy, input) {
+  const directory = input ? await designDirectory({ ...input, designId: policy.designId, revision: policy.revision }) : path.dirname(policy.flow.path);
+  if (policy.flow.path !== path.join(directory, 'site-flow.mmd') || policy.mockups.some((mockup, index) =>
+    mockup.image.path !== path.join(directory, `mockup-${index}.png`)
+    || mockup.generation.receipt.path !== path.join(directory, `generation-${index}.json`))) designFail('ARTIFACT_LOCATION', 'Design evidence must remain in its original repository, flow and revision storage');
+  const diagram = await designArtifact(policy.flow.path, policy.flow);
+  if (diagram.toString('utf8') !== designMermaid(policy.site)) designFail('FLOW', 'The displayed whole-site diagram differs from its page/action inventory');
+  for (const [index, source] of policy.sourceBaseline.entries()) if (source.original) {
+    if (source.original.path !== path.join(directory, `source-${index}.original`)) designFail('ARTIFACT_LOCATION', 'Original UI bytes must remain in their approved design revision');
+    await designArtifact(source.original.path, source.original);
+  }
+  for (const mockup of policy.mockups) {
+    designPng(await designArtifact(mockup.image.path, mockup.image));
+    let receipt;
+    try { receipt = JSON.parse((await designArtifact(mockup.generation.receipt.path, mockup.generation.receipt)).toString('utf8')); }
+    catch { designFail('GENERATION', 'The original image generation record is unavailable or invalid'); }
+    if (Object.keys(receipt).sort().join('|') !== 'generatedAt|imageSha256|promptSha256|requestId|schemaVersion|tool') designFail('GENERATION', 'Image generation records contain only tool identity, prompt/image hashes and the actual generation time');
+    if (receipt.schemaVersion !== 'entrorove.image-generation-record/1.0' || receipt.tool !== mockup.generation.tool
+      || receipt.requestId !== mockup.generation.requestId || receipt.promptSha256 !== mockup.generation.promptSha256
+      || receipt.imageSha256 !== mockup.image.sha256 || !Number.isFinite(Date.parse(receipt.generatedAt))
+      || Date.parse(receipt.generatedAt) < Date.parse(policy.researchRecordedAt)
+      || Date.parse(receipt.generatedAt) > Date.parse(policy.mockupsRecordedAt)) designFail('GENERATION', 'Record the actual image/design tool result after research, bound to these image bytes');
+  }
+}
+export async function captureDesignSourceBaseline(input, directory, names) {
+  const baseline = [];
+  for (const [index, name] of names.entries()) {
+    const file = await mutationTarget14(input.repositoryRoot, name, true);
+    if (!file.exists) { baseline.push({ path: name, original: null }); continue; }
+    const { content } = await mutationRead14(input, input.repositoryRoot, name), target = path.join(directory, `source-${index}.original`);
+    if (content.length > 2_097_152) designFail('LINT_LIMIT', 'Split approved UI source inspection before capturing a source larger than 2 MiB');
+    await writeMutationFile14(target, content);
+    baseline.push({ path: name, original: { path: target, sha256: sha256(content), bytes: content.length } });
+  }
+  return baseline;
+}
+export async function designOriginalSource(policy, name) {
+  const source = policy.sourceBaseline.find(file => file.path === name);
+  if (!source) designFail('BASELINE', 'UI source has no original approved baseline');
+  return source.original ? (await designArtifact(source.original.path, source.original)).toString('utf8') : '';
+}
+export async function designSourceManifest(input, policy) {
+  const { mutationRead14 } = await import('./local-mutation-files.mjs');
+  const root = await mutationRoot14(input.repositoryRoot), files = [];
+  const paths = new Set([...policy.rules.verificationPaths, ...policy.frameworks.flatMap(f => [f.packagePath, f.lockPath])]);
+  for (const name of [...paths].sort()) files.push({ path: name, sha256: (await mutationRead14(input, root, name)).sha256 });
+  return files;
+}
+export const sameDesignBytes = (a, b) => canonical(a) === canonical(b);

