@entrorove/skill 0.1.69 → 0.1.71

package/local-scope-build-data.mjs

@@ -0,0 +1,73 @@
+import path from 'node:path';
+import ts from 'typescript';
+import { protectedBuildRelativePath } from './local-scope-build-read.mjs';
+import { uniConditionalError } from './local-scope-uni-expressions.mjs';
+
+export const buildConfigurationNames = ['vite.config.js', 'vite.config.mjs', 'vite.config.cjs', 'vite.config.ts',
+  'vite.config.mts', 'vite.config.cts', 'vue.config.js', 'vue.config.cjs', 'webpack.config.js', 'webpack.config.cjs',
+  'webpack.config.mjs', 'webpack.config.ts', 'rollup.config.js', 'rollup.config.mjs', 'rollup.config.ts',
+  'babel.config.js', 'babel.config.cjs', 'babel.config.json', '.babelrc', '.babelrc.json', '.babelrc.js',
+  'next.config.js', 'next.config.mjs', 'next.config.ts', 'nuxt.config.js', 'nuxt.config.ts', 'svelte.config.js'];
+export function buildDataPath(base, value) {
+  if (typeof value !== 'string' || value.includes('\\') || value.includes('\0') || path.posix.isAbsolute(value)) {
+    throw Object.assign(new Error('Build data references require literal repository-relative paths'), { code: 'ENTROROVE_PATH_UNSAFE' });
+  }
+  const relative = path.posix.normalize(path.posix.join(base, value)).replace(/\/$/, '');
+  if (relative === '..' || relative.startsWith('../')) throw Object.assign(new Error('Build data references cannot escape the original repository'), { code: 'ENTROROVE_PATH_UNSAFE' });
+  if (protectedBuildRelativePath(relative)) throw uniConditionalError(relative, 0, 'Build data cannot read environment or private control values');
+  return relative;
+}
+export function buildScriptReferences(manifest, filename = 'package.json') {
+  const references = new Set(); let opaque = false;
+  for (const [name, command] of Object.entries(manifest.scripts ?? {})) {
+    if (typeof command !== 'string') throw uniConditionalError(filename, 0, 'Build package scripts require string commands');
+    const relevant = /^(?:dev|build)(?::|$)/.test(name) || /(?:^|\s)(?:--(?:experimental-loader|loader|require|import)(?:=|\s)|-r\s)/.test(command);
+    if (!relevant) continue;
+    opaque = true;
+    // Literal references are data only, with no shell, cwd or execution claim.
+    if (/[$`\n\r|<>;]/.test(command) || /(?:^|&&)\s*cd\s/.test(command)) continue;
+    for (const segment of command.split('&&')) {
+      const words = segment.match(/"[^"]*"|'[^']*'|[^\s]+/g)?.map(word => /^['"]/.test(word) ? word.slice(1, -1) : word) ?? [];
+      let cursor = words[0] === 'cross-env' ? 1 : 0;
+      while (/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[cursor] ?? '')) cursor++;
+      if (words[cursor] === 'node' && words[cursor + 1] && !words[cursor + 1].startsWith('-')) references.add(words[cursor + 1]);
+      for (let index = cursor + 1; index < words.length; index++) {
+        if (['--config', '-c', '--experimental-loader', '--loader', '--require', '--import', '-r'].includes(words[index]) && words[index + 1]) references.add(words[++index]);
+        else if (/^--(?:config|experimental-loader|loader|require|import)=/.test(words[index])) references.add(words[index].slice(words[index].indexOf('=') + 1));
+      }
+    }
+  }
+  return { opaque, references: [...references].sort() };
+}
+export function buildModuleData(source, filename) {
+  let ast;
+  try { ast = ts.createSourceFile(filename, source, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS); }
+  catch (error) { if (!(error instanceof RangeError)) throw error; throw Object.assign(uniConditionalError(filename, 0, 'Build data syntax exceeds its parser bound'), { code: 'ENTROROVE_SCOPE_LIMIT' }); }
+  const references = new Set(); let nodes = 0;
+  const inspect = node => {
+    if (++nodes > 8192) throw Object.assign(uniConditionalError(filename, 0, 'Build data syntax exceeds its 8192-node bound'), { code: 'ENTROROVE_SCOPE_LIMIT' });
+    if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier && ts.isStringLiteralLike(node.moduleSpecifier)) references.add(node.moduleSpecifier.text);
+    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && node.expression.text === 'require'
+      && node.arguments.length === 1 && ts.isStringLiteralLike(node.arguments[0])) references.add(node.arguments[0].text);
+    if (ts.isPropertyAssignment(node) && !ts.isComputedPropertyName(node.name) && ['loader', 'use'].includes(node.name.text)
+      && ts.isStringLiteralLike(node.initializer)) references.add(node.initializer.text);
+    // Function bodies remain opaque build code. Inspect module-level literal
+    // declarations without simulating callbacks or proving a runtime closure.
+    if (ts.isFunctionLike(node)) return;
+    ts.forEachChild(node, inspect);
+  };
+  inspect(ast);
+  const literalRoots = [];
+  for (const statement of ast.statements) {
+    let expression = ts.isExportAssignment(statement) ? statement.expression : ts.isExpressionStatement(statement)
+      && ts.isBinaryExpression(statement.expression) && statement.expression.left.getText(ast) === 'module.exports'
+      && statement.expression.operatorToken.kind === ts.SyntaxKind.EqualsToken ? statement.expression.right : undefined;
+    while (expression && (ts.isParenthesizedExpression(expression) || ts.isAsExpression(expression) || ts.isSatisfiesExpression(expression))) expression = expression.expression;
+    if (!expression || !ts.isObjectLiteralExpression(expression)) continue;
+    const literal = Object.create(null);
+    for (const property of expression.properties) if (ts.isPropertyAssignment(property) && !ts.isComputedPropertyName(property.name)
+      && ['root', 'envDir', 'context'].includes(property.name.text) && ts.isStringLiteralLike(property.initializer)) literal[property.name.text] = property.initializer.text;
+    literalRoots.push(literal);
+  }
+  return { references: [...references].filter(value => value.startsWith('.')).sort(), literalRoots };
+}

