@entrorove/skill 0.1.71 → 0.1.78

package/scope-amendment-client.mjs

@@ -1,3 +1,4 @@
+import { prerequisiteFields } from './service-prerequisite.mjs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { canonical, sha256 } from './local-integrity.mjs';
@@ -9,17 +10,67 @@ import { scopeAmendmentLocation, readScopeAmendmentState, saveScopeAmendmentStat
 import { amendmentRemote, scopeAmendmentStatus } from './scope-amendment-remote.mjs';
 import { observeScopeAmendment } from './scope-amendment-observer.mjs';
 import { retainScopeAmendmentReference } from './scope-amendment-reference.mjs';
+import { saveLocalScopeEvidence, ensureScopeEvidence, validateAppliedEvidence } from './scope-evidence-remote.mjs';
+import { consumeRecovery, recoveryFailureFields } from './local-recovery-budget.mjs';
 
 const schemaVersion = 'entrorove.scope-amendment-connection/1.0';
+const submissionFields = ['evidencePending', 'evidenceDescriptor', 'evidencePrepared', 'evidenceSignature',
+  'attestation', 'attestationDigest', 'attestationRef', 'evidenceResult', 'applied', 'rejection'];
+const signingChallenge = state => (state.signingChallenge ?? state.challenged).challenge;
+function sameChallenge(value, original, location, attemptId, options) {
+  const fresh = scopeAmendmentChallenge(value, location, options);
+  const changing = new Set(['authorityReceipt', 'attemptId', 'challengeId', 'challenge', 'issuedAt', 'expiresAt']);
+  const immutable = challenge => Object.fromEntries(Object.entries(challenge).filter(([field]) => !changing.has(field)));
+  if (canonical(immutable(fresh)) !== canonical(immutable(original)) || fresh.attemptId !== attemptId
+    || fresh.challenge === original.challenge || fresh.challengeId === original.challengeId) {
+    amendmentFail('Fresh amendment challenge changed its original task, signer, step, roles or authority head');
+  }
+  return fresh;
+}
+async function archiveSigningObservation(location, state) {
+  const checksum = sha256(canonical(state)), archive = path.join(location.directory, `${state.attemptId}-${checksum}.json`);
+  try { if (canonical(await readMutationJson14(archive)) !== canonical(state)) amendmentFail('Original signing observation history changed'); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; await atomicMutationJson14(archive, state, { privateFrom: location.stateRoot }); }
+  return checksum;
+}
+export async function renewScopeAmendmentChallenge(location, state, remote) {
+  if (submissionFields.some(field => Object.hasOwn(state, field)) || canonical(state.identity) !== canonical(location.identity)
+    || state.snapshotStarted !== true || !state.snapshot || state.snapshot.snapshotId !== state.snapshotId
+    || state.snapshot.flowId !== location.identity.flowId || state.snapshot.contractDigest !== location.identity.proposalDigest) {
+    amendmentFail('Fresh amendment challenge requires the same verified snapshot before any signed evidence or application');
+  }
+  const original = scopeAmendmentChallenge(state.challenged?.challenge, location, { allowExpired: true });
+  if (state.snapshot.stepId !== original.stepId) amendmentFail('Amendment snapshot replaced its original challenge step');
+  if (state.pending && (state.pending.stage !== 'signingChallenge' || !state.signingAttemptId)) {
+    amendmentFail('Recover the original pending amendment request before signing challenge renewal');
+  }
+  const retained = state.signingChallenge && sameChallenge(state.signingChallenge.challenge, original, location,
+    state.signingAttemptId, { allowExpired: true });
+  if (!state.pending && retained && Date.parse(retained.expiresAt) > Date.now()) {
+    return retained;
+  }
+  if (!state.pending && (!state.signingAttemptId || state.signingChallenge)) {
+    const archivedDigest = await archiveSigningObservation(location, state);
+    consumeRecovery(state, 'signing', state.signingAttemptId ?? state.attemptId);
+    delete state.signingChallenge; state.signingAttemptId = randomUUID();
+    state.signingRecovery = { archivedDigest, snapshotId: state.snapshotId, requiresSnapshotVerification: true,
+      grantsExecutionAuthority: false, recoveredAt: new Date().toISOString() };
+    await saveScopeAmendmentState(location, state);
+  }
