@entrorove/skill 0.1.70 → 0.1.71

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.71 — 2026-10-20
+
+- 通用分离源码依赖事实与未知构建行为：动态配置、宏及加载器保留真实哈希与只读来源，不执行项目代码，不把构建未知标为完整。原审批与独立 S/M 签名仅允许已知源码的非结构修改；隐私文件、路径、资源预算、未知目标及配置漂移继续明确拒绝，实际构建与测试仍需原流程验收。
+- Separate raw source dependency facts from opaque build behavior across projects. Preserve actual hashes and read-only origins for dynamic configuration, macros and loaders without executing project code or claiming compiled completeness. Original approvals and separate S/M signatures permit only known-source nonstructural modifications; private files, unsafe paths, resource budgets, unknown targets and configuration drift remain explicit refusals. Actual builds and tests still require original-flow acceptance.
+
 ## 0.1.70 — 2026-10-20
 
 - 云端沙箱固定中英文输出语言，界面、通知和 Blueprint 文档正文按对应语种显示，原始证据单列来源并保留旧流程精确版本。修复 uni-app 默认条件编译分支解析与长扫描后的原任务签名挑战衔接，核对真实读集并保留原审批、完整路径、快照及失败历史。

package/SKILL.md

@@ -5,7 +5,7 @@ description: Execute a task selected for Entrorove through explicit SDK operatio
 
 # entrorove · 熵巡
 
-Version: 0.1.70.
+Version: 0.1.71.
 
 Entrorove applies only to the task for which it is selected; reading these instructions, discovering capabilities or installing the package never selects or governs another task. Hooks are optional. Reading this document or calling an entry once does not execute the task. On every later turn, including after compaction, continue the original task and its required next operation before dependent work. Keep the original goal, scope, account, flow, cloud task and failure records. Never describe planning, a reported step or model output as verified delivery.
 
@@ -22,7 +22,7 @@ Entrorove applies only to the task for which it is selected; reading these instr
 4. After real cloud acceptance, immediately display the returned entering status in the task’s selected language, including its **taskNumber**. Preserve `taskNumber` verbatim: it is the homepage sandbox tab number. Keep its UUID `taskId` separately. Run the returned `cloud-watch`, show each real public event and its cursor, and continue the original accepted flow from status. A command log alone is insufficient. No accepted cloud task means no cloud ID or model-execution claim.
 5. For an accepted `flowId`, execute the returned `nextStep` with its required payload. Discover the schema before constructing input. An empty payload is valid only when that operation's schema allows it. Reconnect and refresh only the original flow. A changed snapshot is a binding failure to investigate; do not invent a fresh successful baseline, rebuild a flow to evade it, or erase the old failure. If a fresh scope proof returns `ENTROROVE_SCOPE_PLANNING_REASSESSMENT_REQUIRED` before plan freeze, follow its explicit `workflow-scope-reassess` recovery and retry the original complete request; a local reassessment or snapshot refresh alone does not renew the accepted gate. If the terminal flow truly owns a stale task slot, use the explicit `flow-abandon` lifecycle operation described below before routing the original task again.
 6. All governed mutations use the original authority: `local guarded-write`, `local guarded-delete`, `local guarded-move`, or the original frozen approved runner plan. Native patches, scripts, terminal writes, database mutations and unknown MCP operations must not substitute for the controlled entry. User-authorized task messages use the host's message tool and remain subject to host approval; sending a report does not change the flow or grant execution authority. **A failed gate or unknown outcome must never be replaced with another executor or reported as local success.** Query the original request read-only, repair the cause, and obtain the original flow's valid authority before proceeding. If the original scope challenge preparation is absent from authenticated status, `scope-amend` may use the discovered `scope-challenge-retire` lifecycle operation. The server validates the same approved proposal and receiver, atomically fences only an unadmitted challenge, and records a signed retirement without executing that challenge. Recover and acknowledge the original retirement result with GET before a fresh challenge attempt; retain both requests and all failures. An admitted request, issued nonce, scope application or mutation has no missing-challenge retirement path. An uncertain retirement itself permits only its original GET.
-   For a member scope, follow a returned `localAction` before submitting execution evidence. `mutation-connect` obtains only the original task's limited editing pass; it keeps unresolved loader files and project configuration read only. After actual writes, refresh the original scope and run `mutation-settle`. Use the returned `previousPassId` for further edits. In a signed member-local plan, `workflow-observe-step` runs the original approved command and tests without a validator private key. A server-signed `localAcceptance` advances local dependencies; a failed test does not. Preserve the raw observation and its absent independent receipt. See [IDE-EXECUTION.md](IDE-EXECUTION.md#local-ide-acceptance).
+   For a member scope, follow a returned `localAction` before submitting execution evidence. `mutation-connect` obtains only the original task's limited editing pass. Its non-structural modify role requires known target source imports, preserves source imports and public contracts, and keeps unresolved origins, other observed dependencies and project configuration read only. Build scripts, macros and generated sources can remain opaque; source observations and this editing role never prove a complete compiled dependency graph or successful tests. After actual writes, refresh the original scope and run `mutation-settle`. Use the returned `previousPassId` for further edits. In a signed member-local plan, `workflow-observe-step` runs the original frozen command and tests without a validator private key. A server-signed `localAcceptance` advances local dependencies; a failed test does not. A frozen independent plan retains its independent validation requirement. Preserve the raw observation and its absent independent receipt. See [IDE-EXECUTION.md](IDE-EXECUTION.md#local-ide-acceptance).
 7. Read [REUSE-DISCIPLINE.md](REUSE-DISCIPLINE.md) when modifying an existing system. The comparison baseline is the existing implementation in that same repository. It never means another project, another account, or copying external systems.
    Never overwrite a newer package with older bytes, relabel an old archive as new, or roll back because the current state is uncertain. Package identity/version checks and immutable historical byte observations run in the guarded entries. A refusal requires preserved inputs and diagnosis; a `force`, `rollback`, timestamp or filename is not evidence. Intentional rollback uses the original independently signed merge rollback authorization, transaction journal, exact current/restore hashes and fresh original mutation pass. Preserve old failures, receipts and unknown effects; a successful rollback never makes the failed operation successful.
    **Before preparing or writing any UI implementation, read [DESIGN-GATES.md](DESIGN-GATES.md).** Record the whole-site flow first, fetch current mainstream layout references and the specified framework's official rules, create actual mockups or prototypes using the host image/design tool, and show them to the user. Respect their choice of visual format; a prototype is a valid approval baseline. Obtain the original persisted design confirmation before UI code preparation. Carry that exact design approval through the original scope, plan and mutation gates. Neither a caller flag nor a text-only description substitutes for this sequence. Finish real functional tests, actual browser interaction/layout/style checks and original user visual acceptance before delivery. Keep Entrorove unchanged in every language.

