@entrorove/skill 0.1.68 → 0.1.70

package/local-contracts.mjs

@@ -103,7 +103,8 @@ const scopeTask = object({ goal: { ...text, pattern: '\\S', maxLength: 12000 },
   unclear: { type: 'boolean' }, architectureContract: { type: 'boolean' }, explicitAimlockRequested: { type: 'boolean' }, explicitEntroroveRequested: { type: 'boolean' }, userSpecifiedSkills: array(text),
   requirements: { ...array(scopeRequirement, 1), maxItems: 500 }, phase: enumeration(['plan', 'coordinate', 'architecture', 'verify', 'merge', 'decision']), baselineRef: text, interaction: scopeInteraction }, ['goal', 'workType', 'difficulty', 'risk']);
 const probe = { ...step, paths: probePaths, targetPaths: probePaths, task: scopeTask, baselineRef: text, snapshotId: identifier,
-  targetSymbols: array(text, 1), contextMapPath: relativePath, importContexts, signerConfigPath: nullable(text),
+  targetSymbols: array(text, 1), contextMapPath: relativePath, importContexts, contextRevisionDigest: sha256,
+  contextEvidence: { ...array(object({ path: relativePath, sha256 }, ['path', 'sha256'])), maxItems: 200 }, signerConfigPath: nullable(text),
   taskDigest: sha256, ownerId: ledgerIdentifier, chainDigest: sha256, repositoryId: identifier, challenge: ledgerIdentifier };
 add('probe', { ...probe, handoffCandidate: HANDOFF_SNAPSHOT_CANDIDATE_SCHEMA }, ['repositoryRoot']);
 schemas.probe.allOf = [{ if: { type: 'object', anyOf: ['flowId', 'stepId', 'snapshotId'].map(field => ({ required: [field] })) },
@@ -112,7 +113,9 @@ schemas.probe.allOf = [{ if: { type: 'object', anyOf: ['flowId', 'stepId', 'snap
     then: { type: 'object', required: ['flowId', 'stepId', 'snapshotId', 'taskDigest', 'ownerId', 'chainDigest', 'repositoryId', 'challenge'] } },
   { if: { type: 'object', required: ['handoffCandidate'] }, then: { type: 'object', required: ['flowId', 'stepId', 'snapshotId', 'paths', 'taskDigest', 'ownerId', 'chainDigest', 'repositoryId', 'challenge', 'signerConfigPath'],
     properties: { signerConfigPath: text } } },
-  { if: { type: 'object', required: ['targetSymbols'] }, then: { type: 'object', required: ['contextMapPath'] } }];
+  { if: { type: 'object', required: ['targetSymbols'] }, then: { type: 'object', required: ['contextMapPath'] } },
+  { if: { type: 'object', required: ['contextRevisionDigest'] }, then: { type: 'object', required: ['importContexts'] } },
+  { if: { type: 'object', required: ['contextEvidence'] }, then: { type: 'object', required: ['contextRevisionDigest', 'importContexts'] } }];
 add('reassess', { ...probe, snapshotId: nullable(identifier), currentMode: modes, expectedRevision: integer(1) }, ['repositoryRoot']);
 schemas.reassess.allOf = [{ if: { type: 'object', anyOf: [
   ...['flowId', 'stepId', 'expectedRevision', 'taskDigest', 'ownerId', 'chainDigest', 'repositoryId', 'challenge'].map(field => ({ required: [field] })),

package/local-delegated-modify-analysis.mjs

@@ -3,6 +3,7 @@ import { parse as parseVue, parseCache } from '@vue/compiler-sfc';
 import { canonical } from './local-integrity.mjs';
 import { createScopeImportResolver } from './local-scope-import-expressions.mjs';
 import { isDynamicFunctionReference, isTypeOnlyReference } from './local-typescript-function-reference.mjs';
+import { uniConditionalVariants } from './local-scope-uni-conditional.mjs';
 
 const fail = () => { throw Object.assign(new Error('Preserved modification changed an existing definition, public contract, dependency, or unsupported source boundary'),
   { code: 'ENTROROVE_MUTATION_DELEGATION_CHANGE' }); };
@@ -216,17 +217,25 @@ function parts(path, content) {
 function retained(before, after) {
   for (const [key, count] of before) if ((after.get(key) ?? 0) < count) fail();
 }
+function compareSource(path, before, after) {
+  if (!before.trim() && !after.trim()) return;
+  const original = parts(path, before), candidate = parts(path, after);
+  if (canonical(original.metadata) !== canonical(candidate.metadata) || original.scripts.length !== candidate.scripts.length) fail();
+  for (let index = 0; index < original.scripts.length; index++) {
+    const a = scriptProjection(original.scripts[index]), b = scriptProjection(candidate.scripts[index]);
+    if (canonical(a.dependencies) !== canonical(b.dependencies) || canonical(a.public) !== canonical(b.public)) fail();
+    retained(a.definitions, b.definitions); retained(a.signatures, b.signatures); retained(b.unknown, a.unknown);
+  }
+}
 export function assertDelegatedSourceModification(input) {
   const { path, before, after } = input ?? {};
   if (typeof path !== 'string' || typeof before !== 'string' || typeof after !== 'string'
     || Buffer.byteLength(before) > 1_048_576 || Buffer.byteLength(after) > 1_048_576) fail();
   try {
-    const original = parts(path, before), candidate = parts(path, after);
-    if (canonical(original.metadata) !== canonical(candidate.metadata) || original.scripts.length !== candidate.scripts.length) fail();
-    for (let index = 0; index < original.scripts.length; index++) {
-      const a = scriptProjection(original.scripts[index]), b = scriptProjection(candidate.scripts[index]);
-      if (canonical(a.dependencies) !== canonical(b.dependencies) || canonical(a.public) !== canonical(b.public)) fail();
-      retained(a.definitions, b.definitions); retained(a.signatures, b.signatures); retained(b.unknown, a.unknown);
-    }
+    if (!/\.vue$/i.test(path)) return compareSource(path, before, after);
+    const original = uniConditionalVariants(before, path), candidate = uniConditionalVariants(after, path);
+    if (canonical(original.directives) !== canonical(candidate.directives)
+      || canonical(original.variants.map(value => value.key)) !== canonical(candidate.variants.map(value => value.key))) fail();
+    for (let index = 0; index < original.variants.length; index++) compareSource(path, original.variants[index].source, candidate.variants[index].source);
   } catch { fail(); }
 }