+  const issued = await remote('signingChallenge', 'workflow-scope-challenge', { proposalId: location.identity.proposalId,
+    proposalDigest: location.identity.proposalDigest, receiverId: location.binding.runnerId, attemptId: state.signingAttemptId });
+  return sameChallenge(issued.challenge, original, location, state.signingAttemptId);
+}
 function validateProposal(status, input) {
   const proposal = status.proposal;
   if (!proposal || proposal.proposalId !== input.proposalId || proposal.proposalDigest !== input.proposalDigest
     || !['pending', 'approved', 'declined'].includes(proposal.approval)) amendmentFail('Current account has no matching original scope proposal');
   return proposal;
 }
-function validateApplied(output, state, location) {
-  const effective = output.effectiveAuthority, record = scopeRevisionAuthority(effective?.record, 'entrorove.scope-revision-authority/1.0');
-  const challenge = scopeAmendmentChallenge(state.challenged.challenge, location, { allowExpired: true }), refresh = challenge.purpose === 'scope-revision-refresh';
+async function validateApplied(output, state, location) {
+  const effective = output.effectiveAuthority, version = effective?.record?.schemaVersion === 'entrorove.scope-revision-authority/2.0' ? '2.0' : '1.0';
+  const record = scopeRevisionAuthority(effective?.record, `entrorove.scope-revision-authority/${version}`);
+  const challenge = scopeAmendmentChallenge(signingChallenge(state), location, { allowExpired: true }), refresh = challenge.purpose === 'scope-revision-refresh';
   if (output.status !== 'succeeded' || output.grantsExecutionAuthority !== false || output.claimsCompletion !== false
     || output.scopeRevisionDigest !== sha256(canonical(record)) || effective.revisionDigest !== output.scopeRevisionDigest
     || output.revision !== effective.revision || record.revision !== effective.revision
@@ -30,21 +81,26 @@ function validateApplied(output, state, location) {
     || canonical(record.files.map(file => ({ ...file, sha256: null }))) !== canonical(challenge.files.map(file => ({ ...file, sha256: null })))) {
     amendmentFail('Applied scope amendment lost its signed original authority or exact roles');
   }
-  const fact = refresh ? scopeRevisionAuthority(effective.fact, 'entrorove.scope-revision-facts/1.0') : record;
+  const factVersion = effective?.fact?.schemaVersion === 'entrorove.scope-revision-facts/2.0' ? '2.0' : '1.0';
+  const fact = refresh ? scopeRevisionAuthority(effective.fact, `entrorove.scope-revision-facts/${factVersion}`) : record;
+  const compact = fact.schemaVersion.endsWith('/2.0');
+  const attestation = compact ? await validateAppliedEvidence(fact, state, location, challenge,
+    refresh ? 'scope-refresh' : 'scope-revision') : state.attestation;
   if (refresh && (fact.scopeRevisionDigest !== output.scopeRevisionDigest || fact.factRevision !== challenge.expectedFactRevision
     || ['flowId', 'ownerId', 'taskDigest', 'chainDigest'].some(field => fact[field] !== challenge[field]))
-    || canonical(fact.candidateAttestation) !== canonical(state.attestation)
-    || fact.scope?.attestationDigest !== sha256(canonical(state.attestation.scopeAttestation))
+    || !compact && canonical(fact.candidateAttestation) !== canonical(attestation)
+    || fact.scope?.attestationDigest !== sha256(canonical(attestation.scopeAttestation))
+    || compact && effective.candidateAttestationDigest !== sha256(canonical(attestation))
     || effective.factRevision !== (refresh ? fact.factRevision : 0) || output.factRevision !== effective.factRevision) {
     amendmentFail('Applied scope proof differs from this exact actual signed candidate');
   }
   return { schemaVersion, status: 'succeeded', flowId: challenge.flowId, proposalId: challenge.proposalId,
     proposalDigest: challenge.proposalDigest, scopeRevisionDigest: output.scopeRevisionDigest, revision: output.revision,
     factRevision: effective.factRevision, grantsExecutionAuthority: false, claimsCompletion: false,
-    ...(refresh && state.attestation.memberMutation ? { localAction: {
+    ...(refresh && attestation.memberMutation ? { localAction: {
       command: 'npx @entrorove/skill mutation-settle <absolute repositoryRoot>', input: {
-        flowId: challenge.flowId, taskId: state.attestation.memberMutation.consumptionReceipt.taskId,