package/local-budget-reads.mjs

@@ -102,7 +102,7 @@ export async function readBudgetedProjectFile(input, target, options = {}) {
     const root = await fs.realpath(input.repositoryRoot);
     const sourcePath = options.sourcePath ?? path.relative(root, target).split(path.sep).join('/');
     const before = await fs.lstat(target, { bigint: true });
-    const result = await budgetReadBuffer({ ...binding, path: sourcePath }, { target });
+    const result = await budgetReadBuffer({ ...binding, path: sourcePath }, { target, verifyReadTarget: options.verifyReadTarget });
     const after = await fs.lstat(target, { bigint: true });
     if (!sameSourceStat(before, after)) fail('ENTROROVE_SCOPE_CHANGED', 'budgeted project source changed during its bound observation');
     projectBuffers.set(result.content, Object.freeze({ home: await fs.realpath(binding.home ?? os.homedir()),
@@ -110,7 +110,12 @@ export async function readBudgetedProjectFile(input, target, options = {}) {
     return options.encoding ? result.content.toString(options.encoding) : result.content;
   }
   const handle = await fs.open(target, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-  try { if (!(await handle.stat()).isFile()) fail('ENTROROVE_FILE_INVALID', 'source must be a regular file'); return await handle.readFile(options.encoding ? { encoding: options.encoding } : undefined); }
+  try {
+    const descriptor = await handle.stat();
+    if (!descriptor.isFile()) fail('ENTROROVE_FILE_INVALID', 'source must be a regular file');
+    if (options.verifyReadTarget) await options.verifyReadTarget({ target: await fs.realpath(target), descriptor });
+    return await handle.readFile(options.encoding ? { encoding: options.encoding } : undefined);
+  }
   finally { await handle.close(); }
 }
 