package/local-discipline-gate.mjs

@@ -9,6 +9,7 @@ import { assertDelegatedSourceModification } from './local-delegated-modify-anal
 import { assertDesignWrite } from './design-gate.mjs';
 import { assertPackageReplacement } from './package-replacement.mjs';
 import { assertRollbackCandidate } from './rollback-history.mjs';
+import { scopeContextSnapshotInput } from './scope-context-observation.mjs';
 
 const needs = message => mutationFail14('ENTROROVE_DISCIPLINE_NEEDS_HUMAN', message);
 function declaredWrite(input, pass, baseline) {
@@ -84,6 +85,7 @@ export async function disciplineWritePreflight(input, value, content) {
   }
   const { pass, target, binding, snapshot, ledger } = value;
   const review = await readDisciplineSnapshot(snapshot), baseline = snapshot.manifest.files.find(file => file.path === target);
+  input = (await scopeContextSnapshotInput(input, binding.root, review.scopeContext)).input;
   await assertDisciplineRepository(input, binding.root, review, ledger);
   const intent = declaredWrite(input, pass, baseline);
   const originalBytes = baseline.exists ? (await readSnapshotCopy14(input, snapshot.snapshotRoot, snapshot.manifest, target)).content : Buffer.alloc(0);

package/local-discipline-snapshot.mjs

@@ -2,16 +2,22 @@ import path from 'node:path';
 import { canonical, sha256 } from './local-integrity.mjs';
 import { atomicMutationJson14, mutationFail14, readMutationJson14 } from './local-mutation-files.mjs';
 import { disciplineRepositoryObservation } from './local-discipline-repository.mjs';
+import { scopeContextSnapshotInput } from './scope-context-observation.mjs';
 
 export function snapshotDisciplineBinding(value) {
   if (!Object.hasOwn(value, 'disciplineReviewDigest')) return {};
   if (!/^[0-9a-f]{64}$/.test(value.disciplineReviewDigest ?? '')) mutationFail14('ENTROROVE_DISCIPLINE_REVIEW_INVALID', 'Snapshot discipline review digest is invalid');
   return { disciplineReviewDigest: value.disciplineReviewDigest };
 }
-export async function captureDisciplineSnapshot(input, root, location, binding) {
-  const observed = await disciplineRepositoryObservation(input, root, { analyze: true });
+export async function captureDisciplineSnapshot(input, root, location, binding, contextAuthority) {
+  // A fresh S context candidate carries its own signed challenge mapping before
+  // admission. It must not be mistaken for an already accepted M snapshot head.
+  const selected = !contextAuthority && input.contextRevisionDigest !== undefined ? { input, context: null }
+    : await scopeContextSnapshotInput(input, root, contextAuthority, { initial: true });
+  const observed = await disciplineRepositoryObservation(selected.input, root, { analyze: true });
   const review = { schemaVersion: 'entrorove.discipline-review/1.0', ...binding,
     repositoryDigest: sha256(root).slice(0, 32), createdAt: new Date().toISOString(), ...observed,
+    ...(selected.context ? { scopeContext: selected.context } : {}),
     thresholds: { deletionAdditionRatio: null, semanticOverlap: null, directLines: null, usageScopeLimit: null } };
   const digest = sha256(canonical(review));
   await atomicMutationJson14(path.join(location.snapshotRoot, 'discipline-review.json'), review, { privateFrom: location.stateRoot });

package/local-mutation-snapshot.mjs

@@ -148,7 +148,7 @@ async function copySource(input, root, snapshotRoot, relative, stateRoot) {
   await writeMutationFile14(path.join(snapshotRoot, 'files', relative), read.content, { privateFrom: stateRoot });
   return { path: relative, exists: true, sha256: read.sha256, mode: read.mode };
 }
-export async function snapshotPlan14(input, { handoffBinding: binding = {} } = {}) {
+export async function snapshotPlan14(input, { handoffBinding: binding = {}, contextAuthority } = {}) {
   const root = await mutationRoot14(input.repositoryRoot);
   const flowId = mutationId14(input.flowId, 'flowId'); const stepId = mutationId14(input.stepId, 'stepId');
   const paths = mutationPaths14(input.paths); const handoff = handoffBinding(binding);
@@ -162,7 +162,7 @@ export async function snapshotPlan14(input, { handoffBinding: binding = {} } = {
     await privateMutationDirectory14(path.join(loc.snapshotRoot, 'files'), { privateFrom: loc.stateRoot });
     const files = [];
     for (const relative of paths) files.push(await copySource(input, root, loc.snapshotRoot, relative, loc.stateRoot));
-    const discipline = await captureDisciplineSnapshot(input, root, loc, { snapshotId, flowId, stepId });
+    const discipline = await captureDisciplineSnapshot(input, root, loc, { snapshotId, flowId, stepId }, contextAuthority);
     const core = { snapshotId, flowId, stepId, paths, files, contractDigest, ...handoff, ...discipline };
     const manifest = { schemaVersion: SNAPSHOT_SCHEMA, ...core, repositoryDigest: repoKey(root), copyLayout: COPY_LAYOUT,
       createdAt: new Date().toISOString(), snapshotDigest: sha256(canonical(core)) };