-        stepId: state.attestation.memberMutation.consumptionReceipt.stepId, gatePassPath: location.identity.gatePassPath } } } : {}),
+        flowId: challenge.flowId, taskId: attestation.memberMutation.consumptionReceipt.taskId,
+        stepId: attestation.memberMutation.consumptionReceipt.stepId, gatePassPath: location.identity.gatePassPath } } } : {}),
     nextStep: output.nextStep, ...(state.feedback ? { feedback: state.feedback } : {}) };
 }
 async function archiveAttempt(location, state) {
@@ -52,27 +108,36 @@ async function archiveAttempt(location, state) {
   const archive = path.join(location.directory, `${state.attemptId}.json`);
   try { if (canonical(await readMutationJson14(archive)) !== canonical(state)) amendmentFail('Original scope amendment attempt history changed'); }
   catch (error) { if (error.code !== 'ENOENT') throw error; await atomicMutationJson14(archive, state, { privateFrom: location.stateRoot }); }
-  for (const key of Object.keys(state)) if (!['schemaVersion', 'identity'].includes(key)) delete state[key];
+  if (!state.applied) consumeRecovery(state, 'attempt', state.attemptId);
+  const completed = Boolean(state.applied);
+  for (const key of Object.keys(state)) if (!['schemaVersion', 'identity', ...(completed ? [] : ['recovery'])].includes(key)) delete state[key];
   await saveScopeAmendmentState(location, state);
 }
 async function finish(location, state, dependencies) {
-  if (!state.attestation) {
-    state.attestation = await observeScopeAmendment(location, state);
-    state.attestationDigest = sha256(canonical(state.attestation)); await saveScopeAmendmentState(location, state);
+  if (!state.evidenceDescriptor && !state.applied) {
+    const attestation = state.attestation ?? await observeScopeAmendment(location, state, {
+      beforeSign: () => renewScopeAmendmentChallenge(location, state,
+        (stage, operation, payload) => amendmentRemote(stage, operation, payload, state, location, dependencies)) });
+    const challenge = scopeAmendmentChallenge(signingChallenge(state), location, { allowExpired: true });
+    await saveLocalScopeEvidence(attestation, challenge.purpose === 'scope-revision-refresh' ? 'scope-refresh' : 'scope-revision',
+      challenge, state, location, saveScopeAmendmentState);
+  }
+  if (!state.applied) {
+    const attestationRef = await ensureScopeEvidence(state, location, dependencies, signingChallenge(state), saveScopeAmendmentState);
+    await amendmentRemote('applied', 'workflow-scope-apply', { proposalId: location.identity.proposalId,
+      proposalDigest: location.identity.proposalDigest, attestationRef }, state, location, dependencies);
   }
-  const applied = state.applied ?? await amendmentRemote('applied', 'workflow-scope-apply', {
-    proposalId: location.identity.proposalId, proposalDigest: location.identity.proposalDigest,
-    attestation: state.attestation }, state, location, dependencies);
-  const result = validateApplied(applied, state, location);
+  const applied = state.applied, result = await validateApplied(applied, state, location);
   await retainScopeAmendmentReference(location, applied); return result;
 }
 async function amend(location, dependencies) {
   const state = await readScopeAmendmentState(location);
+  if (state.evidencePending || state.pending?.operation === 'scope-evidence-prepare') return finish(location, state, dependencies);
   if (state.pending) {
     const pending = state.pending;
     await amendmentRemote(pending.stage, pending.input.operation, pending.input.payload, state, location, dependencies);
     if (pending.stage === 'applied') {
-      const result = validateApplied(state.applied, state, location);
+      const result = await validateApplied(state.applied, state, location);
       await retainScopeAmendmentReference(location, state.applied); return result;
     }
     return finish(location, state, dependencies);
@@ -84,7 +149,8 @@ async function amend(location, dependencies) {
       requiresOriginalOwnerApproval: true, scopeExpansionAutomaticallyAuthorized: false } };
   if (state.challenged && !state.applied && !state.rejection) {
     const challenge = scopeAmendmentChallenge(state.challenged.challenge, location, { allowExpired: true });
