@entrorove/skill 0.1.70 → 0.1.73

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.1.73 — 2026-10-20
+
+- 修复通用范围连接在长时间扫描后的签名期限绑定：原 S 证明到期时间不晚于原云端挑战，保留原随机数、完整范围、独立验签和失败历史；已过期挑战仍明确拒绝。
+- Bind ordinary scope signatures to their original cloud deadline after long scans. The original S proof expires no later than its challenge, preserving the nonce, complete scope, independent signatures and failure history; expired challenges still reject explicitly.
+
+## 0.1.72 — 2026-10-20
+
+- 将完整范围证据与签名控制分离：四类原 S 证明经有界独立通道上传，紧凑权威绑定不可变摘要与字节数；未知上传仅恢复原 GET，保留原路径、上下文、审批、独立 M 写入和全部旧失败记录。
+- Separate full scope evidence from signed controls: upload four kinds of original S proof through a bounded data channel and bind immutable hashes and byte counts in compact authorities. Recover uncertain uploads with the original GET only, preserving complete paths, contexts, approvals, separate M writes and prior failures.
+
+## 0.1.71 — 2026-10-20
+
+- 通用分离源码依赖事实与未知构建行为：动态配置、宏及加载器保留真实哈希与只读来源，不执行项目代码，不把构建未知标为完整。原审批与独立 S/M 签名仅允许已知源码的非结构修改；隐私文件、路径、资源预算、未知目标及配置漂移继续明确拒绝，实际构建与测试仍需原流程验收。
+- Separate raw source dependency facts from opaque build behavior across projects. Preserve actual hashes and read-only origins for dynamic configuration, macros and loaders without executing project code or claiming compiled completeness. Original approvals and separate S/M signatures permit only known-source nonstructural modifications; private files, unsafe paths, resource budgets, unknown targets and configuration drift remain explicit refusals. Actual builds and tests still require original-flow acceptance.
+
 ## 0.1.70 — 2026-10-20
 
 - 云端沙箱固定中英文输出语言，界面、通知和 Blueprint 文档正文按对应语种显示，原始证据单列来源并保留旧流程精确版本。修复 uni-app 默认条件编译分支解析与长扫描后的原任务签名挑战衔接，核对真实读集并保留原审批、完整路径、快照及失败历史。

package/IDE-EXECUTION.md

@@ -92,6 +92,10 @@ When intake returns `workflow-gate`, connect the current repository before invok
 
 Scope inspection resolves aliases from actual `tsconfig.json` or `jsconfig.json`, including relative and npm `extends` and ordered inheritance arrays. Npm configuration lookup uses the pinned TypeScript JSON-config resolver over controlled metadata reads, including scoped packages, subpaths, package `tsconfig`, `exports` and `typesVersions`. Read-only candidate probes treat a child beneath an ordinary file as absent so normal TypeScript fallbacks continue; actual sources, control files and mutation targets retain strict validation. Rejected paths report the requested path, blocking ancestor, resolved target and reason, including broken or cyclic dependency links. Configurations and package metadata enter the signed hashes; dependencies are read only, never executed. Repository-local pnpm links use their actual configuration location. Read-only external dependency packages support parents and mappings inside their reference boundary; references requiring an unrepresentable external canonical ancestor fail explicitly rather than selecting a different same-name repository package. For plugin source compiled by a host project whose config is outside the source's ancestors, include `importContexts: [{"sourcePrefix":"<plugin source directory>","configPath":"<actual host tsconfig.json>"}]` in `scope-connect` input. Inspect the real build configuration first; never invent an alias or mark an unresolved import as external. These context paths remain inside the repository, their hashes enter the signed facts, and the local task binding freezes them.
 
+Full scope observations travel through a separate authenticated evidence channel. The SDK keeps the complete original canonical UTF8 S proof in a private SHA256-derived sidecar, reserves an upload with the discovered `scope-evidence-prepare`, and sends its exact bytes once through that reservation's `PUT`. The fixed data limit is 16,000,000 bytes, with bounded structure, time and concurrency; ordinary request, signed-control and journal limits remain unchanged. Ordinary observations, context corrections, scope revisions and post-write refreshes have distinct evidence kinds and exact original identity bindings. An upload or reference grants no execution authority. Apply still verifies the original signatures, freshness, full scope, owner approval, nonce and revision CAS, including separate M consumption for changed writes.
+
+An interrupted upload is recovered only with its original reservation's `GET`; a missing or pending result does not authorize another upload, nonce or changed input. Reuse the exact original connector command and input so its private journal performs that recovery. Compact v2 authorities sign the immutable evidence reference, digest, byte count and original task identities. Their revision digest hashes the signed compact record, never a hydrated projection. Readers verify the full sidecar before using the retained context history or amendment reference. Old v1 records and known failures retain their exact bytes; a known terminal rejection is archived before a fresh same-proposal attempt. Do not hand-edit a managed SDK, sidecar, binding or journal to bypass these checks.
+
 ### Correcting build contexts before the first scope gate
 
 An unresolved alias can occur after the original local signer has been enrolled but before any scope facts or gate have been accepted. Ordinary `scope-connect` still rejects a changed `importContexts` list. Use the explicit `scope-context <original absolute repositoryRoot>` recovery on that same flow; do not edit `identity/binding.json`, replace its key, drop target paths or create a replacement flow.

package/SKILL.md

@@ -5,7 +5,7 @@ description: Execute a task selected for Entrorove through explicit SDK operatio
 
 # entrorove · 熵巡
 
-Version: 0.1.70.
+Version: 0.1.73.
 
 Entrorove applies only to the task for which it is selected; reading these instructions, discovering capabilities or installing the package never selects or governs another task. Hooks are optional. Reading this document or calling an entry once does not execute the task. On every later turn, including after compaction, continue the original task and its required next operation before dependent work. Keep the original goal, scope, account, flow, cloud task and failure records. Never describe planning, a reported step or model output as verified delivery.
 