package/local-scope-build-facts.mjs

@@ -0,0 +1,33 @@
+import { packageBoundary, scopeFail, scopePath, scopeBuildSourceRead } from './local-scope-files.mjs';
+
+// Opaque build programs are readonly origins. They never replace source identities
+// or establish a complete compiled graph, and are never executed by inspection.
+export async function observeBuildFacts(root, proof, input, graph) {
+  if (!proof || !Array.isArray(proof.observations) || !Array.isArray(proof.unresolvedBuildSources)) {
+    scopeFail('ENTROROVE_IMPORT_INVALID', 'Build inspection requires explicit observed files and uncertainty origins');
+  }
+  for (const file of proof.observations) {
+    scopePath(file.path);
+    if (!/^[a-f0-9]{64}$/.test(file.sha256 ?? '')) scopeFail('ENTROROVE_IMPORT_INVALID', 'Build observation has no actual file hash');
+    const previous = graph.metadata.get(file.path);
+    if (previous && previous.sha256 !== file.sha256) scopeFail('ENTROROVE_SCOPE_CHANGED', 'Build metadata changed during source inspection');
+    graph.metadata.set(file.path, { path: file.path, sha256: file.sha256 });
+  }
+  for (const origin of proof.unresolvedBuildSources) {
+    const file = graph.metadata.get(origin.path);
+    if (!file || file.sha256 !== origin.sha256 || typeof origin.reason !== 'string' || !/^[a-z][a-z-]{0,95}$/.test(origin.reason)) {
+      scopeFail('ENTROROVE_IMPORT_INVALID', 'Opaque build origin must match an actual readonly file observation');
+    }
+    if (!graph.visited.has(file.path)) {
+      if (graph.visited.size >= 1000) scopeFail('ENTROROVE_SCOPE_LIMIT', 'import graph exceeds the 1000-file inspection bound');
+      const boundary = await packageBoundary(root, file.path, input, scopeBuildSourceRead);
+      graph.visited.set(file.path, { ...file, module: boundary.path, boundary });
+    }
+    if (graph.visited.get(file.path).sha256 !== file.sha256) scopeFail('ENTROROVE_SCOPE_CHANGED', 'Opaque build origin differs from its actual source node');
+    if (graph.dynamicSources.some(item => item.path === file.path)) continue;
+    graph.dynamicSources.push(file);
+    graph.unresolvedImports.push({ path: file.path, line: 1, column: 1, reason: origin.reason,
+      message: 'Build behavior remains unproven; this origin is read-only and source projection grants no compiled dependency guarantee' });
+  }
+  return proof.unresolvedBuildSources.length > 0;
+}