-    if (Date.parse(challenge.expiresAt) > Date.now()) return finish(location, state, dependencies);
+    if (Date.parse(challenge.expiresAt) > Date.now() || state.snapshot && state.snapshotStarted === true
+      && !submissionFields.some(field => Object.hasOwn(state, field))) return finish(location, state, dependencies);
     state.rejection = { code: 'ENTROROVE_SCOPE_AMENDMENT_CHALLENGE_EXPIRED', effects: 'none',
       reason: 'signed-unused-challenge-expired-before-next-post' }; await saveScopeAmendmentState(location, state);
   }
@@ -95,7 +161,7 @@ async function amend(location, dependencies) {
   const challenge = scopeAmendmentChallenge(challenged.challenge, location);
   if (status.effective ? challenge.purpose !== 'scope-revision-refresh'
     || challenge.authorityRevisionDigest !== status.effective.revisionDigest || challenge.expectedFactRevision !== status.effective.factRevision + 1
-    || challenge.currentScopeArtifactDigest !== sha256(canonical(status.effective.scope))
+    || challenge.currentScopeArtifactDigest !== (status.effective.scopeArtifactDigest ?? sha256(canonical(status.effective.scope)))
     : challenge.purpose !== 'scope-revision' || challenge.expectedRevision !== proposal.expectedRevision
       || challenge.previousDigest !== proposal.previousDigest) amendmentFail('Scope amendment challenge has a different original authority head');
   return finish(location, state, dependencies);
@@ -111,13 +177,15 @@ export async function runScopeAmend(repositoryRoot, input, dependencies) {
   } catch (error) {
     const requestId = /^[a-f0-9]{64}$/.test(error?.requestId ?? '') ? error.requestId : undefined;
     return { schemaVersion, status: 'blocked', flowId: input?.flowId,
+      ...prerequisiteFields(error),
       code: error?.code?.startsWith('ENTROROVE_') ? error.code : 'ENTROROVE_SCOPE_AMENDMENT_PREREQUISITE',
       message: ['ENTROROVE_SCOPE_AMENDMENT_BINDING', 'ENTROROVE_SCOPE_AMENDMENT_STATE', 'ENTROROVE_SCOPE_AMENDMENT_UNKNOWN',
         'ENTROROVE_SCOPE_AMENDMENT_NOT_SENT', 'ENTROROVE_SCOPE_AMENDMENT_MUTATION_PENDING'].includes(error?.code) ? error.message
         : 'Scope amendment stopped; preserve the original proposal, signer, journal and actual evidence.',
-      ...(requestId ? { requestId } : {}), ...(error?.output ? { output: error.output } : {}),
+      ...(requestId ? { requestId } : {}), ...(error?.uploadId ? { uploadId: error.uploadId } : {}), ...(error?.output ? { output: error.output } : {}),
       ...(error?.feedback ? { feedback: error.feedback } : {}),
-      ...(error?.outcomeUnknown ? { outcomeUnknown: true, nextAction: { operation: 'scope-amend', requestId,
+      ...recoveryFailureFields(error),
+      ...(error?.outcomeUnknown ? { outcomeUnknown: true, nextAction: { operation: 'scope-amend', ...(requestId ? { requestId } : { uploadId: error.uploadId }),
         method: 'GET', reuseOriginalInput: true, repeatPost: false } } : {}) };
   }
 }

package/scope-amendment-observer.mjs

@@ -21,12 +21,14 @@ async function inspectFiles(location, challenge) {
     physical.add(identity);
   }
 }
-export async function observeScopeAmendment(location, state) {
-  const challenge = scopeAmendmentChallenge(state.challenged.challenge, location);
+export async function observeScopeAmendment(location, state, { beforeSign } = {}) {
+  const original = scopeAmendmentChallenge(state.challenged.challenge, location, { allowExpired: beforeSign !== undefined });
+  let challenge = original;
   await inspectFiles(location, challenge);
   if (!state.snapshotId) { state.snapshotId = `scope-amend-${randomUUID()}`; await saveScopeAmendmentState(location, state); }
   const input = { repositoryRoot: location.root, home: location.home, flowId: challenge.flowId, stepId: challenge.stepId,
     snapshotId: state.snapshotId, paths: challenge.files.map(file => file.path).sort(),
+    scopeWritePaths: challenge.files.filter(file => file.access !== 'read-only').map(file => file.path).sort(),
     contractDigest: challenge.proposalDigest, importContexts: location.contextAuthority?.record.importContexts ?? location.binding.importContexts,
     ...(location.contextAuthority ? { contextRevisionDigest: location.contextAuthority.revisionDigest,
       contextEvidence: location.contextAuthority.record.evidence } : {}),