package/local-budget.mjs

@@ -91,7 +91,7 @@ function assertReadAllowed(state, relative, tokens, now = Date.now()) {
   if (tokens > state.maxTokenEstimate - state.tokenEstimate) fail('ENTROROVE_BUDGET_EXHAUSTED', 'read token budget exhausted');
   if (now - Date.parse(state.startedAt) >= state.maxDurationMs) fail('ENTROROVE_BUDGET_EXHAUSTED', 'read duration budget exhausted');
 }
-async function readSource(location, state, relative, target, received) {
+async function readSource(location, state, relative, target, received, verifyReadTarget) {
   const binding = { home: location.home, repositoryRoot: location.root, flowId: location.flowId, path: relative };
   await assertBudgetHandoffReadAllowed(binding, state);
   const actualTarget = await budgetSourceTarget(location, relative, target);
@@ -101,6 +101,7 @@ async function readSource(location, state, relative, target, received) {
   try {
     const stat = await handle.stat(); if (!stat.isFile()) fail('ENTROROVE_FILE_INVALID', 'budget source must be a regular file');
     await assertDescriptorTarget(target, actualTarget, stat);
+    if (verifyReadTarget) await verifyReadTarget({ target: actualTarget, descriptor: stat });
     assertReadAllowed(state, relative, Math.ceil(stat.size / 4));
     const cap = state.enforced ? Math.max(0, (state.maxTokenEstimate - state.tokenEstimate) * 4) : Number.MAX_SAFE_INTEGER;
     const chunks = []; let size = 0;
@@ -131,7 +132,7 @@ export async function budgetReadBuffer(input, options = {}) {
       if (state.grant?.purpose === 'handoff-read') requireLiveBudget(budgetHandoffReadValidationState(state));
       else state = consumeBudgetRenewal({ state });
       const target = options.target ?? path.join(location.root, relative);
-      const content = await readSource(location, state, relative, target, received); const tokens = Math.ceil(content.length / 4);
+      const content = await readSource(location, state, relative, target, received, options.verifyReadTarget); const tokens = Math.ceil(content.length / 4);
       const updated = { ...state, files: state.files.includes(relative) ? state.files : [...state.files, relative], readCalls: state.readCalls + 1, tokenEstimate: state.tokenEstimate + tokens };
       const committed = await commitBudget(location, loaded, updated, 'budget-read', { path: relative, tokens, bytes: content.length,
         readId, renewedIntervals: (state.autoRenew?.renewalsUsed ?? 0) - (loaded.state.autoRenew?.renewalsUsed ?? 0), reason: state.autoRenew?.lastRenewalReason ?? null });