package/local-scope-build-io.mjs

@@ -0,0 +1,57 @@
+import { promises as fs } from 'node:fs';
+import { scopeFail, scopeProbeTarget, scopeTarget } from './local-scope-files.mjs';
+import { isProtectedBuildPath, protectedBuildRelativePath as protectedPath } from './local-scope-build-read.mjs';
+
+const dependency = relative => relative.split('/').includes('node_modules');
+
+// Inspect names and physical destinations before a build helper can read bytes.
+// A dependency symlink is never permission to read an environment/control file.
+export function createScopeBuildIO(root, readMetadata, hashMetadata) {
+  const protectedDestination = actual => isProtectedBuildPath(root, actual);
+  const probe = async relative => {
+    if (relative === '.') return { exists: true, file: false, directory: true };
+    const target = await scopeProbeTarget(root, relative, dependency(relative));
+    return { exists: target.exists, file: Boolean(target.stat?.isFile()), directory: Boolean(target.stat?.isDirectory()) };
+  };
+  const readTarget = async (relative, operation) => {
+    if (protectedPath(relative)) scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'Build inspection cannot read environment or control files');
+    const target = await scopeProbeTarget(root, relative, dependency(relative));
+    if (target.exists && protectedDestination(await fs.realpath(target.target))) {
+      scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'Build dependency resolves to an environment or control file; values were not read');
+    }
+    return operation(relative);
+  };
+  const read = relative => readTarget(relative, readMetadata);
+  const inspectDirectory = async (relative, maximumEntries) => {
+    if (protectedPath(relative)) scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'Build inspection cannot enter a private control directory');
+    const target = relative === '.' ? root : (await scopeTarget(root, relative)).target;
+    const before = await fs.lstat(target), realPath = await fs.realpath(target);
+    if (!before.isDirectory() || before.isSymbolicLink() || protectedDestination(realPath)) {
+      scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'Build directory must be a real non-private directory');
+    }
+    const identity = { dev: before.dev, ino: before.ino, mode: before.mode & 0o777, realPath };
+    const verify = async () => {
+      const current = await fs.lstat(target), actual = await fs.realpath(target);
+      if (!current.isDirectory() || current.isSymbolicLink() || current.dev !== identity.dev || current.ino !== identity.ino
+        || (current.mode & 0o777) !== identity.mode || actual !== realPath || protectedDestination(actual)) {
+        scopeFail('ENTROROVE_SCOPE_CHANGED', 'Build directory identity changed during name observation');
+      }
+    };
+    await verify();
+    const directory = await fs.opendir(target), environmentFiles = [], children = []; let entries = 0;
+    let iterating = false;
+    try {
+      await verify(); iterating = true;
+      for await (const entry of directory) {
+        if (++entries > maximumEntries) scopeFail('ENTROROVE_SCOPE_LIMIT', 'Conditional build directory exceeds its bounded entry inspection');
+        if (entry.name === '.env' || entry.name.startsWith('.env.')) environmentFiles.push(entry.name);
+        children.push({ name: entry.name, kind: entry.isSymbolicLink() ? 'symlink' : entry.isDirectory() ? 'directory'
+          : entry.isFile() ? 'file' : 'unsupported' });
+      }
+    } finally { if (!iterating) await directory.close(); }
+    await verify();
+    children.sort((left, right) => left.name.localeCompare(right.name));
+    return { environmentFiles: environmentFiles.sort(), entries, children, identity };
+  };
+  return { read, probe, inspectDirectory, ...(hashMetadata ? { hashMetadata: relative => readTarget(relative, hashMetadata) } : {}) };
+}