package/local-preserved-mutation-protection.mjs

@@ -5,6 +5,7 @@ import { readDisciplineSnapshot } from './local-discipline-snapshot.mjs';
 import { preservedMutationDelegation, preservedMutationFail } from './local-preserved-mutation-wire.mjs';
 import { preservedMutationProtectedFiles } from './local-preserved-mutation-state.mjs';
 import { scopeCandidateImports } from './local-scope-repository.mjs';
+import { scopeContextSnapshotInput } from './scope-context-observation.mjs';
 
 function unknownTarget(path, site) {
   const reason = typeof site?.reason === 'string' && /^[a-z-]+$/.test(site.reason) ? site.reason : 'unknown-import-source';
@@ -23,6 +24,7 @@ async function observe(input, root, expected) {
 }
 export async function capturePreservedMutationProtection(input, root, authority, snapshot) {
   const delegation = preservedMutationDelegation(authority), review = await readDisciplineSnapshot(snapshot);
+  input = (await scopeContextSnapshotInput(input, root, review.scopeContext)).input;
   for (const expected of delegation.targetFiles) {
     const file = snapshot.manifest.files.find(item => item.path === expected.path);
     if (delegation.purpose === 'planned-file-create') {

package/local-scope-files.mjs

@@ -4,6 +4,7 @@ import { canonical, sha256 } from './local-integrity.mjs';
 import { readBudgetedProjectFile } from './local-budget-reads.mjs';
 import { verifiedSfnt } from './local-scope-font.mjs';
 import { verifiedZip } from './local-scope-zip.mjs';
+import { observeScopeAbsence, observeScopeRead, observeScopeTarget } from './local-scope-read-set.mjs';
 
 export function scopeFail(code, message) { throw Object.assign(new Error(message), { code }); }
 export function observedScopeRisk(files) {
@@ -66,6 +67,7 @@ export async function scopeTarget(root, relative, allowMissing = false, allowDep
     current = path.join(current, part);
     let stat;
     try { stat = await fs.lstat(current); } catch (error) {
+      if (error.code === 'ENOENT') observeScopeAbsence(root, relative, () => scopeTarget(root, relative, true, allowDependency));
       if (error.code === 'ENOENT' && allowMissing) return { target: path.join(root, relative), exists: false, stat: null };
       throw error;
     }
@@ -82,7 +84,11 @@ export async function scopeTarget(root, relative, allowMissing = false, allowDep
       }
     }
     if (index < parts.length - 1 && !stat.isDirectory()) await invalidScopeTarget(root, relative, current, 'non-directory-ancestor');
-    if (index === parts.length - 1) return { target: current, exists: true, stat, dependency: followDependency };
+    if (index === parts.length - 1) {
+      const target = { target: current, exists: true, stat, dependency: followDependency };
+      observeScopeTarget(root, relative, target, () => scopeTarget(root, relative, true, allowDependency));
+      return target;
+    }
   }
 }
 // Only speculative, read-only resolver candidates may treat a non-directory ancestor as absent.
@@ -90,6 +96,7 @@ export async function scopeProbeTarget(root, relative, allowDependency = false)
   try { return await scopeTarget(root, relative, true, allowDependency); }
   catch (error) {
     if (error.code !== 'ENTROROVE_FILE_INVALID' || error.reason !== 'non-directory-ancestor') throw error;
+    observeScopeAbsence(root, relative, () => scopeProbeTarget(root, relative, allowDependency));
     return { target: path.join(root, relative), exists: false, stat: null };
   }
 }
@@ -109,7 +116,12 @@ async function safeScopeRead(root, relative, input, allowDependency = true) {
       || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs || latest.ino !== after.ino
       || latest.dev !== after.dev || !dependency && latest.isSymbolicLink() || beforeReal !== afterReal) scopeFail('ENTROROVE_SCOPE_CHANGED', 'scope source changed during inspection');
     await scopeTarget(root, relative, false, dependency);
-    return { content, mode: after.mode & 0o777, sha256: sha256(content), bytes: content.length };
+    const digest = sha256(content);
+    observeScopeRead(root, relative, { sha256: digest, mode: after.mode & 0o777, realPath: afterReal ?? target.target }, async () => {
+      const actual = await safeScopeRead(root, relative, input, allowDependency);
+      return { sha256: actual.sha256, mode: actual.mode, realPath: await fs.realpath(target.target) };
+    });
+    return { content, mode: after.mode & 0o777, sha256: digest, bytes: content.length };
   } finally { await handle.close(); }
 }
 export const scopeRead = (root, relative, input = { repositoryRoot: root }) => safeScopeRead(root, relative, input, true);