package/local-scope-build-data.mjs

@@ -0,0 +1,73 @@
+import path from 'node:path';
+import ts from 'typescript';
+import { protectedBuildRelativePath } from './local-scope-build-read.mjs';
+import { uniConditionalError } from './local-scope-uni-expressions.mjs';
+
+export const buildConfigurationNames = ['vite.config.js', 'vite.config.mjs', 'vite.config.cjs', 'vite.config.ts',
+  'vite.config.mts', 'vite.config.cts', 'vue.config.js', 'vue.config.cjs', 'webpack.config.js', 'webpack.config.cjs',
+  'webpack.config.mjs', 'webpack.config.ts', 'rollup.config.js', 'rollup.config.mjs', 'rollup.config.ts',
+  'babel.config.js', 'babel.config.cjs', 'babel.config.json', '.babelrc', '.babelrc.json', '.babelrc.js',
+  'next.config.js', 'next.config.mjs', 'next.config.ts', 'nuxt.config.js', 'nuxt.config.ts', 'svelte.config.js'];
+export function buildDataPath(base, value) {
+  if (typeof value !== 'string' || value.includes('\\') || value.includes('\0') || path.posix.isAbsolute(value)) {
+    throw Object.assign(new Error('Build data references require literal repository-relative paths'), { code: 'ENTROROVE_PATH_UNSAFE' });
+  }
+  const relative = path.posix.normalize(path.posix.join(base, value)).replace(/\/$/, '');
+  if (relative === '..' || relative.startsWith('../')) throw Object.assign(new Error('Build data references cannot escape the original repository'), { code: 'ENTROROVE_PATH_UNSAFE' });
+  if (protectedBuildRelativePath(relative)) throw uniConditionalError(relative, 0, 'Build data cannot read environment or private control values');
+  return relative;
+}
+export function buildScriptReferences(manifest, filename = 'package.json') {
+  const references = new Set(); let opaque = false;
+  for (const [name, command] of Object.entries(manifest.scripts ?? {})) {
+    if (typeof command !== 'string') throw uniConditionalError(filename, 0, 'Build package scripts require string commands');
+    const relevant = /^(?:dev|build)(?::|$)/.test(name) || /(?:^|\s)(?:--(?:experimental-loader|loader|require|import)(?:=|\s)|-r\s)/.test(command);
+    if (!relevant) continue;
+    opaque = true;
+    // Literal references are data only, with no shell, cwd or execution claim.
+    if (/[$`\n\r|<>;]/.test(command) || /(?:^|&&)\s*cd\s/.test(command)) continue;
+    for (const segment of command.split('&&')) {
+      const words = segment.match(/"[^"]*"|'[^']*'|[^\s]+/g)?.map(word => /^['"]/.test(word) ? word.slice(1, -1) : word) ?? [];
+      let cursor = words[0] === 'cross-env' ? 1 : 0;
+      while (/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[cursor] ?? '')) cursor++;
+      if (words[cursor] === 'node' && words[cursor + 1] && !words[cursor + 1].startsWith('-')) references.add(words[cursor + 1]);
+      for (let index = cursor + 1; index < words.length; index++) {
+        if (['--config', '-c', '--experimental-loader', '--loader', '--require', '--import', '-r'].includes(words[index]) && words[index + 1]) references.add(words[++index]);
+        else if (/^--(?:config|experimental-loader|loader|require|import)=/.test(words[index])) references.add(words[index].slice(words[index].indexOf('=') + 1));
+      }
+    }
+  }
+  return { opaque, references: [...references].sort() };
+}
+export function buildModuleData(source, filename) {
+  let ast;
+  try { ast = ts.createSourceFile(filename, source, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS); }
+  catch (error) { if (!(error instanceof RangeError)) throw error; throw Object.assign(uniConditionalError(filename, 0, 'Build data syntax exceeds its parser bound'), { code: 'ENTROROVE_SCOPE_LIMIT' }); }
+  const references = new Set(); let nodes = 0;
+  const inspect = node => {
+    if (++nodes > 8192) throw Object.assign(uniConditionalError(filename, 0, 'Build data syntax exceeds its 8192-node bound'), { code: 'ENTROROVE_SCOPE_LIMIT' });
+    if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier && ts.isStringLiteralLike(node.moduleSpecifier)) references.add(node.moduleSpecifier.text);
+    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && node.expression.text === 'require'
+      && node.arguments.length === 1 && ts.isStringLiteralLike(node.arguments[0])) references.add(node.arguments[0].text);
+    if (ts.isPropertyAssignment(node) && !ts.isComputedPropertyName(node.name) && ['loader', 'use'].includes(node.name.text)
+      && ts.isStringLiteralLike(node.initializer)) references.add(node.initializer.text);
+    // Function bodies remain opaque build code. Inspect module-level literal
+    // declarations without simulating callbacks or proving a runtime closure.
+    if (ts.isFunctionLike(node)) return;
+    ts.forEachChild(node, inspect);
+  };
+  inspect(ast);
+  const literalRoots = [];
+  for (const statement of ast.statements) {
+    let expression = ts.isExportAssignment(statement) ? statement.expression : ts.isExpressionStatement(statement)
+      && ts.isBinaryExpression(statement.expression) && statement.expression.left.getText(ast) === 'module.exports'
+      && statement.expression.operatorToken.kind === ts.SyntaxKind.EqualsToken ? statement.expression.right : undefined;
+    while (expression && (ts.isParenthesizedExpression(expression) || ts.isAsExpression(expression) || ts.isSatisfiesExpression(expression))) expression = expression.expression;
+    if (!expression || !ts.isObjectLiteralExpression(expression)) continue;
+    const literal = Object.create(null);
+    for (const property of expression.properties) if (ts.isPropertyAssignment(property) && !ts.isComputedPropertyName(property.name)
+      && ['root', 'envDir', 'context'].includes(property.name.text) && ts.isStringLiteralLike(property.initializer)) literal[property.name.text] = property.initializer.text;
+    literalRoots.push(literal);
+  }
+  return { references: [...references].filter(value => value.startsWith('.')).sort(), literalRoots };
+}