@@ -22,7 +22,7 @@ Entrorove applies only to the task for which it is selected; reading these instr
 4. After real cloud acceptance, immediately display the returned entering status in the task’s selected language, including its **taskNumber**. Preserve `taskNumber` verbatim: it is the homepage sandbox tab number. Keep its UUID `taskId` separately. Run the returned `cloud-watch`, show each real public event and its cursor, and continue the original accepted flow from status. A command log alone is insufficient. No accepted cloud task means no cloud ID or model-execution claim.
 5. For an accepted `flowId`, execute the returned `nextStep` with its required payload. Discover the schema before constructing input. An empty payload is valid only when that operation's schema allows it. Reconnect and refresh only the original flow. A changed snapshot is a binding failure to investigate; do not invent a fresh successful baseline, rebuild a flow to evade it, or erase the old failure. If a fresh scope proof returns `ENTROROVE_SCOPE_PLANNING_REASSESSMENT_REQUIRED` before plan freeze, follow its explicit `workflow-scope-reassess` recovery and retry the original complete request; a local reassessment or snapshot refresh alone does not renew the accepted gate. If the terminal flow truly owns a stale task slot, use the explicit `flow-abandon` lifecycle operation described below before routing the original task again.
 6. All governed mutations use the original authority: `local guarded-write`, `local guarded-delete`, `local guarded-move`, or the original frozen approved runner plan. Native patches, scripts, terminal writes, database mutations and unknown MCP operations must not substitute for the controlled entry. User-authorized task messages use the host's message tool and remain subject to host approval; sending a report does not change the flow or grant execution authority. **A failed gate or unknown outcome must never be replaced with another executor or reported as local success.** Query the original request read-only, repair the cause, and obtain the original flow's valid authority before proceeding. If the original scope challenge preparation is absent from authenticated status, `scope-amend` may use the discovered `scope-challenge-retire` lifecycle operation. The server validates the same approved proposal and receiver, atomically fences only an unadmitted challenge, and records a signed retirement without executing that challenge. Recover and acknowledge the original retirement result with GET before a fresh challenge attempt; retain both requests and all failures. An admitted request, issued nonce, scope application or mutation has no missing-challenge retirement path. An uncertain retirement itself permits only its original GET.
-   For a member scope, follow a returned `localAction` before submitting execution evidence. `mutation-connect` obtains only the original task's limited editing pass; it keeps unresolved loader files and project configuration read only. After actual writes, refresh the original scope and run `mutation-settle`. Use the returned `previousPassId` for further edits. In a signed member-local plan, `workflow-observe-step` runs the original approved command and tests without a validator private key. A server-signed `localAcceptance` advances local dependencies; a failed test does not. Preserve the raw observation and its absent independent receipt. See [IDE-EXECUTION.md](IDE-EXECUTION.md#local-ide-acceptance).
+   For a member scope, follow a returned `localAction` before submitting execution evidence. `mutation-connect` obtains only the original task's limited editing pass. Its non-structural modify role requires known target source imports, preserves source imports and public contracts, and keeps unresolved origins, other observed dependencies and project configuration read only. Build scripts, macros and generated sources can remain opaque; source observations and this editing role never prove a complete compiled dependency graph or successful tests. After actual writes, refresh the original scope and run `mutation-settle`. Use the returned `previousPassId` for further edits. In a signed member-local plan, `workflow-observe-step` runs the original frozen command and tests without a validator private key. A server-signed `localAcceptance` advances local dependencies; a failed test does not. A frozen independent plan retains its independent validation requirement. Preserve the raw observation and its absent independent receipt. See [IDE-EXECUTION.md](IDE-EXECUTION.md#local-ide-acceptance).
 7. Read [REUSE-DISCIPLINE.md](REUSE-DISCIPLINE.md) when modifying an existing system. The comparison baseline is the existing implementation in that same repository. It never means another project, another account, or copying external systems.
    Never overwrite a newer package with older bytes, relabel an old archive as new, or roll back because the current state is uncertain. Package identity/version checks and immutable historical byte observations run in the guarded entries. A refusal requires preserved inputs and diagnosis; a `force`, `rollback`, timestamp or filename is not evidence. Intentional rollback uses the original independently signed merge rollback authorization, transaction journal, exact current/restore hashes and fresh original mutation pass. Preserve old failures, receipts and unknown effects; a successful rollback never makes the failed operation successful.
    **Before preparing or writing any UI implementation, read [DESIGN-GATES.md](DESIGN-GATES.md).** Record the whole-site flow first, fetch current mainstream layout references and the specified framework's official rules, create actual mockups or prototypes using the host image/design tool, and show them to the user. Respect their choice of visual format; a prototype is a valid approval baseline. Obtain the original persisted design confirmation before UI code preparation. Carry that exact design approval through the original scope, plan and mutation gates. Neither a caller flag nor a text-only description substitutes for this sequence. Finish real functional tests, actual browser interaction/layout/style checks and original user visual acceptance before delivery. Keep Entrorove unchanged in every language.
@@ -46,6 +46,7 @@ When a new user requirement arrives while the original task is unfinished, store
 - Invoke service operations with JSON stdin to `npx @entrorove/skill invoke` or a host-approved rewritten equivalent.
 - Explicit domains use `native <domain> <operation>`. Domains: aimlock, blueprint, calctool, swarm, validator, mergeguard, archguard, confirm-protocol. Aimlock `brain-plan`, `brain-check`, `brain-validate`, `brain-status` use the original stored plan.
 - At `workflow-gate`, connect the actual repository and exact source paths with `scope-connect`, then use its original `nextInput`. Scope inspection does not grant execution or writes. Dynamic references remain unknown; never set graph completeness manually.
+- Complete S evidence uses a separate bounded upload and private hash-bound data file. Keep every original path, context and unknown origin. An interrupted upload permits only its original GET recovery through the unchanged connector input; a missing result never permits another PUT or challenge. Compact signed authorities bind the complete evidence reference while preserving the original control limits and v1 history.
 - If a real missing build context blocks the first scope scan, use the same-flow `scope-context` review and original-owner answer described in [IDE-EXECUTION.md](IDE-EXECUTION.md#correcting-build-contexts-before-the-first-scope-gate). Apply its exact approved proposal with the original S signer and fresh actual snapshot, then retry the returned complete `scope-connect` input. Keep the original binding, all paths and failed attempts; ordinary reconnects cannot silently change contexts.
 - If actual files were omitted before plan freeze, follow the discovered same-flow `workflow-scope-review`, original owner approval and `scope-amend` recovery in [IDE-EXECUTION.md](IDE-EXECUTION.md#correcting-omitted-scope-before-plan-freeze). Preserve each file's explicit write or read-only role and bind the resulting `scopeRevisionDigest` in the corrected plan; never widen ordinary `scope-connect` input to bypass its original binding.
 - `local capabilities` describes scope, snapshot, budget, ownership, mutation, review and evidence contracts. Do not call a guessed operation or construct a local signature in place of cloud authority.