package/local-scope-read-set.mjs

@@ -0,0 +1,66 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { createHash } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+const context = new AsyncLocalStorage();
+const MAX_RECORDS = 32_768, MAX_PATH_BYTES = 4_194_304, MAX_DIRECTORY_ENTRIES = 32_768;
+const fail = (code, message) => { throw Object.assign(new Error(message), { code }); };
+const changed = () => fail('ENTROROVE_SCOPE_CHANGED', 'Original scope resolver observations changed before signing');
+const fingerprint = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+function record(root, relative, kind, expected, inspect, directoryEntries = 0) {
+  const state = context.getStore();
+  if (!state || state.sealed) return;
+  if (root !== state.root || typeof relative !== 'string' || typeof inspect !== 'function') {
+    fail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Scope read observations require their original in-process root');
+  }
+  const key = `${kind}:${relative}`, checksum = fingerprint(expected), previous = state.records.get(key);
+  if (previous) { if (previous.checksum !== checksum) changed(); return; }
+  state.pathBytes += Buffer.byteLength(relative);
+  state.directoryEntries += directoryEntries;
+  if (state.records.size >= MAX_RECORDS || state.pathBytes > MAX_PATH_BYTES || state.directoryEntries > MAX_DIRECTORY_ENTRIES) {
+    fail('ENTROROVE_SCOPE_LIMIT', 'Scope resolver observations exceed their bounded in-process read set');
+  }
+  state.records.set(key, { checksum, inspect });
+}
+export function observeScopeAbsence(root, relative, inspect) {
+  record(root, relative, 'absence', false, async () => (await inspect()).exists);
+}
+export function observeScopeRead(root, relative, expected, inspect) {
+  record(root, relative, 'read', expected, inspect);
+}
+export function observeScopeTarget(root, relative, target, inspect) {
+  const kind = value => ({ exists: value.exists, file: value.stat?.isFile() ?? false, directory: value.stat?.isDirectory() ?? false });
+  record(root, relative, 'target', kind(target), async () => kind(await inspect()));
+}
+export function observeScopeDirectory(root, relative, names, inspect) {
+  record(root, relative, 'directory', names, inspect, names.length);
+}
+function sameRoot(before, after) {
+  return after.isDirectory() && !after.isSymbolicLink() && before.dev === after.dev && before.ino === after.ino;
+}
+export async function captureScopeReadSet(root, action) {
+  if (context.getStore() || typeof root !== 'string' || !path.isAbsolute(root) || typeof action !== 'function') {
+    fail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Scope read capture requires one actual independent observation');
+  }
+  const original = await fs.lstat(root);
+  if (!sameRoot(original, original) || await fs.realpath(root) !== root) {
+    fail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Scope read capture requires the original real repository root');
+  }
+  const state = { root, records: new Map(), pathBytes: 0, directoryEntries: 0, sealed: false };
+  let value;
+  try { value = await context.run(state, action); } finally { state.sealed = true; }
+  const verify = () => context.run(undefined, async () => {
+    try {
+      if (!sameRoot(original, await fs.lstat(root)) || await fs.realpath(root) !== root) changed();
+      for (const observation of state.records.values()) {
+        if (fingerprint(await observation.inspect()) !== observation.checksum) changed();
+      }
+      if (!sameRoot(original, await fs.lstat(root)) || await fs.realpath(root) !== root) changed();
+    } catch (error) {
+      if (error.code?.startsWith('ENTROROVE_')) throw error;
+      changed();
+    }
+  });
+  return { value, verify };
+}

package/local-scope-repository.mjs

@@ -17,8 +17,16 @@ import { createScopeImportResolver, unresolvedImportSite } from './local-scope-i
 import { isTypeOnlyReference, isDynamicFunctionReference } from './local-typescript-function-reference.mjs';
 import { createScopeRequireContexts } from './local-scope-create-require.mjs';
 import { resolveCreatedRequire } from './local-scope-require-resolution.mjs';
+import { uniConditionalVariants } from './local-scope-uni-conditional.mjs';
+import { createUniBuildInspection } from './local-scope-uni-build.mjs';
 