package/local-scope-build-facts.mjs

@@ -0,0 +1,33 @@
+import { packageBoundary, scopeFail, scopePath, scopeBuildSourceRead } from './local-scope-files.mjs';
+
+// Opaque build programs are readonly origins. They never replace source identities
+// or establish a complete compiled graph, and are never executed by inspection.
+export async function observeBuildFacts(root, proof, input, graph) {
+  if (!proof || !Array.isArray(proof.observations) || !Array.isArray(proof.unresolvedBuildSources)) {
+    scopeFail('ENTROROVE_IMPORT_INVALID', 'Build inspection requires explicit observed files and uncertainty origins');
+  }
+  for (const file of proof.observations) {
+    scopePath(file.path);
+    if (!/^[a-f0-9]{64}$/.test(file.sha256 ?? '')) scopeFail('ENTROROVE_IMPORT_INVALID', 'Build observation has no actual file hash');
+    const previous = graph.metadata.get(file.path);
+    if (previous && previous.sha256 !== file.sha256) scopeFail('ENTROROVE_SCOPE_CHANGED', 'Build metadata changed during source inspection');
+    graph.metadata.set(file.path, { path: file.path, sha256: file.sha256 });
+  }
+  for (const origin of proof.unresolvedBuildSources) {
+    const file = graph.metadata.get(origin.path);
+    if (!file || file.sha256 !== origin.sha256 || typeof origin.reason !== 'string' || !/^[a-z][a-z-]{0,95}$/.test(origin.reason)) {
+      scopeFail('ENTROROVE_IMPORT_INVALID', 'Opaque build origin must match an actual readonly file observation');
+    }
+    if (!graph.visited.has(file.path)) {
+      if (graph.visited.size >= 1000) scopeFail('ENTROROVE_SCOPE_LIMIT', 'import graph exceeds the 1000-file inspection bound');
+      const boundary = await packageBoundary(root, file.path, input, scopeBuildSourceRead);
+      graph.visited.set(file.path, { ...file, module: boundary.path, boundary });
+    }
+    if (graph.visited.get(file.path).sha256 !== file.sha256) scopeFail('ENTROROVE_SCOPE_CHANGED', 'Opaque build origin differs from its actual source node');
+    if (graph.dynamicSources.some(item => item.path === file.path)) continue;
+    graph.dynamicSources.push(file);
+    graph.unresolvedImports.push({ path: file.path, line: 1, column: 1, reason: origin.reason,
+      message: 'Build behavior remains unproven; this origin is read-only and source projection grants no compiled dependency guarantee' });
+  }
+  return proof.unresolvedBuildSources.length > 0;
+}

package/local-scope-build-io.mjs

@@ -0,0 +1,57 @@
+import { promises as fs } from 'node:fs';
+import { scopeFail, scopeProbeTarget, scopeTarget } from './local-scope-files.mjs';
+import { isProtectedBuildPath, protectedBuildRelativePath as protectedPath } from './local-scope-build-read.mjs';
+
+const dependency = relative => relative.split('/').includes('node_modules');
+
+// Inspect names and physical destinations before a build helper can read bytes.
+// A dependency symlink is never permission to read an environment/control file.
+export function createScopeBuildIO(root, readMetadata, hashMetadata) {
+  const protectedDestination = actual => isProtectedBuildPath(root, actual);
+  const probe = async relative => {
+    if (relative === '.') return { exists: true, file: false, directory: true };
+    const target = await scopeProbeTarget(root, relative, dependency(relative));
+    return { exists: target.exists, file: Boolean(target.stat?.isFile()), directory: Boolean(target.stat?.isDirectory()) };
+  };
+  const readTarget = async (relative, operation) => {
+    if (protectedPath(relative)) scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'Build inspection cannot read environment or control files');
+    const target = await scopeProbeTarget(root, relative, dependency(relative));
+    if (target.exists && protectedDestination(await fs.realpath(target.target))) {
+      scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'Build dependency resolves to an environment or control file; values were not read');
+    }
+    return operation(relative);
+  };
+  const read = relative => readTarget(relative, readMetadata);
+  const inspectDirectory = async (relative, maximumEntries) => {
+    if (protectedPath(relative)) scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'Build inspection cannot enter a private control directory');
+    const target = relative === '.' ? root : (await scopeTarget(root, relative)).target;
+    const before = await fs.lstat(target), realPath = await fs.realpath(target);
+    if (!before.isDirectory() || before.isSymbolicLink() || protectedDestination(realPath)) {
+      scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'Build directory must be a real non-private directory');
+    }
+    const identity = { dev: before.dev, ino: before.ino, mode: before.mode & 0o777, realPath };
+    const verify = async () => {
+      const current = await fs.lstat(target), actual = await fs.realpath(target);
+      if (!current.isDirectory() || current.isSymbolicLink() || current.dev !== identity.dev || current.ino !== identity.ino
+        || (current.mode & 0o777) !== identity.mode || actual !== realPath || protectedDestination(actual)) {
+        scopeFail('ENTROROVE_SCOPE_CHANGED', 'Build directory identity changed during name observation');
+      }
+    };
+    await verify();
+    const directory = await fs.opendir(target), environmentFiles = [], children = []; let entries = 0;
+    let iterating = false;
+    try {
+      await verify(); iterating = true;
+      for await (const entry of directory) {
+        if (++entries > maximumEntries) scopeFail('ENTROROVE_SCOPE_LIMIT', 'Conditional build directory exceeds its bounded entry inspection');
+        if (entry.name === '.env' || entry.name.startsWith('.env.')) environmentFiles.push(entry.name);
+        children.push({ name: entry.name, kind: entry.isSymbolicLink() ? 'symlink' : entry.isDirectory() ? 'directory'
+          : entry.isFile() ? 'file' : 'unsupported' });
+      }
+    } finally { if (!iterating) await directory.close(); }
+    await verify();
+    children.sort((left, right) => left.name.localeCompare(right.name));
+    return { environmentFiles: environmentFiles.sort(), entries, children, identity };
+  };
+  return { read, probe, inspectDirectory, ...(hashMetadata ? { hashMetadata: relative => readTarget(relative, hashMetadata) } : {}) };
+}