package/design-ui.mjs

@@ -0,0 +1,24 @@
+import ts from 'typescript';
+
+const uiExtension = /\.(?:[jt]sx|vue|svelte|html?|xhtml|css|scss|sass|less|styl|wxml|wxss|axml|acss)$/i;
+export const designUiAsset = name => /\.(?:png|jpe?g|webp|avif|gif|ico|woff2?|ttf|otf)$/i.test(name);
+const markup = /<\/?(?:html|head|body|main|div|section|form|button|input|table|dialog|template|script|style|[A-Z][A-Za-z0-9]*)\b[^>]*>/;
+function scriptUi(source, name) {
+  const kind = /\.[cm]?ts$/i.test(name) ? ts.ScriptKind.TS : ts.ScriptKind.TSX;
+  const tree = ts.createSourceFile(name, source, ts.ScriptTarget.Latest, true, kind);
+  let found = false;
+  const walk = node => {
+    if (ts.isJsxElement(node) || ts.isJsxSelfClosingElement(node) || ts.isJsxFragment(node)
+      || ts.isPropertyAccessExpression(node) && ['createElement', 'createRoot', 'innerHTML', 'outerHTML', 'insertAdjacentHTML',
+        'querySelector', 'querySelectorAll', 'getElementById', 'style'].includes(node.name.text)
+      || (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node) || ts.isTemplateHead(node)) && markup.test(node.text)) found = true;
+    if (!found) ts.forEachChild(node, walk);
+  };
+  walk(tree); return found;
+}
+export function designUiCandidate(name, before = '', after = '') {
+  if (uiExtension.test(name) || /\.svg$/i.test(name)
+    || /(?:^|\/)(?:public|assets|images|icons)\//i.test(name) && designUiAsset(name)) return true;
+  if (/\.(?:[cm]?[jt]s)$/i.test(name)) return Boolean(before || after) && (scriptUi(before, name) || scriptUi(after, name));
+  return /\.(?:php|txt)$/i.test(name) && markup.test(`${before}\n${after}`);
+}

package/install-identity.mjs

@@ -0,0 +1,16 @@
+import { createHash } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+export async function installPackageIdentity(directory, metadata) {
+  const files = [...new Set(['package.json', ...metadata.files])].sort(), digest = createHash('sha256');
+  for (const name of files) {
+    if (typeof name !== 'string' || path.isAbsolute(name) || name.includes('\\')
+      || name.split('/').some(part => !part || part === '.' || part === '..')) throw new Error('Invalid packaged source inventory');
+    const file = path.join(directory, name), stat = await fs.lstat(file);
+    if (!stat.isFile() || stat.isSymbolicLink()) throw new Error('Packaged source identity requires regular files');
+    const bytes = await fs.readFile(file);
+    digest.update(`${name}\0${createHash('sha256').update(bytes).digest('hex')}\n`);
+  }
+  return digest.digest('hex');
+}

package/local-cli.mjs

@@ -25,6 +25,7 @@ import { ARCHGUARD_LOCAL_OPERATIONS } from './local-archguard-operations.mjs';
 import { LOCAL_BUDGET_HANDOFF_OPERATIONS } from './local-budget-handoff.mjs';
 import { LOCAL_CHAIN_OPERATIONS } from './local-chain-operations.mjs';
 import { DISCIPLINE_LOCAL_OPERATIONS } from './local-discipline-operations.mjs';
+import { DESIGN_LOCAL_OPERATIONS } from './design-operations.mjs';
 import { assertIdeExecution, settleBreakGlassSession } from './ide-session.mjs';
 import { runManagedWorkflowLocalStep } from './workflow-local-client.mjs';
 import { localErrorEnvelope } from './local-error.mjs';
@@ -47,6 +48,7 @@ const operations = {
   'mutation-consumption-attest': attestMutationConsumption14,
   'mutation-delegate-prepare': preparePreservedMutationSigner,
   ...DISCIPLINE_LOCAL_OPERATIONS,
+  ...DESIGN_LOCAL_OPERATIONS,
   'snapshot-plan': snapshotPlan, 'snapshot-verify': snapshotVerify, 'mutation-snapshot-attest': attestMutationSnapshot14, 'mutate-gate': mutateGate,
   'gate-issue': issueMutationPass, 'gate-verify': verifyMutationPass, 'guarded-write': guardedWrite,
   'budget-init': budgetInit, 'budget-context': budgetContext, 'budget-read': budgetRead, 'budget-status': budgetStatus,
@@ -87,7 +89,7 @@ function capabilitiesFor(group) {
 async function checkedLocalInput(operation, input) {
   try {
     const validated = validateLocalInput(operation, input);
-    if (['mutation-snapshot-attest', 'mutation-consumption-attest', 'workflow-run-step', 'mutate-gate', 'gate-issue', 'gate-verify', 'guarded-write', 'guarded-delete', 'guarded-move', 'discipline-review', 'discipline-check'].includes(operation)) await hydrateCloudMutationAuthority(input.home, new URL(apiUrl).origin);
+    if (['mutation-snapshot-attest', 'mutation-consumption-attest', 'workflow-run-step', 'design-verify', 'mutate-gate', 'gate-issue', 'gate-verify', 'guarded-write', 'guarded-delete', 'guarded-move', 'discipline-review', 'discipline-check'].includes(operation)) await hydrateCloudMutationAuthority(input.home, new URL(apiUrl).origin);
     return validated;
   }
   catch (cause) {