package/local-budget-reads.mjs

@@ -102,7 +102,7 @@ export async function readBudgetedProjectFile(input, target, options = {}) {
     const root = await fs.realpath(input.repositoryRoot);
     const sourcePath = options.sourcePath ?? path.relative(root, target).split(path.sep).join('/');
     const before = await fs.lstat(target, { bigint: true });
-    const result = await budgetReadBuffer({ ...binding, path: sourcePath }, { target });
+    const result = await budgetReadBuffer({ ...binding, path: sourcePath }, { target, verifyReadTarget: options.verifyReadTarget });
     const after = await fs.lstat(target, { bigint: true });
     if (!sameSourceStat(before, after)) fail('ENTROROVE_SCOPE_CHANGED', 'budgeted project source changed during its bound observation');
     projectBuffers.set(result.content, Object.freeze({ home: await fs.realpath(binding.home ?? os.homedir()),
@@ -110,7 +110,12 @@ export async function readBudgetedProjectFile(input, target, options = {}) {
     return options.encoding ? result.content.toString(options.encoding) : result.content;
   }
   const handle = await fs.open(target, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-  try { if (!(await handle.stat()).isFile()) fail('ENTROROVE_FILE_INVALID', 'source must be a regular file'); return await handle.readFile(options.encoding ? { encoding: options.encoding } : undefined); }
+  try {
+    const descriptor = await handle.stat();
+    if (!descriptor.isFile()) fail('ENTROROVE_FILE_INVALID', 'source must be a regular file');
+    if (options.verifyReadTarget) await options.verifyReadTarget({ target: await fs.realpath(target), descriptor });
+    return await handle.readFile(options.encoding ? { encoding: options.encoding } : undefined);
+  }
   finally { await handle.close(); }
 }
 

package/local-budget.mjs

@@ -91,7 +91,7 @@ function assertReadAllowed(state, relative, tokens, now = Date.now()) {
   if (tokens > state.maxTokenEstimate - state.tokenEstimate) fail('ENTROROVE_BUDGET_EXHAUSTED', 'read token budget exhausted');
   if (now - Date.parse(state.startedAt) >= state.maxDurationMs) fail('ENTROROVE_BUDGET_EXHAUSTED', 'read duration budget exhausted');
 }
-async function readSource(location, state, relative, target, received) {
+async function readSource(location, state, relative, target, received, verifyReadTarget) {
   const binding = { home: location.home, repositoryRoot: location.root, flowId: location.flowId, path: relative };
   await assertBudgetHandoffReadAllowed(binding, state);
   const actualTarget = await budgetSourceTarget(location, relative, target);
@@ -101,6 +101,7 @@ async function readSource(location, state, relative, target, received) {
   try {
     const stat = await handle.stat(); if (!stat.isFile()) fail('ENTROROVE_FILE_INVALID', 'budget source must be a regular file');
     await assertDescriptorTarget(target, actualTarget, stat);
+    if (verifyReadTarget) await verifyReadTarget({ target: actualTarget, descriptor: stat });
     assertReadAllowed(state, relative, Math.ceil(stat.size / 4));
     const cap = state.enforced ? Math.max(0, (state.maxTokenEstimate - state.tokenEstimate) * 4) : Number.MAX_SAFE_INTEGER;
     const chunks = []; let size = 0;
@@ -131,7 +132,7 @@ export async function budgetReadBuffer(input, options = {}) {
       if (state.grant?.purpose === 'handoff-read') requireLiveBudget(budgetHandoffReadValidationState(state));
       else state = consumeBudgetRenewal({ state });
       const target = options.target ?? path.join(location.root, relative);
-      const content = await readSource(location, state, relative, target, received); const tokens = Math.ceil(content.length / 4);
+      const content = await readSource(location, state, relative, target, received, options.verifyReadTarget); const tokens = Math.ceil(content.length / 4);
       const updated = { ...state, files: state.files.includes(relative) ? state.files : [...state.files, relative], readCalls: state.readCalls + 1, tokenEstimate: state.tokenEstimate + tokens };
       const committed = await commitBudget(location, loaded, updated, 'budget-read', { path: relative, tokens, bytes: content.length,
         readId, renewedIntervals: (state.autoRenew?.renewalsUsed ?? 0) - (loaded.state.autoRenew?.renewalsUsed ?? 0), reason: state.autoRenew?.lastRenewalReason ?? null });