package/local-scope-build-read.mjs

@@ -0,0 +1,22 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+export const protectedBuildRelativePath = value => value.split(/[\\/]/).some(part => part === '.env' || part.startsWith('.env.')
+  || ['.git', '.entrorove', '.aimlock', '.archguard', '.ssh', '.aws', '.gnupg', '.kube', '.azure',
+    '.codex', '.claude', '.agents', '.npmrc', '.netrc', '.pypirc', '.gitconfig', 'id_rsa', 'id_ed25519'].includes(part)
+  || /\.(?:pem|key)$/i.test(part));
+export function isProtectedBuildPath(root, actual) {
+  const relative = path.relative(root, actual);
+  return protectedBuildRelativePath(relative === '..' || relative.startsWith(`..${path.sep}`) ? actual : relative);
+}
+export async function assertBuildReadTarget(root, relative, target, descriptor) {
+  if (protectedBuildRelativePath(relative) || isProtectedBuildPath(root, target)) {
+    throw Object.assign(new Error('Build dependency resolves to an environment or control file; values were not read'),
+      { code: 'ENTROROVE_IMPORT_UNSUPPORTED' });
+  }
+  const actual = await fs.stat(target);
+  if (!actual.isFile() || actual.dev !== descriptor.dev || actual.ino !== descriptor.ino) {
+    throw Object.assign(new Error('Build dependency destination changed before reading any source bytes'),
+      { code: 'ENTROROVE_SCOPE_CHANGED' });
+  }
+}