 const execute = promisify(execFile);
+const inspectionFreshness = new WeakMap();
+export async function verifyScopeInspectionFreshness(facts) {
+  const verify = facts && typeof facts === 'object' ? inspectionFreshness.get(facts.importGraph) : null;
+  if (!verify) scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Fresh scope verification requires its original in-process graph inspection');
+  await verify();
+}
 async function git(root, args, allowed = [], input = { repositoryRoot: root }) {
   await assertBudgetRunnerAllowed(input);
   const executable = await scopeGitExecutable({ repositoryRoot: root });
@@ -93,6 +101,10 @@ export async function gitFacts(root, files, baselineRef, input = { repositoryRoo
 const scriptKinds = new Map([['.ts', ts.ScriptKind.TS], ['.mts', ts.ScriptKind.TS], ['.cts', ts.ScriptKind.TS],
   ['.tsx', ts.ScriptKind.TSX], ['.js', ts.ScriptKind.JS], ['.mjs', ts.ScriptKind.JS], ['.cjs', ts.ScriptKind.JS], ['.jsx', ts.ScriptKind.JSX]]);
 const dynamicNames = new Set(['eval', 'Function', 'createRequire']);
+function physicalImportSite(site, context) {
+  return { ...site, line: site.line + (context.lineOffset ?? 0),
+    column: site.line === 1 ? Math.max(1, site.column + (context.columnOffset ?? 0) - (context.syntheticPrefix ?? 0)) : site.column };
+}
 function staticString(expression) {
   while (expression && ts.isParenthesizedExpression(expression)) expression = expression.expression;
   if (!expression || (!ts.isStringLiteral(expression) && !ts.isNoSubstitutionTemplateLiteral(expression))) return null;
@@ -108,7 +120,11 @@ function globalObject(expression) {
 function scriptImports(source, filename, context = {}) {
   const parsed = ts.createSourceFile(filename, source, ts.ScriptTarget.Latest, true,
     scriptKinds.get(path.extname(filename).toLowerCase()) ?? ts.ScriptKind.TS);
-  if (parsed.parseDiagnostics.length) scopeFail('ENTROROVE_IMPORT_INVALID', 'source has invalid or unterminated syntax');
+  if (parsed.parseDiagnostics.length) {
+    const diagnostic = parsed.parseDiagnostics[0], location = parsed.getLineAndCharacterOfPosition(diagnostic.start ?? 0);
+    const site = physicalImportSite({ line: location.line + 1, column: location.character + 1 }, context);
+    scopeFail('ENTROROVE_IMPORT_INVALID', `${context.sourceFilename ?? filename}:${site.line}:${site.column}: source syntax diagnostic ${diagnostic.code}`);
+  }
   const found = new Set(), requires = new Map(), unresolvedImports = [], resolve = createScopeImportResolver(parsed); let dynamic = false;
   const contexts = createScopeRequireContexts(parsed, context.repositoryRoot, context.sourceFilename ?? filename);
   const unresolved = (expression, reason, message) => { dynamic = true;
@@ -160,11 +176,14 @@ function scriptImports(source, filename, context = {}) {
   };
   visit(parsed); return { specifiers: [...found].sort(), requires: [...requires.values()], dynamic, unresolvedImports };
 }
-function vueScripts(source, filename) {
+function vueVariantScripts(source, filename, label) {
   const { descriptor, errors } = parseVue(source, { filename, sourceMap: false,
     templateParseOptions: { expressionPlugins: ['typescript'] } });
   vueParseCache.clear();
-  if (errors.length) scopeFail('ENTROROVE_IMPORT_INVALID', 'component has invalid or unterminated syntax');
+  if (errors.length) {
+    const error = errors[0], location = error.loc?.start;
+    scopeFail('ENTROROVE_IMPORT_INVALID', `${filename}:${location?.line ?? 1}:${location?.column ?? 1}: component syntax diagnostic ${error.code ?? 'invalid'} (${label})`);
+  }
   if (descriptor.customBlocks.length || descriptor.template?.lang || descriptor.template?.src) {
     scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'component dependency inspection requires supported inline template syntax');
   }
@@ -174,29 +193,40 @@ function vueScripts(source, filename) {
     if (!['js', 'javascript', 'ts', 'typescript', 'jsx', 'tsx'].includes(language)) scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'component script language is unsupported');
     const extension = { javascript: 'js', typescript: 'ts' }[language] ?? language;
     scripts.push({ source: block.src ? `import ${JSON.stringify(block.src)};` : block.content, filename: `${filename}.${extension}`,
-      lineOffset: block.loc.start.line - 1, vueComponent: true, vueSetup: block === descriptor.scriptSetup });
+      lineOffset: block.loc.start.line - 1, columnOffset: block.loc.start.column - 1, vueComponent: true, vueSetup: block === descriptor.scriptSetup });
   }
   const seen = new WeakSet();
   const walk = node => {
     if (!node || typeof node !== 'object' || seen.has(node)) return;
     seen.add(node);
     if (node.type === 7 && ['on', 'for'].includes(node.name) && node.exp?.content) {
-      scripts.push({ source: node.name === 'for' ? `for (${node.exp.content}) {}` : node.exp.content, filename: `${filename}.ts` });
+      scripts.push({ source: node.name === 'for' ? `for (${node.exp.content}) {}` : node.exp.content, filename: `${filename}.ts`,
+        lineOffset: node.exp.loc.start.line - 1, columnOffset: node.exp.loc.start.column - 1, syntheticPrefix: node.name === 'for' ? 5 : 0 });
       seen.add(node.exp);
     }
-    if (node.type === 4 && !node.isStatic && node.content) scripts.push({ source: `void (${node.content});`, filename: `${filename}.ts` });
+    if (node.type === 4 && !node.isStatic && node.content) scripts.push({ source: `void (${node.content});`, filename: `${filename}.ts`,
+      lineOffset: node.loc.start.line - 1, columnOffset: node.loc.start.column - 1, syntheticPrefix: 6 });
     for (const [key, child] of Object.entries(node)) if (!['loc', 'ast', 'parent', 'codegenNode'].includes(key)) {
       if (Array.isArray(child)) child.forEach(walk); else walk(child);