package/local-probe.mjs

@@ -50,7 +50,7 @@ async function handoffReadBudget(input) {
   const loaded = await loadBudget(await budgetLocation(binding));
   return loaded.state.enforced && loaded.state.grant?.purpose === 'handoff-read';
 }
-async function probeHandoffCandidate(input, root, candidate) {
+async function probeHandoffCandidate(input, root, candidate, signingOptions) {
   scopeBinding(input);
   const native = await import('./local-task-handoff-read-authority.mjs');
   const readHome = await native.assertTaskHandoffReadHome({ ...input, taskId: candidate.receiverTaskId, ownerId: candidate.ownerId });
@@ -67,13 +67,22 @@ async function probeHandoffCandidate(input, root, candidate) {
     preservedSnapshotDigest: null, preservedSnapshotId: null, currentSnapshotFresh: true,
     receiverOrigin: { flowId: candidate.flowId, taskId: candidate.receiverTaskId,
       scopeDigest: candidate.receiverOriginalScopeDigest, checkpointDigest: candidate.receiverCheckpointDigest,
-      acceptanceReceiptId: candidate.receiverAcceptanceReceiptId, sourceCopiesVerified: false } });
+      acceptanceReceiptId: candidate.receiverAcceptanceReceiptId, sourceCopiesVerified: false } }, signingOptions);
 }
-export async function probe(input) {
+function probeSigningOptions(options) {
+  if (!options || typeof options !== 'object' || Array.isArray(options)
+    || Object.keys(options).some(key => key !== 'maximumExpiresAt')
+    || options.maximumExpiresAt !== undefined && (!Number.isSafeInteger(options.maximumExpiresAt) || options.maximumExpiresAt < 1)) {
+    scopeFail('ENTROROVE_SCOPE_ATTESTATION_BINDING', 'Internal probe signing options require only a finite exact deadline');
+  }
+  return { maximumExpiresAt: options.maximumExpiresAt };
+}
+export async function probe(input, options = {}) {
+  const signingOptions = probeSigningOptions(options);
   rejectScopePrivileges(input);
   const root = await scopeRoot(input.repositoryRoot);
   const candidate = await verifiedScopeCandidate(input, root);
-  if (candidate && await handoffReadBudget(input)) return probeHandoffCandidate(input, root, candidate);
+  if (candidate && await handoffReadBudget(input)) return probeHandoffCandidate(input, root, candidate, signingOptions);
   const hasBinding = ['flowId', 'stepId', 'snapshotId'].some(field => input[field] !== undefined);
   const retained = hasBinding ? await retainedScope(input, root, true) : null;
   const fresh = !!candidate || (!!retained && retained.stepId !== input.stepId);
@@ -97,15 +106,15 @@ export async function probe(input) {
         classification: { ...result.classification, mode: candidate ? result.classification.mode : retained.mode }, requiredMode: result.classification.mode,
         originalBinding: { flowId: retained.flowId, stepId: retained.stepId, snapshotId: retained.originalSnapshot.snapshotId },
         snapshotDigest: result.facts.snapshotEvidence.snapshotDigest, preservedSnapshotDigest: retained.originalSnapshot.digest,
-        preservedSnapshotId: retained.originalSnapshot.snapshotId, currentSnapshotFresh: true });
+        preservedSnapshotId: retained.originalSnapshot.snapshotId, currentSnapshotFresh: true }, signingOptions);
     }
     const saved = await initializeScope(input, result.repositoryRoot, result.facts, result.classification);
     return attestScopeFacts(input, { ...result, revision: saved.state.revision, statePath: saved.statePath,
       classification: { ...result.classification, mode: saved.state.mode }, requiredMode: result.classification.mode,
       snapshotDigest: result.facts.snapshotEvidence.snapshotDigest, preservedSnapshotDigest: saved.state.originalSnapshot.digest,
-      preservedSnapshotId: saved.state.originalSnapshot.snapshotId, currentSnapshotFresh: true });
+      preservedSnapshotId: saved.state.originalSnapshot.snapshotId, currentSnapshotFresh: true }, signingOptions);
   }
-  return attestScopeFacts(input, result);
+  return attestScopeFacts(input, result, signingOptions);
 }
 function observationReassessment(input, result) {
   const previousMode = input.currentMode === undefined ? result.classification.mode : input.currentMode;