package/local-scope-build-readset.mjs

@@ -0,0 +1,49 @@
+import { uniConditionalError } from './local-scope-uni-expressions.mjs';
+import { buildDataPath } from './local-scope-build-data.mjs';
+import { sha256 } from './local-integrity.mjs';
+
+const absent = error => ['ENOENT', 'ENOTDIR'].includes(error.code);
+const changed = path => Object.assign(uniConditionalError(path, 0, 'Build data or candidate absence changed during inspection'), { code: 'ENTROROVE_SCOPE_CHANGED' });
+const shape = value => value ? { entries: value.entries, environmentFiles: [...value.environmentFiles].sort(),
+  ...(value.identity ? { identity: { ...value.identity } } : {}),
+  ...(value.children ? { children: value.children.map(({ name, kind }) => ({ name, kind })).sort((a, b) => a.name.localeCompare(b.name)) } : {}) } : null;
+export function createBuildDataReadset(read, inspectDirectory) {
+  const files = new Map(), directories = new Map(); let bytes = 0, entries = 0;
+  const observe = async relative => {
+    buildDataPath('.', relative); if (files.has(relative)) return files.get(relative);
+    if (files.size >= 2048) throw uniConditionalError(relative, 0, 'Build data exceeds its 2048-path inspection bound');
+    let item; try { item = await read(relative); } catch (error) { if (!absent(error)) throw error; }
+    if (item) {
+      const content = Buffer.from(item.contentBase64, 'base64'), size = content.length;
+      if (size > 1_048_576 || bytes + size > 8_388_608) throw Object.assign(uniConditionalError(relative, 0, 'Build data exceeds its 1-MiB/file or 8-MiB bound'), { code: 'ENTROROVE_SCOPE_LIMIT' });
+      if (item.path !== relative || !/^[a-f0-9]{64}$/.test(item.sha256) || item.sha256 !== sha256(content)) throw uniConditionalError(relative, 0, 'Build data observation has no actual path and hash');
+      bytes += size;
+    }
+    files.set(relative, item ?? null); return item ?? null;
+  };
+  const directory = async relative => {
+    if (relative !== '.') buildDataPath('.', relative);
+    if (directories.has(relative)) return directories.get(relative);
+    if (directories.size >= 128 || typeof inspectDirectory !== 'function') throw uniConditionalError(relative, 0, 'Build directory absence requires bounded actual inspection');
+    let value; try { value = await inspectDirectory(relative, Math.min(8192, 32768 - entries)); } catch (error) { if (!absent(error)) throw error; }
+    if (value) {
+      if (!Number.isInteger(value.entries) || value.entries < 0 || !Array.isArray(value.environmentFiles)
+        || value.entries > 8192 || entries + value.entries > 32768) throw Object.assign(uniConditionalError(relative, 0, 'Build directory exceeds its bounded name inspection'), { code: 'ENTROROVE_SCOPE_LIMIT' });
+      entries += value.entries;
+    }
+    const result = shape(value); directories.set(relative, result); return result;
+  };
+  const verify = async () => {
+    for (const [relative, expected] of files) {
+      let actual; try { actual = await read(relative); } catch (error) { if (!absent(error)) throw error; }
+      if ((actual?.sha256 ?? null) !== (expected?.sha256 ?? null) || actual?.realPath !== expected?.realPath
+        || actual?.mode !== expected?.mode || JSON.stringify(actual?.referenceRoot) !== JSON.stringify(expected?.referenceRoot)) throw changed(relative);
+    }
+    let checked = 0;
+    for (const [relative, expected] of directories) {
+      let actual; try { actual = await inspectDirectory(relative, Math.min(8192, 32768 - checked)); } catch (error) { if (!absent(error)) throw error; }
+      checked += actual?.entries ?? 0; if (JSON.stringify(shape(actual)) !== JSON.stringify(expected)) throw changed(relative);
+    }
+  };
+  return { observe, directory, verify, get observations() { return [...files.values()].filter(Boolean).map(({ path, sha256 }) => ({ path, sha256 })).sort((a, b) => a.path.localeCompare(b.path)); } };
+}

package/local-scope-files.mjs

@@ -5,6 +5,7 @@ import { readBudgetedProjectFile } from './local-budget-reads.mjs';
 import { verifiedSfnt } from './local-scope-font.mjs';
 import { verifiedZip } from './local-scope-zip.mjs';
 import { observeScopeAbsence, observeScopeRead, observeScopeTarget } from './local-scope-read-set.mjs';
+import { assertBuildReadTarget, protectedBuildRelativePath } from './local-scope-build-read.mjs';
 