     }
   };
   walk(descriptor.template?.ast); return scripts;
 }
-function importSpecifiers(content, filename, repositoryRoot) {
+function vueScripts(source, filename, conditional) {
+  const { variants } = conditional ?? uniConditionalVariants(source, filename), scripts = [], inspected = new Set();
+  for (const variant of variants) {
+    if (!variant.source.trim() || inspected.has(variant.source)) continue;
+    inspected.add(variant.source); scripts.push(...vueVariantScripts(variant.source, filename, variant.label));
+  }
+  if (!scripts.length && !variants.some(variant => variant.source.trim())) scopeFail('ENTROROVE_IMPORT_INVALID', `${filename}:1:1: component has no inspectable conditional branch`);
+  return scripts;
+}
+function importSpecifiers(content, filename, repositoryRoot, conditional) {
   try {
-    const source = content.toString('utf8'), parts = path.extname(filename).toLowerCase() === '.vue' ? vueScripts(source, filename) : [{ source, filename }];
+    const source = content.toString('utf8'), parts = path.extname(filename).toLowerCase() === '.vue' ? vueScripts(source, filename, conditional) : [{ source, filename }];
     const specifiers = new Set(), requires = new Map(), unresolvedImports = []; let dynamic = false;
     for (const part of parts) { const parsed = scriptImports(part.source, part.filename, { ...part, repositoryRoot, sourceFilename: filename }); dynamic ||= parsed.dynamic;
-      unresolvedImports.push(...parsed.unresolvedImports.map(site => ({ ...site, line: site.line + (part.lineOffset ?? 0) })));
+      unresolvedImports.push(...parsed.unresolvedImports.map(site => physicalImportSite(site, part)));
       for (const require of parsed.requires) requires.set(`${require.anchor}\0${require.specifier}`, require);
       for (const specifier of parsed.specifiers) specifiers.add(specifier); }
     return { specifiers: [...specifiers].sort(), requires: [...requires.values()], dynamic, unresolvedImports };
@@ -261,6 +291,19 @@ async function configMetadata(root, relative, input) {
   const referenceRoot = outside ? await externalConfigReference(root, relative, resolved) : undefined;
   return { path: relative, sha256: read.sha256, contentBase64: read.content.toString('base64'), realPath, referenceRoot };
 }
+async function conditionalBuildDirectory(root, relative, maximumEntries) {
+  const target = relative === '.' ? root : (await scopeTarget(root, relative, false, dependencyReference(relative))).target;
+  const directory = await fs.opendir(target); const environmentFiles = []; let entries = 0;
+  for await (const entry of directory) {
+    if (++entries > maximumEntries) scopeFail('ENTROROVE_SCOPE_LIMIT', 'Conditional build directory exceeds its bounded entry inspection');
+    if (entry.name === '.env' || entry.name.startsWith('.env.')) environmentFiles.push(entry.name);
+  }
+  return { environmentFiles, entries };
+}
+function conditionalBuildInspection(root, input) {
+  return createUniBuildInspection(relative => configMetadata(root, relative, input),
+    (relative, maximumEntries) => conditionalBuildDirectory(root, relative, maximumEntries));
+}
 async function resolveLocalImport(root, relative, required = true) {
   if (relative.startsWith('../') || relative === '..') scopeFail('ENTROROVE_PATH_UNSAFE', 'local import escapes the repository');
   const replacements = /\.js$/.test(relative) ? [relative.replace(/\.js$/, '.ts'), relative.replace(/\.js$/, '.tsx')] : [];
@@ -280,6 +323,7 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
   const pendingCreates = new Set(originals.filter(file => file.exists === false && input.scopeCreatePaths?.includes(file.path)).map(file => file.path));
   const workspace = await workspaceIndex(root, input);
   const metadata = new Map(workspace.metadata.map(item => [item.path, item]));
+  const inspectBuild = conditionalBuildInspection(root, input);
   while (pending.length) {
     const relative = pending.shift(); if (visited.has(relative)) continue;
     if (visited.size >= 1000) scopeFail('ENTROROVE_SCOPE_LIMIT', 'import graph exceeds the 1000-file inspection bound');
@@ -298,8 +342,10 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
     const configPath = contexts[0]?.configPath;
     const aliases = await scopeTsconfigImports(target => configMetadata(root, target, input), relative, configPath);
     for (const observed of aliases.observations) metadata.set(observed.path, observed);
+    const conditional = /\.vue$/i.test(relative) ? uniConditionalVariants(read.content.toString('utf8'), relative) : undefined;
+    if (conditional?.directives.length) for (const observed of await inspectBuild(relative, configPath)) metadata.set(observed.path, observed);
     const declarations = declarationModules(read.content, relative);
-    const imports = importSpecifiers(read.content, relative, root); dynamic ||= imports.dynamic;
+    const imports = importSpecifiers(read.content, relative, root, conditional); dynamic ||= imports.dynamic;
     unresolvedImports.push(...imports.unresolvedImports.map(site => ({ path: relative, ...site })));
     if (imports.dynamic) dynamicSources.push({ path: relative, sha256: read.sha256 });
     for (const specifier of imports.specifiers.sort()) {
@@ -327,18 +373,27 @@ export async function importGraph(root, originals, input = { repositoryRoot: roo
   }
   const nodes = [...visited.values()].sort((a, b) => a.path.localeCompare(b.path));
   await stableScope(root, nodes, input);
+  await inspectBuild.verify();
   const workspaceMetadata = [...metadata.values()].sort((a, b) => a.path.localeCompare(b.path));
   await stableScope(root, workspaceMetadata, input);
-  return { nodes, edges: edges.sort((a, b) => `${a.from}:${a.specifier}`.localeCompare(`${b.from}:${b.specifier}`)),