package/local-scope-build-data.mjs

@@ -0,0 +1,73 @@
+import path from 'node:path';
+import ts from 'typescript';
+import { protectedBuildRelativePath } from './local-scope-build-read.mjs';
+import { uniConditionalError } from './local-scope-uni-expressions.mjs';
+
+export const buildConfigurationNames = ['vite.config.js', 'vite.config.mjs', 'vite.config.cjs', 'vite.config.ts',
+  'vite.config.mts', 'vite.config.cts', 'vue.config.js', 'vue.config.cjs', 'webpack.config.js', 'webpack.config.cjs',
+  'webpack.config.mjs', 'webpack.config.ts', 'rollup.config.js', 'rollup.config.mjs', 'rollup.config.ts',
+  'babel.config.js', 'babel.config.cjs', 'babel.config.json', '.babelrc', '.babelrc.json', '.babelrc.js',
+  'next.config.js', 'next.config.mjs', 'next.config.ts', 'nuxt.config.js', 'nuxt.config.ts', 'svelte.config.js'];
+export function buildDataPath(base, value) {
+  if (typeof value !== 'string' || value.includes('\\') || value.includes('\0') || path.posix.isAbsolute(value)) {
+    throw Object.assign(new Error('Build data references require literal repository-relative paths'), { code: 'ENTROROVE_PATH_UNSAFE' });
+  }
+  const relative = path.posix.normalize(path.posix.join(base, value)).replace(/\/$/, '');
+  if (relative === '..' || relative.startsWith('../')) throw Object.assign(new Error('Build data references cannot escape the original repository'), { code: 'ENTROROVE_PATH_UNSAFE' });
+  if (protectedBuildRelativePath(relative)) throw uniConditionalError(relative, 0, 'Build data cannot read environment or private control values');
+  return relative;
+}
+export function buildScriptReferences(manifest, filename = 'package.json') {
+  const references = new Set(); let opaque = false;
+  for (const [name, command] of Object.entries(manifest.scripts ?? {})) {
+    if (typeof command !== 'string') throw uniConditionalError(filename, 0, 'Build package scripts require string commands');
+    const relevant = /^(?:dev|build)(?::|$)/.test(name) || /(?:^|\s)(?:--(?:experimental-loader|loader|require|import)(?:=|\s)|-r\s)/.test(command);
+    if (!relevant) continue;
+    opaque = true;
+    // Literal references are data only, with no shell, cwd or execution claim.
+    if (/[$`\n\r|<>;]/.test(command) || /(?:^|&&)\s*cd\s/.test(command)) continue;
+    for (const segment of command.split('&&')) {
+      const words = segment.match(/"[^"]*"|'[^']*'|[^\s]+/g)?.map(word => /^['"]/.test(word) ? word.slice(1, -1) : word) ?? [];
+      let cursor = words[0] === 'cross-env' ? 1 : 0;
+      while (/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[cursor] ?? '')) cursor++;
+      if (words[cursor] === 'node' && words[cursor + 1] && !words[cursor + 1].startsWith('-')) references.add(words[cursor + 1]);
+      for (let index = cursor + 1; index < words.length; index++) {
+        if (['--config', '-c', '--experimental-loader', '--loader', '--require', '--import', '-r'].includes(words[index]) && words[index + 1]) references.add(words[++index]);
+        else if (/^--(?:config|experimental-loader|loader|require|import)=/.test(words[index])) references.add(words[index].slice(words[index].indexOf('=') + 1));
+      }
+    }
+  }
+  return { opaque, references: [...references].sort() };
+}
+export function buildModuleData(source, filename) {
+  let ast;
+  try { ast = ts.createSourceFile(filename, source, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS); }
+  catch (error) { if (!(error instanceof RangeError)) throw error; throw Object.assign(uniConditionalError(filename, 0, 'Build data syntax exceeds its parser bound'), { code: 'ENTROROVE_SCOPE_LIMIT' }); }
+  const references = new Set(); let nodes = 0;
+  const inspect = node => {
+    if (++nodes > 8192) throw Object.assign(uniConditionalError(filename, 0, 'Build data syntax exceeds its 8192-node bound'), { code: 'ENTROROVE_SCOPE_LIMIT' });
+    if ((ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) && node.moduleSpecifier && ts.isStringLiteralLike(node.moduleSpecifier)) references.add(node.moduleSpecifier.text);
+    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && node.expression.text === 'require'
+      && node.arguments.length === 1 && ts.isStringLiteralLike(node.arguments[0])) references.add(node.arguments[0].text);
+    if (ts.isPropertyAssignment(node) && !ts.isComputedPropertyName(node.name) && ['loader', 'use'].includes(node.name.text)
+      && ts.isStringLiteralLike(node.initializer)) references.add(node.initializer.text);
+    // Function bodies remain opaque build code. Inspect module-level literal
+    // declarations without simulating callbacks or proving a runtime closure.
+    if (ts.isFunctionLike(node)) return;
+    ts.forEachChild(node, inspect);
+  };
+  inspect(ast);
+  const literalRoots = [];
+  for (const statement of ast.statements) {
+    let expression = ts.isExportAssignment(statement) ? statement.expression : ts.isExpressionStatement(statement)
+      && ts.isBinaryExpression(statement.expression) && statement.expression.left.getText(ast) === 'module.exports'
+      && statement.expression.operatorToken.kind === ts.SyntaxKind.EqualsToken ? statement.expression.right : undefined;
+    while (expression && (ts.isParenthesizedExpression(expression) || ts.isAsExpression(expression) || ts.isSatisfiesExpression(expression))) expression = expression.expression;
+    if (!expression || !ts.isObjectLiteralExpression(expression)) continue;
+    const literal = Object.create(null);
+    for (const property of expression.properties) if (ts.isPropertyAssignment(property) && !ts.isComputedPropertyName(property.name)
+      && ['root', 'envDir', 'context'].includes(property.name.text) && ts.isStringLiteralLike(property.initializer)) literal[property.name.text] = property.initializer.text;
+    literalRoots.push(literal);
+  }
+  return { references: [...references].filter(value => value.startsWith('.')).sort(), literalRoots };
+}