package/local-scope-build-read.mjs

@@ -0,0 +1,22 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+export const protectedBuildRelativePath = value => value.split(/[\\/]/).some(part => part === '.env' || part.startsWith('.env.')
+  || ['.git', '.entrorove', '.aimlock', '.archguard', '.ssh', '.aws', '.gnupg', '.kube', '.azure',
+    '.codex', '.claude', '.agents', '.npmrc', '.netrc', '.pypirc', '.gitconfig', 'id_rsa', 'id_ed25519'].includes(part)
+  || /\.(?:pem|key)$/i.test(part));
+export function isProtectedBuildPath(root, actual) {
+  const relative = path.relative(root, actual);
+  return protectedBuildRelativePath(relative === '..' || relative.startsWith(`..${path.sep}`) ? actual : relative);
+}
+export async function assertBuildReadTarget(root, relative, target, descriptor) {
+  if (protectedBuildRelativePath(relative) || isProtectedBuildPath(root, target)) {
+    throw Object.assign(new Error('Build dependency resolves to an environment or control file; values were not read'),
+      { code: 'ENTROROVE_IMPORT_UNSUPPORTED' });
+  }
+  const actual = await fs.stat(target);
+  if (!actual.isFile() || actual.dev !== descriptor.dev || actual.ino !== descriptor.ino) {
+    throw Object.assign(new Error('Build dependency destination changed before reading any source bytes'),
+      { code: 'ENTROROVE_SCOPE_CHANGED' });
+  }
+}

package/local-scope-build-readset.mjs

@@ -0,0 +1,49 @@
+import { uniConditionalError } from './local-scope-uni-expressions.mjs';
+import { buildDataPath } from './local-scope-build-data.mjs';
+import { sha256 } from './local-integrity.mjs';
+
+const absent = error => ['ENOENT', 'ENOTDIR'].includes(error.code);
+const changed = path => Object.assign(uniConditionalError(path, 0, 'Build data or candidate absence changed during inspection'), { code: 'ENTROROVE_SCOPE_CHANGED' });
+const shape = value => value ? { entries: value.entries, environmentFiles: [...value.environmentFiles].sort(),
+  ...(value.identity ? { identity: { ...value.identity } } : {}),
+  ...(value.children ? { children: value.children.map(({ name, kind }) => ({ name, kind })).sort((a, b) => a.name.localeCompare(b.name)) } : {}) } : null;
+export function createBuildDataReadset(read, inspectDirectory) {
+  const files = new Map(), directories = new Map(); let bytes = 0, entries = 0;
+  const observe = async relative => {
+    buildDataPath('.', relative); if (files.has(relative)) return files.get(relative);
+    if (files.size >= 2048) throw uniConditionalError(relative, 0, 'Build data exceeds its 2048-path inspection bound');
+    let item; try { item = await read(relative); } catch (error) { if (!absent(error)) throw error; }
+    if (item) {
+      const content = Buffer.from(item.contentBase64, 'base64'), size = content.length;
+      if (size > 1_048_576 || bytes + size > 8_388_608) throw Object.assign(uniConditionalError(relative, 0, 'Build data exceeds its 1-MiB/file or 8-MiB bound'), { code: 'ENTROROVE_SCOPE_LIMIT' });
+      if (item.path !== relative || !/^[a-f0-9]{64}$/.test(item.sha256) || item.sha256 !== sha256(content)) throw uniConditionalError(relative, 0, 'Build data observation has no actual path and hash');
+      bytes += size;
+    }
+    files.set(relative, item ?? null); return item ?? null;
+  };
+  const directory = async relative => {
+    if (relative !== '.') buildDataPath('.', relative);
+    if (directories.has(relative)) return directories.get(relative);
+    if (directories.size >= 128 || typeof inspectDirectory !== 'function') throw uniConditionalError(relative, 0, 'Build directory absence requires bounded actual inspection');
+    let value; try { value = await inspectDirectory(relative, Math.min(8192, 32768 - entries)); } catch (error) { if (!absent(error)) throw error; }
+    if (value) {
+      if (!Number.isInteger(value.entries) || value.entries < 0 || !Array.isArray(value.environmentFiles)
+        || value.entries > 8192 || entries + value.entries > 32768) throw Object.assign(uniConditionalError(relative, 0, 'Build directory exceeds its bounded name inspection'), { code: 'ENTROROVE_SCOPE_LIMIT' });
+      entries += value.entries;
+    }
+    const result = shape(value); directories.set(relative, result); return result;
+  };
+  const verify = async () => {
+    for (const [relative, expected] of files) {
+      let actual; try { actual = await read(relative); } catch (error) { if (!absent(error)) throw error; }
+      if ((actual?.sha256 ?? null) !== (expected?.sha256 ?? null) || actual?.realPath !== expected?.realPath
+        || actual?.mode !== expected?.mode || JSON.stringify(actual?.referenceRoot) !== JSON.stringify(expected?.referenceRoot)) throw changed(relative);
+    }
+    let checked = 0;
+    for (const [relative, expected] of directories) {
+      let actual; try { actual = await inspectDirectory(relative, Math.min(8192, 32768 - checked)); } catch (error) { if (!absent(error)) throw error; }
+      checked += actual?.entries ?? 0; if (JSON.stringify(shape(actual)) !== JSON.stringify(expected)) throw changed(relative);
+    }
+  };
+  return { observe, directory, verify, get observations() { return [...files.values()].filter(Boolean).map(({ path, sha256 }) => ({ path, sha256 })).sort((a, b) => a.path.localeCompare(b.path)); } };
+}