package/local-contracts.mjs

@@ -9,6 +9,7 @@ import { WORKFLOW_LOCAL_OPERATION_SCHEMA } from './workflow-local-contracts.mjs'
 import { HANDOFF_WRITE_PASS_SCHEMA, HANDOFF_PROVISIONAL_LEASE_SCHEMA, HANDOFF_SNAPSHOT_CANDIDATE_SCHEMA } from './local-task-handoff-contracts.mjs';
 import { LOCAL_CHAIN_OPERATION_SCHEMAS } from './local-chain-contracts.mjs';
 import { DISCIPLINE_DECLARATION_SCHEMA } from './local-discipline-contracts.mjs';
+import { DESIGN_LOCAL_OPERATION_SCHEMAS } from './design-local-contracts.mjs';
 import { array, binding, change, confirmation, enumeration, evidence, evidenceArray, executionContext, executionPlan,
   formula, formulaDefinitions, formulaEntry, decimalValues, identifier, integer, ledgerIdentifier, modes, nullable, object, paths, record, relativePath, sha256, text } from './local-contract-types.mjs';
 
@@ -85,6 +86,7 @@ add('chain-resume', { ...chain, stepId: ledgerIdentifier, status: enumeration(['
 add('chain-status|chain-ledger-status', chain, ['repositoryRoot', 'chainId']);
 add('chain-answer', { ...chain, stepId: ledgerIdentifier, answer: { anyOf: [text, object({ id: text }, ['id'])] }, accepted: { type: 'boolean' }, actorId: nullable(text) }, ['repositoryRoot', 'chainId', 'answer']);
 Object.assign(schemas, LOCAL_CHAIN_OPERATION_SCHEMAS);
+Object.assign(schemas, DESIGN_LOCAL_OPERATION_SCHEMAS);
 const renewal = { ...flow, requestId: identifier, scope: object({ goal: text, allowedPaths: paths, forbiddenPaths: paths }, ['goal', 'allowedPaths']), policy: object({ intervalMs: integer(1), maxRenewals: integer(1, 100) }, ['intervalMs', 'maxRenewals']) };
 add('budget-auto-renew-request', renewal, ['repositoryRoot', 'flowId', 'requestId', 'scope', 'policy']);
 add('budget-auto-renew', { ...renewal, confirmation, grant: record }, ['repositoryRoot', 'flowId', 'requestId', 'scope', 'policy'], ['grant', 'confirmation']);

package/local-discipline-actions.mjs

@@ -9,6 +9,8 @@ import { assertDisciplineRepository } from './local-discipline-repository.mjs';
 import { saveMutationConsumption14 } from './local-mutation-pass-store.mjs';
 import { auditMutation14, withMutationAudit14 } from './local-mutation-audit.mjs';
 import { mutationFail14, removeMutationProjectFile14, moveMutationProjectFile14 } from './local-mutation-files.mjs';
+import { assertDesignWrite } from './design-gate.mjs';
+import { readSnapshotCopy14 } from './local-mutation-snapshot.mjs';
 