package/local-scope-build-facts.mjs

@@ -0,0 +1,33 @@
+import { packageBoundary, scopeFail, scopePath, scopeBuildSourceRead } from './local-scope-files.mjs';
+
+// Opaque build programs are readonly origins. They never replace source identities
+// or establish a complete compiled graph, and are never executed by inspection.
+export async function observeBuildFacts(root, proof, input, graph) {
+  if (!proof || !Array.isArray(proof.observations) || !Array.isArray(proof.unresolvedBuildSources)) {
+    scopeFail('ENTROROVE_IMPORT_INVALID', 'Build inspection requires explicit observed files and uncertainty origins');
+  }
+  for (const file of proof.observations) {
+    scopePath(file.path);
+    if (!/^[a-f0-9]{64}$/.test(file.sha256 ?? '')) scopeFail('ENTROROVE_IMPORT_INVALID', 'Build observation has no actual file hash');
+    const previous = graph.metadata.get(file.path);
+    if (previous && previous.sha256 !== file.sha256) scopeFail('ENTROROVE_SCOPE_CHANGED', 'Build metadata changed during source inspection');
+    graph.metadata.set(file.path, { path: file.path, sha256: file.sha256 });
+  }
+  for (const origin of proof.unresolvedBuildSources) {
+    const file = graph.metadata.get(origin.path);
+    if (!file || file.sha256 !== origin.sha256 || typeof origin.reason !== 'string' || !/^[a-z][a-z-]{0,95}$/.test(origin.reason)) {
+      scopeFail('ENTROROVE_IMPORT_INVALID', 'Opaque build origin must match an actual readonly file observation');
+    }
+    if (!graph.visited.has(file.path)) {
+      if (graph.visited.size >= 1000) scopeFail('ENTROROVE_SCOPE_LIMIT', 'import graph exceeds the 1000-file inspection bound');
+      const boundary = await packageBoundary(root, file.path, input, scopeBuildSourceRead);
+      graph.visited.set(file.path, { ...file, module: boundary.path, boundary });
+    }
+    if (graph.visited.get(file.path).sha256 !== file.sha256) scopeFail('ENTROROVE_SCOPE_CHANGED', 'Opaque build origin differs from its actual source node');
+    if (graph.dynamicSources.some(item => item.path === file.path)) continue;
+    graph.dynamicSources.push(file);
+    graph.unresolvedImports.push({ path: file.path, line: 1, column: 1, reason: origin.reason,
+      message: 'Build behavior remains unproven; this origin is read-only and source projection grants no compiled dependency guarantee' });
+  }
+  return proof.unresolvedBuildSources.length > 0;
+}

package/local-scope-build-io.mjs

@@ -0,0 +1,57 @@
+import { promises as fs } from 'node:fs';
+import { scopeFail, scopeProbeTarget, scopeTarget } from './local-scope-files.mjs';
+import { isProtectedBuildPath, protectedBuildRelativePath as protectedPath } from './local-scope-build-read.mjs';
+
+const dependency = relative => relative.split('/').includes('node_modules');
+
+// Inspect names and physical destinations before a build helper can read bytes.
+// A dependency symlink is never permission to read an environment/control file.
+export function createScopeBuildIO(root, readMetadata, hashMetadata) {
+  const protectedDestination = actual => isProtectedBuildPath(root, actual);
+  const probe = async relative => {
+    if (relative === '.') return { exists: true, file: false, directory: true };
+    const target = await scopeProbeTarget(root, relative, dependency(relative));
+    return { exists: target.exists, file: Boolean(target.stat?.isFile()), directory: Boolean(target.stat?.isDirectory()) };
+  };
+  const readTarget = async (relative, operation) => {
+    if (protectedPath(relative)) scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'Build inspection cannot read environment or control files');
+    const target = await scopeProbeTarget(root, relative, dependency(relative));
+    if (target.exists && protectedDestination(await fs.realpath(target.target))) {
+      scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'Build dependency resolves to an environment or control file; values were not read');
+    }
+    return operation(relative);
+  };
+  const read = relative => readTarget(relative, readMetadata);
+  const inspectDirectory = async (relative, maximumEntries) => {
+    if (protectedPath(relative)) scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'Build inspection cannot enter a private control directory');
+    const target = relative === '.' ? root : (await scopeTarget(root, relative)).target;
+    const before = await fs.lstat(target), realPath = await fs.realpath(target);
+    if (!before.isDirectory() || before.isSymbolicLink() || protectedDestination(realPath)) {
+      scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'Build directory must be a real non-private directory');
+    }
+    const identity = { dev: before.dev, ino: before.ino, mode: before.mode & 0o777, realPath };
+    const verify = async () => {
+      const current = await fs.lstat(target), actual = await fs.realpath(target);
+      if (!current.isDirectory() || current.isSymbolicLink() || current.dev !== identity.dev || current.ino !== identity.ino
+        || (current.mode & 0o777) !== identity.mode || actual !== realPath || protectedDestination(actual)) {
+        scopeFail('ENTROROVE_SCOPE_CHANGED', 'Build directory identity changed during name observation');
+      }
+    };
+    await verify();
+    const directory = await fs.opendir(target), environmentFiles = [], children = []; let entries = 0;
+    let iterating = false;
+    try {
+      await verify(); iterating = true;
+      for await (const entry of directory) {
+        if (++entries > maximumEntries) scopeFail('ENTROROVE_SCOPE_LIMIT', 'Conditional build directory exceeds its bounded entry inspection');
+        if (entry.name === '.env' || entry.name.startsWith('.env.')) environmentFiles.push(entry.name);
+        children.push({ name: entry.name, kind: entry.isSymbolicLink() ? 'symlink' : entry.isDirectory() ? 'directory'
+          : entry.isFile() ? 'file' : 'unsupported' });
+      }
+    } finally { if (!iterating) await directory.close(); }
+    await verify();
+    children.sort((left, right) => left.name.localeCompare(right.name));
+    return { environmentFiles: environmentFiles.sort(), entries, children, identity };
+  };
+  return { read, probe, inspectDirectory, ...(hashMetadata ? { hashMetadata: relative => readTarget(relative, hashMetadata) } : {}) };
+}