package/local-scope-files.mjs

@@ -4,6 +4,8 @@ import { canonical, sha256 } from './local-integrity.mjs';
 import { readBudgetedProjectFile } from './local-budget-reads.mjs';
 import { verifiedSfnt } from './local-scope-font.mjs';
 import { verifiedZip } from './local-scope-zip.mjs';
+import { observeScopeAbsence, observeScopeRead, observeScopeTarget } from './local-scope-read-set.mjs';
+import { assertBuildReadTarget, protectedBuildRelativePath } from './local-scope-build-read.mjs';
 
 export function scopeFail(code, message) { throw Object.assign(new Error(message), { code }); }
 export function observedScopeRisk(files) {
@@ -66,6 +68,7 @@ export async function scopeTarget(root, relative, allowMissing = false, allowDep
     current = path.join(current, part);
     let stat;
     try { stat = await fs.lstat(current); } catch (error) {
+      if (error.code === 'ENOENT') observeScopeAbsence(root, relative, () => scopeTarget(root, relative, true, allowDependency));
       if (error.code === 'ENOENT' && allowMissing) return { target: path.join(root, relative), exists: false, stat: null };
       throw error;
     }
@@ -82,7 +85,11 @@ export async function scopeTarget(root, relative, allowMissing = false, allowDep
       }
     }
     if (index < parts.length - 1 && !stat.isDirectory()) await invalidScopeTarget(root, relative, current, 'non-directory-ancestor');
-    if (index === parts.length - 1) return { target: current, exists: true, stat, dependency: followDependency };
+    if (index === parts.length - 1) {
+      const target = { target: current, exists: true, stat, dependency: followDependency };
+      observeScopeTarget(root, relative, target, () => scopeTarget(root, relative, true, allowDependency));
+      return target;
+    }
   }
 }
 // Only speculative, read-only resolver candidates may treat a non-directory ancestor as absent.
@@ -90,10 +97,11 @@ export async function scopeProbeTarget(root, relative, allowDependency = false)
   try { return await scopeTarget(root, relative, true, allowDependency); }
   catch (error) {
     if (error.code !== 'ENTROROVE_FILE_INVALID' || error.reason !== 'non-directory-ancestor') throw error;
+    observeScopeAbsence(root, relative, () => scopeProbeTarget(root, relative, allowDependency));
     return { target: path.join(root, relative), exists: false, stat: null };
   }
 }
-async function safeScopeRead(root, relative, input, allowDependency = true) {
+async function safeScopeRead(root, relative, input, allowDependency = true, verifyReadTarget) {
   const dependency = allowDependency && dependencyReference(relative), target = await scopeTarget(root, relative, false, dependency);
   if (!target.stat.isFile()) await invalidScopeTarget(root, relative, target.target, 'not-regular-file');
   if (target.stat.size > 16_777_216) scopeFail('ENTROROVE_SCOPE_LIMIT', 'scope source exceeds the 16 MiB inspection bound');
@@ -101,7 +109,15 @@ async function safeScopeRead(root, relative, input, allowDependency = true) {
   try {
     const before = await handle.stat();
     const beforeReal = dependency ? await fs.realpath(target.target) : null;
-    const content = input ? await readBudgetedProjectFile(input, target.target, { sourcePath: relative }) : await handle.readFile();
+    if (verifyReadTarget) {
+      if (before.ino !== target.stat.ino || before.dev !== target.stat.dev) scopeFail('ENTROROVE_SCOPE_CHANGED', 'Build source changed before its descriptor was opened');
+      await verifyReadTarget({ target: beforeReal ?? target.target, descriptor: before });
+    }
+    const boundedVerify = verifyReadTarget ? async actual => {
+      if (actual.descriptor.ino !== before.ino || actual.descriptor.dev !== before.dev) scopeFail('ENTROROVE_SCOPE_CHANGED', 'Build source changed before its accounted descriptor was opened');
+      await verifyReadTarget(actual);
+    } : undefined;
+    const content = input ? await readBudgetedProjectFile(input, target.target, { sourcePath: relative, verifyReadTarget: boundedVerify }) : await handle.readFile();
     const after = await handle.stat();
     const latest = dependency ? await fs.stat(target.target) : await fs.lstat(target.target);