+  const graph = { nodes, edges: edges.sort((a, b) => `${a.from}:${a.specifier}`.localeCompare(`${b.from}:${b.specifier}`)),
     dynamic, complete: !dynamic, dynamicSources: dynamicSources.sort((a, b) => a.path.localeCompare(b.path)), workspaceMetadata,
     ...(unresolvedImports.length ? { unresolvedImports } : {}) };
+  const actualFiles = [...nodes, ...workspaceMetadata].map(file => ({ path: file.path, sha256: file.sha256 }));
+  inspectionFreshness.set(graph, async () => { await inspectBuild.verify(); await stableScope(root, actualFiles, input); });
+  return graph;
 }
 export async function scopeCandidateImports(root, file, input = { repositoryRoot: root }) {
-  const parsed = importSpecifiers(Buffer.from(file.content), file.path, root);
   const workspace = await workspaceIndex(root, input);
   const context = (input.importContexts ?? []).filter(item => file.path === item.sourcePrefix || file.path.startsWith(`${item.sourcePrefix}/`))
     .sort((a, b) => b.sourcePrefix.length - a.sourcePrefix.length)[0];
   const aliases = await scopeTsconfigImports(relative => configMetadata(root, relative, input), file.path, context?.configPath);
+  const conditional = /\.vue$/i.test(file.path) ? uniConditionalVariants(file.content, file.path) : undefined;
+  let inspectBuild;
+  if (conditional?.directives.length) {
+    inspectBuild = conditionalBuildInspection(root, input); await inspectBuild(file.path, context?.configPath);
+  }
+  const parsed = importSpecifiers(Buffer.from(file.content), file.path, root, conditional);
   const declarations = declarationModules(Buffer.from(file.content), file.path), edges = [];
   for (const specifier of parsed.specifiers) {
     const target = await resolveImport(root, file.path, specifier, workspace, input, aliases, context?.configPath, declarations);
@@ -349,6 +404,7 @@ export async function scopeCandidateImports(root, file, input = { repositoryRoot
     await stableScope(root, resolved.metadata, input);
     edges.push({ from: file.path, to: resolved.external ? null : resolved.target, external: resolved.external, specifier: request.specifier });
   }
+  await inspectBuild?.verify();
   return { edges: edges.sort((a, b) => `${a.from}:${a.specifier}`.localeCompare(`${b.from}:${b.specifier}`)), dynamic: parsed.dynamic,
     ...(parsed.unresolvedImports.length ? { unresolvedImports: parsed.unresolvedImports.map(site => ({ path: file.path, ...site })) } : {}) };
 }
@@ -364,7 +420,11 @@ export async function collectScopeFacts(root, requested, baselineRef, knownFiles
     const read = await scopeRead(root, relative, input); const boundary = await packageBoundary(root, relative, input);
     files.push({ path: relative, exists: true, sha256: read.sha256, bytes: read.bytes, lines: lineCount(read.content), module: boundary.path });
   }
-  const graph = await importGraph(root, files, input); const observedGit = await observeGitFacts(root, files, baselineRef, input); const history = observedGit.facts;
+  const graph = await importGraph(root, files, input);
+  await contextEvidence(root, graph, input);
+  const verifyGraph = inspectionFreshness.get(graph), observedMetadata = graph.workspaceMetadata.map(file => ({ path: file.path, sha256: file.sha256 }));
+  inspectionFreshness.set(graph, async () => { await verifyGraph(); await stableScope(root, observedMetadata, input); });
+  const observedGit = await observeGitFacts(root, files, baselineRef, input); const history = observedGit.facts;
   const modules = [...new Map(graph.nodes.map(node => [node.boundary.path, node.boundary])).values()].sort((a, b) => a.path.localeCompare(b.path));
   await stableScope(root, files, input);
   await stableScope(root, modules.filter(module => module.manifestPath).map(module => ({ path: module.manifestPath, sha256: module.manifestDigest })), input);
@@ -377,3 +437,27 @@ export async function collectScopeFacts(root, requested, baselineRef, knownFiles
     crossModule: modules.length > 1, risk: observedScopeRisk(files), importGraph: graph, git: history,
     estimatedChangedLines };
 }
+async function contextEvidence(root, graph, input) {
+  if (input.contextEvidence === undefined) return;
+  if (!/^[a-f0-9]{64}$/.test(input.contextRevisionDigest ?? '') || !Array.isArray(input.contextEvidence)
+    || input.contextEvidence.length > 200 || new Set(input.contextEvidence.map(file => file?.path)).size !== input.contextEvidence.length) {
+    scopeFail('ENTROROVE_SCOPE_CONTEXT_BINDING', 'Context evidence requires its bounded unique actual file hashes and revision');
+  }
+  const metadata = new Map(graph.workspaceMetadata.map(file => [file.path, file])); let bytes = 0;
+  for (const file of input.contextEvidence) {
+    if (!file || Object.keys(file).sort().join(',') !== 'path,sha256' || !/^[a-f0-9]{64}$/.test(file.sha256 ?? '')) {
+      scopeFail('ENTROROVE_SCOPE_CONTEXT_BINDING', 'Context evidence requires exact path and hash fields');
+    }
+    const target = await scopeTarget(root, file.path);
+    if (!target.stat.isFile() || target.stat.size > 1_048_576 || (bytes += target.stat.size) > 8_388_608) {
+      scopeFail('ENTROROVE_SCOPE_LIMIT', 'Context evidence exceeds its bounded actual file inspection');
+    }
+    const read = await scopeRead(root, file.path, input);
+    if (read.sha256 !== file.sha256 || metadata.has(file.path) && metadata.get(file.path).sha256 !== read.sha256) {
+      scopeFail('ENTROROVE_SCOPE_CHANGED', 'Actual context build evidence changed since its exact review');
+    }
+    if (!metadata.has(file.path)) metadata.set(file.path, { path: file.path, sha256: read.sha256 });
+  }
+  graph.workspaceMetadata = [...metadata.values()].sort((left, right) => left.path.localeCompare(right.path));
+  await stableScope(root, graph.workspaceMetadata, input);
+}