package/local-scope-build-read.mjs

@@ -0,0 +1,22 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+export const protectedBuildRelativePath = value => value.split(/[\\/]/).some(part => part === '.env' || part.startsWith('.env.')
+  || ['.git', '.entrorove', '.aimlock', '.archguard', '.ssh', '.aws', '.gnupg', '.kube', '.azure',
+    '.codex', '.claude', '.agents', '.npmrc', '.netrc', '.pypirc', '.gitconfig', 'id_rsa', 'id_ed25519'].includes(part)
+  || /\.(?:pem|key)$/i.test(part));
+export function isProtectedBuildPath(root, actual) {
+  const relative = path.relative(root, actual);
+  return protectedBuildRelativePath(relative === '..' || relative.startsWith(`..${path.sep}`) ? actual : relative);
+}
+export async function assertBuildReadTarget(root, relative, target, descriptor) {
+  if (protectedBuildRelativePath(relative) || isProtectedBuildPath(root, target)) {
+    throw Object.assign(new Error('Build dependency resolves to an environment or control file; values were not read'),
+      { code: 'ENTROROVE_IMPORT_UNSUPPORTED' });
+  }
+  const actual = await fs.stat(target);
+  if (!actual.isFile() || actual.dev !== descriptor.dev || actual.ino !== descriptor.ino) {
+    throw Object.assign(new Error('Build dependency destination changed before reading any source bytes'),
+      { code: 'ENTROROVE_SCOPE_CHANGED' });
+  }
+}

package/local-scope-build-readset.mjs

@@ -0,0 +1,49 @@
+import { uniConditionalError } from './local-scope-uni-expressions.mjs';
+import { buildDataPath } from './local-scope-build-data.mjs';
+import { sha256 } from './local-integrity.mjs';
+
+const absent = error => ['ENOENT', 'ENOTDIR'].includes(error.code);
+const changed = path => Object.assign(uniConditionalError(path, 0, 'Build data or candidate absence changed during inspection'), { code: 'ENTROROVE_SCOPE_CHANGED' });
+const shape = value => value ? { entries: value.entries, environmentFiles: [...value.environmentFiles].sort(),
+  ...(value.identity ? { identity: { ...value.identity } } : {}),
+  ...(value.children ? { children: value.children.map(({ name, kind }) => ({ name, kind })).sort((a, b) => a.name.localeCompare(b.name)) } : {}) } : null;
+export function createBuildDataReadset(read, inspectDirectory) {
+  const files = new Map(), directories = new Map(); let bytes = 0, entries = 0;
+  const observe = async relative => {
+    buildDataPath('.', relative); if (files.has(relative)) return files.get(relative);
+    if (files.size >= 2048) throw uniConditionalError(relative, 0, 'Build data exceeds its 2048-path inspection bound');
+    let item; try { item = await read(relative); } catch (error) { if (!absent(error)) throw error; }
+    if (item) {
+      const content = Buffer.from(item.contentBase64, 'base64'), size = content.length;
+      if (size > 1_048_576 || bytes + size > 8_388_608) throw Object.assign(uniConditionalError(relative, 0, 'Build data exceeds its 1-MiB/file or 8-MiB bound'), { code: 'ENTROROVE_SCOPE_LIMIT' });
+      if (item.path !== relative || !/^[a-f0-9]{64}$/.test(item.sha256) || item.sha256 !== sha256(content)) throw uniConditionalError(relative, 0, 'Build data observation has no actual path and hash');
+      bytes += size;
+    }
+    files.set(relative, item ?? null); return item ?? null;
+  };
+  const directory = async relative => {
+    if (relative !== '.') buildDataPath('.', relative);
+    if (directories.has(relative)) return directories.get(relative);
+    if (directories.size >= 128 || typeof inspectDirectory !== 'function') throw uniConditionalError(relative, 0, 'Build directory absence requires bounded actual inspection');
+    let value; try { value = await inspectDirectory(relative, Math.min(8192, 32768 - entries)); } catch (error) { if (!absent(error)) throw error; }
+    if (value) {
+      if (!Number.isInteger(value.entries) || value.entries < 0 || !Array.isArray(value.environmentFiles)
+        || value.entries > 8192 || entries + value.entries > 32768) throw Object.assign(uniConditionalError(relative, 0, 'Build directory exceeds its bounded name inspection'), { code: 'ENTROROVE_SCOPE_LIMIT' });
+      entries += value.entries;
+    }
+    const result = shape(value); directories.set(relative, result); return result;
+  };
+  const verify = async () => {
+    for (const [relative, expected] of files) {
+      let actual; try { actual = await read(relative); } catch (error) { if (!absent(error)) throw error; }
+      if ((actual?.sha256 ?? null) !== (expected?.sha256 ?? null) || actual?.realPath !== expected?.realPath
+        || actual?.mode !== expected?.mode || JSON.stringify(actual?.referenceRoot) !== JSON.stringify(expected?.referenceRoot)) throw changed(relative);
+    }
+    let checked = 0;
+    for (const [relative, expected] of directories) {
+      let actual; try { actual = await inspectDirectory(relative, Math.min(8192, 32768 - checked)); } catch (error) { if (!absent(error)) throw error; }
+      checked += actual?.entries ?? 0; if (JSON.stringify(shape(actual)) !== JSON.stringify(expected)) throw changed(relative);
+    }
+  };
+  return { observe, directory, verify, get observations() { return [...files.values()].filter(Boolean).map(({ path, sha256 }) => ({ path, sha256 })).sort((a, b) => a.path.localeCompare(b.path)); } };
+}

package/local-scope-files.mjs

@@ -5,6 +5,7 @@ import { readBudgetedProjectFile } from './local-budget-reads.mjs';
 import { verifiedSfnt } from './local-scope-font.mjs';
 import { verifiedZip } from './local-scope-zip.mjs';
 import { observeScopeAbsence, observeScopeRead, observeScopeTarget } from './local-scope-read-set.mjs';
+import { assertBuildReadTarget, protectedBuildRelativePath } from './local-scope-build-read.mjs';
 