 function actionIntent(input, value, kind, review) {
   if (value.pass.writeDelegation) mutationFail14('ENTROROVE_MUTATION_DELEGATION_CHANGE', 'Preserved mutation forbids structural file actions');
@@ -38,6 +40,9 @@ async function perform(input, kind, original, state) {
     const review = await readDisciplineSnapshot(snapshot), intent = actionIntent(input, value, kind, review);
     await assertDisciplineRepository(input, binding.root, review, ledger);
     const source = snapshot.manifest.files.find(file => file.path === value.target);
+    const sourceBytes = (await readSnapshotCopy14(input, snapshot.snapshotRoot, snapshot.manifest, value.target)).content.toString('utf8');
+    await assertDesignWrite(input, pass, value.target, sourceBytes, kind === 'move' ? sourceBytes : '');
+    if (kind === 'move') await assertDesignWrite(input, pass, intent.destinationPath, '', sourceBytes);
     const at = new Date().toISOString();
     const writes = { ...ledger.writes, [value.target]: { status: 'pending', kind: 'delete', contentDigest: source.sha256, mode: source.mode, at } };
     let destination;

package/local-discipline-batch.mjs

@@ -3,6 +3,10 @@ import { mutationFail14 } from './local-mutation-files.mjs';
 import { disciplineWritePreflight } from './local-discipline-gate.mjs';
 import { readDisciplineSnapshot } from './local-discipline-snapshot.mjs';
 import { assertDisciplineRepository } from './local-discipline-repository.mjs';
+import { designUiCandidate } from './design-ui.mjs';
+import { archiveFormat } from './package-archive.mjs';
+import { assertRollbackCandidate, rememberMutationBaselines } from './rollback-history.mjs';
+import { readSnapshotCopy14 } from './local-mutation-snapshot.mjs';
 
 export async function disciplineBatchBefore(input, value, options, before, after, ledger) {
   const review = await readDisciplineSnapshot(value.snapshot);
@@ -11,14 +15,18 @@ export async function disciplineBatchBefore(input, value, options, before, after
   // by mutationBatchReceiptBinding14. It restores that known image, rather than
   // proposing a new definition or reusing a forward mutation permission.
   const restoration = options.contract?.schemaVersion === 'entrorove.merge-rollback-authorization/1.0';
-  if (restoration) return review;
+  if (restoration) { await rememberMutationBaselines(input, value, before); return review; }
   for (const file of after) {
     const original = before.find(item => item.path === file.path);
     if (canonical(original) === canonical(file)) continue;
     if (!file.exists) mutationFail14('ENTROROVE_DISCIPLINE_NEEDS_HUMAN', 'Forward batch deletion requires its separate guarded deletion declaration');
+    await assertRollbackCandidate(input, value.binding.root, file.path, original.sha256, file.sha256);
     const source = options.contents?.find(item => item.path === file.path);
     if (!source) {
-      if (/\.(?:[cm]?[jt]sx?|php|py|java|rs|vue|svelte|css)$/iu.test(file.path)) mutationFail14('ENTROROVE_DISCIPLINE_REVIEW_REQUIRED', 'Source batch needs actual candidate bytes before any write');
+      const bytes = original.exists ? (await readSnapshotCopy14(input, value.snapshot.snapshotRoot, value.snapshot.manifest, file.path)).content : Buffer.alloc(0);
+      if (designUiCandidate(file.path) || archiveFormat(file.path, bytes)
+        || /(?:^|\/)(?:package|manifest)\.json$/i.test(file.path)
+        || /\.(?:[cm]?[jt]sx?|php|py|java|rs|vue|svelte|css)$/iu.test(file.path)) mutationFail14('ENTROROVE_DISCIPLINE_REVIEW_REQUIRED', 'Source or package batch needs actual candidate bytes before any write');
       continue;
     }
     const bytes = Buffer.from(source.contentBase64, 'base64');
@@ -26,7 +34,8 @@ export async function disciplineBatchBefore(input, value, options, before, after
     const intent = value.pass.disciplinePolicy?.writes.find(write => write.targetPath === file.path);
     await disciplineWritePreflight({ ...input, targetPath: file.path,
       ...(intent ? { declaration: { ...intent, usageReviewDigest: value.snapshot.manifest.disciplineReviewDigest } } : {}) },
-    { ...value, target: file.path, ledger }, bytes.toString('utf8'));
+    { ...value, target: file.path, ledger }, bytes);
   }
+  await rememberMutationBaselines(input, value, before);
   return review;
 }