package/local-scope-signature.mjs

@@ -2,9 +2,11 @@ import { createPrivateKey, createPublicKey, randomUUID, sign } from 'node:crypto
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 import { canonical, sha256 } from './local-integrity.mjs';
-import { scopeFail, scopeRead, scopeControlRead, scopeRoot } from './local-scope-files.mjs';
-import { collectScopeFacts } from './local-scope-repository.mjs';
+import { scopeFail, scopeRead, scopeControlRead, scopeRoot, stableScope } from './local-scope-files.mjs';
+import { collectScopeFacts, verifyScopeInspectionFreshness } from './local-scope-repository.mjs';
 import { readScopeSnapshot, verifyFreshScopeSnapshot } from './local-scope-snapshot.mjs';
+import { scopeGitMetadata } from './local-scope-git-reads.mjs';
+import { captureScopeReadSet } from './local-scope-read-set.mjs';
 import { resolveScopePaths } from './local-scope-context.mjs';
 import { rejectScopePrivileges, verifiedScopeCandidate } from './local-scope-candidate.mjs';
 
@@ -33,15 +35,45 @@ function binding(input, result) {
   for (const field of ['taskDigest', 'chainDigest']) if (!digest.test(String(input[field] ?? ''))) scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'scope signature requires original task and chain digests');
   if (!digest.test(String(result.snapshotDigest ?? ''))) scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'scope signature requires a verified preserved snapshot digest');
 }
-export async function attestScopeFacts(input, result, { maximumExpiresAt } = {}) {
+async function signingChallenge(input, beforeSign, maximumExpiresAt) {
+  if (beforeSign === undefined) return { input, maximumExpiresAt };
+  if (typeof beforeSign !== 'function' || !input.contextRevisionDigest || Object.hasOwn(input, 'handoffCandidate')) {
+    scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Challenge renewal is restricted to an original context observation');
+  }
+  const fresh = await beforeSign();
+  if (!fresh || Object.keys(fresh).sort().join(',') !== 'challenge,maximumExpiresAt'
+    || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/.test(fresh.challenge ?? '')
+    || !Number.isSafeInteger(fresh.maximumExpiresAt) || fresh.maximumExpiresAt <= Date.now()) {
+    scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Actual scope signature requires a current exact challenge bound');
+  }
+  return { input: { ...input, challenge: fresh.challenge }, maximumExpiresAt: fresh.maximumExpiresAt };
+}
+async function verifySigningFreshness(input, root, actual) {
+  await verifyScopeInspectionFreshness(actual);
+  await verifyFreshScopeSnapshot(input, root, actual);
+  await stableScope(root, actual.importGraph.nodes, input);
+  await stableScope(root, actual.importGraph.workspaceMetadata, input);
+  await stableScope(root, actual.modules.filter(module => module.manifestPath)
+    .map(module => ({ path: module.manifestPath, sha256: module.manifestDigest })), input);
+  if (actual.git.available && (await scopeGitMetadata(root, ['rev-parse', '--verify', 'HEAD'], input, [128]))?.trim() !== actual.git.head) {
+    scopeFail('ENTROROVE_SCOPE_CHANGED', 'Git HEAD changed before the original context signature');
+  }
+}
+export async function attestScopeFacts(input, result, { maximumExpiresAt, beforeSign } = {}) {
   if (maximumExpiresAt !== undefined && (!Number.isSafeInteger(maximumExpiresAt) || maximumExpiresAt < 1)) {
     scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'scope signature deadline must be a finite exact bound');
   }
   rejectScopePrivileges(input);
+  if (Object.hasOwn(input, 'contextRevisionDigest') && (!/^[a-f0-9]{64}$/.test(input.contextRevisionDigest ?? '')
+    || !Array.isArray(input.importContexts))) scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Context proof requires its exact contexts and revision digest together');
   if (input.signerConfigPath === undefined || input.signerConfigPath === null) return result;
   binding(input, result);
+  const inspectedInput = canonical(input);
   const root = await scopeRoot(input.repositoryRoot); const snapshot = await readScopeSnapshot(input, root);
-  const actual = await collectScopeFacts(root, await resolveScopePaths(input, root), input.baselineRef, snapshot.known, input);
+  const paths = await resolveScopePaths(input, root);
+  const inspect = () => collectScopeFacts(root, paths, input.baselineRef, snapshot.known, input);
+  const inspection = beforeSign ? await captureScopeReadSet(root, inspect) : { value: await inspect() };
+  const actual = inspection.value;
   actual.snapshotEvidence = await verifyFreshScopeSnapshot(input, root, actual);
   const candidate = await verifiedScopeCandidate(input, root, actual.snapshotEvidence.manifest);
   if (root !== result.repositoryRoot || canonical(actual) !== canonical(result.facts)
@@ -60,15 +92,29 @@ export async function attestScopeFacts(input, result, { maximumExpiresAt } = {})
     if (error.code === 'ENTROROVE_SCOPE_SIGNER_INVALID') throw error;
     scopeFail('ENTROROVE_SCOPE_SIGNER_INVALID', 'scope signer configuration or signing key could not be read');
   }
+  // The independent S scan is complete before requesting its short-lived signing challenge.
+  // The internal callback can change only the nonce and deadline, never observed facts or identity.
+  const originalInput = input;
+  ({ input, maximumExpiresAt } = await signingChallenge(input, beforeSign, maximumExpiresAt));
+  if (canonical(originalInput) !== inspectedInput || root !== result.repositoryRoot
+    || canonical(actual) !== canonical(result.facts) || actual.snapshotEvidence.snapshotDigest !== result.snapshotDigest) {
+    scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'scope signing preparation changed during challenge renewal');
+  }
+  if (beforeSign) { await inspection.verify(); await verifySigningFreshness(input, root, actual); }
+  if (canonical(originalInput) !== inspectedInput || root !== result.repositoryRoot
+    || canonical(actual) !== canonical(result.facts) || actual.snapshotEvidence.snapshotDigest !== result.snapshotDigest) {
+    scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'scope signing preparation changed before its actual signature');
+  }
   const now = Date.now();
   const expiresAt = Math.min(now + config.receiptTtlMs, candidate ? Date.parse(candidate.expiresAt) : Infinity,
     maximumExpiresAt ?? Infinity);
   if (expiresAt <= now) scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'candidate challenge expired before its actual scope signature');
   const core = { schemaVersion: 'entrorove.scope-facts/1.0', flowId: input.flowId, stepId: input.stepId,
     taskDigest: input.taskDigest, ownerId: input.ownerId, chainDigest: input.chainDigest, repositoryId: input.repositoryId,
-    facts: result.facts, snapshotDigest: result.snapshotDigest, challenge: input.challenge,
+    facts: actual, snapshotDigest: actual.snapshotEvidence.snapshotDigest, challenge: input.challenge,
     issuedAt: new Date(now).toISOString(), expiresAt: new Date(expiresAt).toISOString(),
-    nonce: randomUUID(), keyId: config.keyId };
+    nonce: randomUUID(), keyId: config.keyId,
+    ...(input.contextRevisionDigest === undefined ? {} : { importContexts: input.importContexts, contextRevisionDigest: input.contextRevisionDigest }) };
   const signature = sign(null, Buffer.from(canonical(core)), privateKey).toString('base64url');
   return { ...result, attestation: { ...core, signature }, trusted: false, status: 'reported' };
 }