 export function scopeFail(code, message) { throw Object.assign(new Error(message), { code }); }
 export function observedScopeRisk(files) {
@@ -100,7 +101,7 @@ export async function scopeProbeTarget(root, relative, allowDependency = false)
     return { target: path.join(root, relative), exists: false, stat: null };
   }
 }
-async function safeScopeRead(root, relative, input, allowDependency = true) {
+async function safeScopeRead(root, relative, input, allowDependency = true, verifyReadTarget) {
   const dependency = allowDependency && dependencyReference(relative), target = await scopeTarget(root, relative, false, dependency);
   if (!target.stat.isFile()) await invalidScopeTarget(root, relative, target.target, 'not-regular-file');
   if (target.stat.size > 16_777_216) scopeFail('ENTROROVE_SCOPE_LIMIT', 'scope source exceeds the 16 MiB inspection bound');
@@ -108,7 +109,15 @@ async function safeScopeRead(root, relative, input, allowDependency = true) {
   try {
     const before = await handle.stat();
     const beforeReal = dependency ? await fs.realpath(target.target) : null;
-    const content = input ? await readBudgetedProjectFile(input, target.target, { sourcePath: relative }) : await handle.readFile();
+    if (verifyReadTarget) {
+      if (before.ino !== target.stat.ino || before.dev !== target.stat.dev) scopeFail('ENTROROVE_SCOPE_CHANGED', 'Build source changed before its descriptor was opened');
+      await verifyReadTarget({ target: beforeReal ?? target.target, descriptor: before });
+    }
+    const boundedVerify = verifyReadTarget ? async actual => {
+      if (actual.descriptor.ino !== before.ino || actual.descriptor.dev !== before.dev) scopeFail('ENTROROVE_SCOPE_CHANGED', 'Build source changed before its accounted descriptor was opened');
+      await verifyReadTarget(actual);
+    } : undefined;
+    const content = input ? await readBudgetedProjectFile(input, target.target, { sourcePath: relative, verifyReadTarget: boundedVerify }) : await handle.readFile();
     const after = await handle.stat();
     const latest = dependency ? await fs.stat(target.target) : await fs.lstat(target.target);
     const afterReal = dependency ? await fs.realpath(target.target) : null;
@@ -118,13 +127,17 @@ async function safeScopeRead(root, relative, input, allowDependency = true) {
     await scopeTarget(root, relative, false, dependency);
     const digest = sha256(content);
     observeScopeRead(root, relative, { sha256: digest, mode: after.mode & 0o777, realPath: afterReal ?? target.target }, async () => {
-      const actual = await safeScopeRead(root, relative, input, allowDependency);
+      const actual = await safeScopeRead(root, relative, input, allowDependency, verifyReadTarget);
       return { sha256: actual.sha256, mode: actual.mode, realPath: await fs.realpath(target.target) };
     });
     return { content, mode: after.mode & 0o777, sha256: digest, bytes: content.length };
   } finally { await handle.close(); }
 }
 export const scopeRead = (root, relative, input = { repositoryRoot: root }) => safeScopeRead(root, relative, input, true);
+export function scopeBuildSourceRead(root, relative, input = { repositoryRoot: root }) {
+  if (protectedBuildRelativePath(relative)) scopeFail('ENTROROVE_IMPORT_UNSUPPORTED', 'Build inspection cannot read environment or credential values');
+  return safeScopeRead(root, relative, input, true, ({ target, descriptor }) => assertBuildReadTarget(root, relative, target, descriptor));
+}
 // Internal control roles only: signed manifest metadata and already validated private signer files.
 export const scopeControlRead = (root, relative) => safeScopeRead(root, relative, null, false);
 const excluded = new Set(['.git', 'node_modules', '.entrorove', '.aimlock', '.archguard']);
@@ -152,12 +165,12 @@ export function lineCount(content) {
   if (!content.length || verifiedSfnt(content) || verifiedZip(content)) return 0;
   return content.toString('utf8').split(/\r\n|\n|\r/).length - (/[\r\n]$/.test(content.toString('utf8')) ? 1 : 0);
 }
-export async function packageBoundary(root, relative, input = { repositoryRoot: root }) {
+export async function packageBoundary(root, relative, input = { repositoryRoot: root }, readSource = scopeRead) {
   let directory = path.posix.dirname(relative);
   while (true) {
     const manifestPath = directory === '.' ? 'package.json' : `${directory}/package.json`;
     try {
-      const read = await scopeRead(root, manifestPath, input); let manifest;
+      const read = await readSource(root, manifestPath, input); let manifest;
       try { manifest = JSON.parse(read.content.toString('utf8')); } catch { scopeFail('ENTROROVE_PACKAGE_INVALID', 'package manifest is not valid JSON'); }
       return { path: directory, manifestPath, manifestDigest: read.sha256, name: typeof manifest.name === 'string' ? manifest.name : null };
     } catch (error) { if (error.code !== 'ENOENT') throw error; }
@@ -166,11 +179,11 @@ export async function packageBoundary(root, relative, input = { repositoryRoot:
   }
   return { path: relative.includes('/') ? relative.split('/')[0] : '.', manifestPath: null, manifestDigest: null, name: null };
 }
-export async function stableScope(root, files, input = { repositoryRoot: root }) {
+export async function stableScope(root, files, input = { repositoryRoot: root }, readSource = scopeRead) {
   for (const file of files) {
     if (file.exists === false) {
       if ((await scopeTarget(root, file.path, true)).exists) scopeFail('ENTROROVE_SCOPE_CHANGED', 'a deleted target reappeared during inspection');
-    } else if ((await scopeRead(root, file.path, input)).sha256 !== file.sha256) scopeFail('ENTROROVE_SCOPE_CHANGED', 'scope files changed before the observation completed');
+    } else if ((await readSource(root, file.path, input)).sha256 !== file.sha256) scopeFail('ENTROROVE_SCOPE_CHANGED', 'scope files changed before the observation completed');
   }
 }
 export const scopeDigest = value => sha256(canonical(value));