package/local-discipline-contracts.mjs

@@ -1,6 +1,8 @@
 import Ajv from 'ajv';
 import { canonical, sha256 } from './local-integrity.mjs';
 import { object, array, text, identifier, relativePath, sha256 as shaSchema, integer } from './local-contract-types.mjs';
+import { DESIGN_POLICY_SCHEMA } from './design-contracts.mjs';
+import { assertDesignDeclaration } from './design-declaration.mjs';
 
 const refs = { ...array(identifier, 1), uniqueItems: true };
 const defect = object({ path: relativePath, line: integer(1) }, ['path', 'line']);
@@ -13,7 +15,7 @@ export const DISCIPLINE_WRITE_SCHEMA = object({ targetPath: relativePath,
 const approval = object({ interactionId: identifier, interactionDigest: shaSchema, auditId: identifier,
   proposalDigest: shaSchema }, ['interactionId', 'interactionDigest', 'auditId', 'proposalDigest']);
 const mutablePolicy = object({ schemaVersion: { const: 'entrorove.discipline-policy/1.0' },
-  requirementIds: refs, writes: array(DISCIPLINE_WRITE_SCHEMA, 1), approval,
+  requirementIds: refs, writes: array(DISCIPLINE_WRITE_SCHEMA, 1), approval, designApproval: approval, design: DESIGN_POLICY_SCHEMA,
   dataOperations: array(object({ operation: { enum: ['delete', 'migrate', 'rebuild'] }, target: text,
     reason: text, requirementRefs: refs, snapshotArtifactDigest: shaSchema }, ['operation', 'target', 'reason', 'requirementRefs', 'snapshotArtifactDigest'])),
 }, ['schemaVersion', 'requirementIds', 'writes']);
@@ -37,10 +39,14 @@ export function disciplinePolicy(value) {
   if (value.dataOperations?.some(action => action.requirementRefs.some(id => !requirements.has(id)))) {
     throw Object.assign(new Error('Data operations must reference original requirements'), { code: 'ENTROROVE_DISCIPLINE_POLICY_INVALID' });
   }
+  assertDesignDeclaration(value, value.writes.flatMap(write => [write.targetPath, ...(write.destinationPath ? [write.destinationPath] : [])]));
+  if (value.design && value.design.site.requirementIds.some(id => !requirements.has(id))) {
+    throw Object.assign(new Error('Design must retain its original task requirements'), { code: 'ENTROROVE_DESIGN_BINDING' });
+  }
   return structuredClone(value);
 }
 export function disciplineProposalDigest(value) {
-  const { approval, ...proposal } = disciplinePolicy(value);
+  const { approval, designApproval, ...proposal } = disciplinePolicy(value);
   return sha256(canonical(proposal));
 }
 export function disciplineHumanTriggers(value) {
@@ -50,11 +56,17 @@ export function disciplineHumanTriggers(value) {
     if (['delete', 'move'].includes(write.kind) || write.deletedSymbols?.length) triggers.add(write.kind === 'move' ? 'move' : 'delete');
   }
   if (policy.dataOperations?.length) triggers.add('existing-data');
+  if (policy.design) triggers.add('interface-design');
   return [...triggers].sort();
 }
 export function disciplineApprovedPolicy(value) {
   const policy = disciplinePolicy(value);
-  if (disciplineHumanTriggers(policy).length && (!policy.approval || policy.approval.proposalDigest !== disciplineProposalDigest(policy))) {
+  const triggers = disciplineHumanTriggers(policy), fullReview = triggers.some(trigger => trigger !== 'interface-design')
+    || Boolean(policy.design && !policy.designApproval);
+  if (policy.designApproval && (!policy.design || policy.designApproval.proposalDigest !== policy.design.baselineDigest)) {
+    throw Object.assign(new Error('The exact design revision needs its original human confirmation'), { code: 'ENTROROVE_DESIGN_APPROVAL_REQUIRED' });
+  }
+  if (fullReview && (!policy.approval || policy.approval.proposalDigest !== disciplineProposalDigest(policy))) {
     throw Object.assign(new Error('This exact change proposal needs the original persisted human approval'), { code: 'ENTROROVE_DISCIPLINE_NEEDS_HUMAN' });
   }
   return policy;