 export function scopeFail(code, message) { throw Object.assign(new Error(message), { code }); }
 export function observedScopeRisk(files) {
@@ -100,7 +101,7 @@ export async function scopeProbeTarget(root, relative, allowDependency = false)
     return { target: path.join(root, relative), exists: false, stat: null };
   }
 }
-async function safeScopeRead(root, relative, input, allowDependency = true) {
+async function safeScopeRead(root, relative, input, allowDependency = true, verifyReadTarget) {
   const dependency = allowDependency && dependencyReference(relative), target = await scopeTarget(root, relative, false, dependency);
   if (!target.stat.isFile()) await invalidScopeTarget(root, relative, target.target, 'not-regular-file');
   if (target.stat.size > 16_777_216) scopeFail('ENTROROVE_SCOPE_LIMIT', 'scope source exceeds the 16 MiB inspection bound');
@@ -108,7 +109,15 @@ async function safeScopeRead(root, relative, input, allowDependency = true) {
   try {
     const before = await handle.stat();
     const beforeReal = dependency ? await fs.realpath(target.target) : null;
-    const content = input ? await readBudgetedProjectFile(input, target.target, { sourcePath: relative }) : await handle.readFile();
+    if (verifyReadTarget) {
+      if (before.ino !== target.stat.ino || before.dev !== target.stat.dev) scopeFail('ENTROROVE_SCOPE_CHANGED', 'Build source changed before its descriptor was opened');
+      await verifyReadTarget({ target: beforeReal ?? target.target, descriptor: before });
+    }
+    const boundedVerify = verifyReadTarget ? async actual => {
+      if (actual.descriptor.ino !== before.ino || actual.descriptor.dev !== before.dev) scopeFail('ENTROROVE_SCOPE_CHANGED', 'Build source changed before its accounted descriptor was opened');
+      await verifyReadTarget(actual);
+    } : undefined;
+    const content = input ? await readBudgetedProjectFile(input, target.target, { sourcePath: relative, verifyReadTarget: boundedVerify }) : await handle.readFile();
     const after = await handle.stat();
     const latest = dependency ? await fs.stat(target.target) : await fs.lstat(target.target);
     const afterReal = dependency ? await fs.realpath(target.target) : null;
@@ -118,13 +127,17 @@ async function safeScopeRead(root, relative, input, allowDependency = true) {
     await scopeTarget(root, relative, false, dependency);
     const digest = sha256(content);
     observeScopeRead(root, relative, { sha256: digest, mode: after.mode & 0o777, realPath: afterReal ?? target.target }, async () => {
-      const actual = await safeScopeRead(root, relative, input, allowDependency);
+      const actual = await safeScopeRead(root, relative, input, allowDependency, verifyReadTarget);
       return { sha256: actual.sha256, mode: actual.mode, realPath: await fs.realpath(target.target) };
     });
     return { content, mode: after.mode & 0o777, sha256: digest, bytes: content.length };
   } finally { await handle.close(); }
 }
 export const scopeRead = (root, relative, input = { repositoryRoot: root }) => safeScopeRead(root, relative, input, true);
+export function scopeBuildSourceRead(root, relative, input = { repositoryRoot: root }) {
+  if (protectedBuildRelativePath(relative)) scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'Build inspection cannot read environment or credential values');
+  return safeScopeRead(root, relative, input, true, ({ target, descriptor }) => assertBuildReadTarget(root, relative, target, descriptor));
+}
 // Internal control roles only: signed manifest metadata and already validated private signer files.
 export const scopeControlRead = (root, relative) => safeScopeRead(root, relative, null, false);
 const excluded = new Set(['.git', 'node_modules', '.entrorove', '.aimlock', '.archguard']);
@@ -152,12 +165,12 @@ export function lineCount(content) {
   if (!content.length || verifiedSfnt(content) || verifiedZip(content)) return 0;
   return content.toString('utf8').split(/\r\n|\n|\r/).length - (/[\r\n]$/.test(content.toString('utf8')) ? 1 : 0);
 }
-export async function packageBoundary(root, relative, input = { repositoryRoot: root }) {
+export async function packageBoundary(root, relative, input = { repositoryRoot: root }, readSource = scopeRead) {
   let directory = path.posix.dirname(relative);
   while (true) {
     const manifestPath = directory === '.' ? 'package.json' : `${directory}/package.json`;
     try {
-      const read = await scopeRead(root, manifestPath, input); let manifest;
+      const read = await readSource(root, manifestPath, input); let manifest;
       try { manifest = JSON.parse(read.content.toString('utf8')); } catch { scopeFail('ENTROROVE_PACKAGE_INVALID', 'package manifest is not valid JSON'); }
       return { path: directory, manifestPath, manifestDigest: read.sha256, name: typeof manifest.name === 'string' ? manifest.name : null };
     } catch (error) { if (error.code !== 'ENOENT') throw error; }
@@ -166,11 +179,11 @@ export async function packageBoundary(root, relative, input = { repositoryRoot:
   }
   return { path: relative.includes('/') ? relative.split('/')[0] : '.', manifestPath: null, manifestDigest: null, name: null };
 }
-export async function stableScope(root, files, input = { repositoryRoot: root }) {
+export async function stableScope(root, files, input = { repositoryRoot: root }, readSource = scopeRead) {
   for (const file of files) {
     if (file.exists === false) {
       if ((await scopeTarget(root, file.path, true)).exists) scopeFail('ENTROROVE_SCOPE_CHANGED', 'a deleted target reappeared during inspection');
-    } else if ((await scopeRead(root, file.path, input)).sha256 !== file.sha256) scopeFail('ENTROROVE_SCOPE_CHANGED', 'scope files changed before the observation completed');
+    } else if ((await readSource(root, file.path, input)).sha256 !== file.sha256) scopeFail('ENTROROVE_SCOPE_CHANGED', 'scope files changed before the observation completed');
   }
 }
 export const scopeDigest = value => sha256(canonical(value));