     const afterReal = dependency ? await fs.realpath(target.target) : null;
@@ -109,10 +125,19 @@ async function safeScopeRead(root, relative, input, allowDependency = true) {
       || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs || latest.ino !== after.ino
       || latest.dev !== after.dev || !dependency && latest.isSymbolicLink() || beforeReal !== afterReal) scopeFail('ENTROROVE_SCOPE_CHANGED', 'scope source changed during inspection');
     await scopeTarget(root, relative, false, dependency);
-    return { content, mode: after.mode & 0o777, sha256: sha256(content), bytes: content.length };
+    const digest = sha256(content);
+    observeScopeRead(root, relative, { sha256: digest, mode: after.mode & 0o777, realPath: afterReal ?? target.target }, async () => {
+      const actual = await safeScopeRead(root, relative, input, allowDependency, verifyReadTarget);
+      return { sha256: actual.sha256, mode: actual.mode, realPath: await fs.realpath(target.target) };
+    });
+    return { content, mode: after.mode & 0o777, sha256: digest, bytes: content.length };
   } finally { await handle.close(); }
 }
 export const scopeRead = (root, relative, input = { repositoryRoot: root }) => safeScopeRead(root, relative, input, true);
+export function scopeBuildSourceRead(root, relative, input = { repositoryRoot: root }) {
+  if (protectedBuildRelativePath(relative)) scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'Build inspection cannot read environment or credential values');
+  return safeScopeRead(root, relative, input, true, ({ target, descriptor }) => assertBuildReadTarget(root, relative, target, descriptor));
+}
 // Internal control roles only: signed manifest metadata and already validated private signer files.
 export const scopeControlRead = (root, relative) => safeScopeRead(root, relative, null, false);
 const excluded = new Set(['.git', 'node_modules', '.entrorove', '.aimlock', '.archguard']);
@@ -140,12 +165,12 @@ export function lineCount(content) {
   if (!content.length || verifiedSfnt(content) || verifiedZip(content)) return 0;
   return content.toString('utf8').split(/\r\n|\n|\r/).length - (/[\r\n]$/.test(content.toString('utf8')) ? 1 : 0);
 }
-export async function packageBoundary(root, relative, input = { repositoryRoot: root }) {
+export async function packageBoundary(root, relative, input = { repositoryRoot: root }, readSource = scopeRead) {
   let directory = path.posix.dirname(relative);
   while (true) {
     const manifestPath = directory === '.' ? 'package.json' : `${directory}/package.json`;
     try {
-      const read = await scopeRead(root, manifestPath, input); let manifest;
+      const read = await readSource(root, manifestPath, input); let manifest;
       try { manifest = JSON.parse(read.content.toString('utf8')); } catch { scopeFail('ENTROROVE_PACKAGE_INVALID', 'package manifest is not valid JSON'); }
       return { path: directory, manifestPath, manifestDigest: read.sha256, name: typeof manifest.name === 'string' ? manifest.name : null };
     } catch (error) { if (error.code !== 'ENOENT') throw error; }
@@ -154,11 +179,11 @@ export async function packageBoundary(root, relative, input = { repositoryRoot:
   }
   return { path: relative.includes('/') ? relative.split('/')[0] : '.', manifestPath: null, manifestDigest: null, name: null };
 }
-export async function stableScope(root, files, input = { repositoryRoot: root }) {
+export async function stableScope(root, files, input = { repositoryRoot: root }, readSource = scopeRead) {
   for (const file of files) {
     if (file.exists === false) {
       if ((await scopeTarget(root, file.path, true)).exists) scopeFail('ENTROROVE_SCOPE_CHANGED', 'a deleted target reappeared during inspection');
-    } else if ((await scopeRead(root, file.path, input)).sha256 !== file.sha256) scopeFail('ENTROROVE_SCOPE_CHANGED', 'scope files changed before the observation completed');
+    } else if ((await readSource(root, file.path, input)).sha256 !== file.sha256) scopeFail('ENTROROVE_SCOPE_CHANGED', 'scope files changed before the observation completed');
   }
 }
 export const scopeDigest = value => sha256(canonical(value));

package/local-scope-read-set.mjs

@@ -0,0 +1,66 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { createHash } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+const context = new AsyncLocalStorage();
+const MAX_RECORDS = 32_768, MAX_PATH_BYTES = 4_194_304, MAX_DIRECTORY_ENTRIES = 32_768;
+const fail = (code, message) => { throw Object.assign(new Error(message), { code }); };
+const changed = () => fail('ENTROROVE_SCOPE_CHANGED', 'Original scope resolver observations changed before signing');
+const fingerprint = value => createHash('sha256').update(JSON.stringify(value)).digest('hex');
+function record(root, relative, kind, expected, inspect, directoryEntries = 0) {
+  const state = context.getStore();
+  if (!state || state.sealed) return;
+  if (root !== state.root || typeof relative !== 'string' || typeof inspect !== 'function') {
+    fail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Scope read observations require their original in-process root');
+  }
+  const key = `${kind}:${relative}`, checksum = fingerprint(expected), previous = state.records.get(key);
+  if (previous) { if (previous.checksum !== checksum) changed(); return; }
+  state.pathBytes += Buffer.byteLength(relative);
+  state.directoryEntries += directoryEntries;
+  if (state.records.size >= MAX_RECORDS || state.pathBytes > MAX_PATH_BYTES || state.directoryEntries > MAX_DIRECTORY_ENTRIES) {
+    fail('ENTROROVE_SCOPE_LIMIT', 'Scope resolver observations exceed their bounded in-process read set');
+  }
+  state.records.set(key, { checksum, inspect });
+}
+export function observeScopeAbsence(root, relative, inspect) {
+  record(root, relative, 'absence', false, async () => (await inspect()).exists);
+}
+export function observeScopeRead(root, relative, expected, inspect) {
+  record(root, relative, 'read', expected, inspect);
+}
+export function observeScopeTarget(root, relative, target, inspect) {
+  const kind = value => ({ exists: value.exists, file: value.stat?.isFile() ?? false, directory: value.stat?.isDirectory() ?? false });
+  record(root, relative, 'target', kind(target), async () => kind(await inspect()));
+}
+export function observeScopeDirectory(root, relative, names, inspect) {
+  record(root, relative, 'directory', names, inspect, names.length);
+}
+function sameRoot(before, after) {
+  return after.isDirectory() && !after.isSymbolicLink() && before.dev === after.dev && before.ino === after.ino;
+}
+export async function captureScopeReadSet(root, action) {
+  if (context.getStore() || typeof root !== 'string' || !path.isAbsolute(root) || typeof action !== 'function') {
+    fail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Scope read capture requires one actual independent observation');
+  }
+  const original = await fs.lstat(root);
+  if (!sameRoot(original, original) || await fs.realpath(root) !== root) {
+    fail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Scope read capture requires the original real repository root');
+  }
+  const state = { root, records: new Map(), pathBytes: 0, directoryEntries: 0, sealed: false };
+  let value;
+  try { value = await context.run(state, action); } finally { state.sealed = true; }
+  const verify = () => context.run(undefined, async () => {
+    try {
+      if (!sameRoot(original, await fs.lstat(root)) || await fs.realpath(root) !== root) changed();
+      for (const observation of state.records.values()) {
+        if (fingerprint(await observation.inspect()) !== observation.checksum) changed();
+      }
+      if (!sameRoot(original, await fs.lstat(root)) || await fs.realpath(root) !== root) changed();
+    } catch (error) {
+      if (error.code?.startsWith('ENTROROVE_')) throw error;
+      changed();
+    }
+  });
+  return { value, verify };
+}