@@ -56,7 +58,11 @@ export async function observeScopeAmendment(location, state) {
   const observed = await attestScopeFacts({ ...input, ownerId: challenge.ownerId, taskDigest: challenge.taskDigest,
     chainDigest: challenge.chainDigest, repositoryId: challenge.repositoryId, challenge: challenge.challenge,
     signerConfigPath: location.signerConfigPath }, { repositoryRoot: location.root, facts,
-    snapshotDigest: facts.snapshotEvidence.snapshotDigest }, { maximumExpiresAt: Date.parse(challenge.expiresAt) });
+    snapshotDigest: facts.snapshotEvidence.snapshotDigest }, { maximumExpiresAt: Date.parse(challenge.expiresAt),
+    ...(beforeSign === undefined ? {} : { beforeSign: async () => {
+      challenge = await beforeSign();
+      return { challenge: challenge.challenge, maximumExpiresAt: Date.parse(challenge.expiresAt) };
+    } }) });
   const memberMutation = await scopeAmendmentMutation(location, state, challenge, facts);
   const core = { schemaVersion: 'entrorove.scope-revision-attestation/1.0', purpose: challenge.purpose,
     proposalId: challenge.proposalId, proposalDigest: challenge.proposalDigest, expectedRevision: challenge.expectedRevision,

package/scope-amendment-reference.mjs

@@ -1,7 +1,10 @@
 import path from 'node:path';
 import { canonical, sha256 } from './local-integrity.mjs';
-import { mutationHome14, privateMutationDirectory14, readMutationJson14, atomicMutationJson14 } from './local-mutation-files.mjs';
+import { mutationHome14, mutationFile14, privateMutationDirectory14, readMutationJson14, atomicMutationJson14 } from './local-mutation-files.mjs';
 import { scopeRevisionAuthority, amendmentFail } from './scope-amendment-wire.mjs';
+import { readScopeEvidence } from './scope-evidence-local.mjs';
+import { evidenceReference } from './scope-evidence-wire.mjs';
+import { trustedOrigin } from './remote-transport.mjs';
 
 async function referenceLocation(root, home, flowId, revisionDigest) {
   const stateRoot = path.join(await mutationHome14(home), '.entrorove');
@@ -11,21 +14,36 @@ async function referenceLocation(root, home, flowId, revisionDigest) {
 export async function retainScopeAmendmentReference(location, output) {
   const effective = output.effectiveAuthority, target = await referenceLocation(location.root, location.home,
     location.identity.flowId, output.scopeRevisionDigest);
-  const value = { schemaVersion: 'entrorove.scope-amendment-reference/1.0', input: {
+  const compact = effective.record.schemaVersion === 'entrorove.scope-revision-authority/2.0';
+  if (compact) await readScopeEvidence(location, evidenceReference(effective.record.candidateAttestationRef, undefined, location));
+  const value = { schemaVersion: compact ? 'entrorove.scope-amendment-reference/2.0' : 'entrorove.scope-amendment-reference/1.0',
+    ...(compact ? { apiOrigin: location.apiOrigin } : {}), input: {
     flowId: location.identity.flowId, proposalId: location.identity.proposalId, proposalDigest: location.identity.proposalDigest }, record: effective.record };
   await privateMutationDirectory14(target.directory, { privateFrom: target.stateRoot });
   try { if (canonical(await readMutationJson14(target.file)) !== canonical(value)) amendmentFail('Scope amendment original authority reference changed'); }
   catch (error) { if (error.code !== 'ENOENT') throw error; await atomicMutationJson14(target.file, value, { privateFrom: target.stateRoot }); }
 }
+async function readReferenceEvidence(reference, input) {
+  const origin = trustedOrigin(reference.apiOrigin), stateRoot = path.join(await mutationHome14(input.home), '.entrorove');
+  const base = path.join(stateRoot, 'scope-runners', sha256(`${origin}:${reference.record.flowId}:${input.repositoryRoot}`));
+  const file = path.join(base, 'identity', 'binding.json'), item = await mutationFile14(file);
+  if (item.stat.size > 1_000_000 || item.stat.nlink !== 1) amendmentFail('Original amendment signer binding is invalid');
+  const binding = await readMutationJson14(file);
+  if (binding.repositoryRoot !== input.repositoryRoot || binding.apiOrigin !== origin || binding.flowId !== reference.record.flowId) amendmentFail('Original amendment signer binding changed');
+  const location = { base, binding };
+  await readScopeEvidence(location, evidenceReference(reference.record.candidateAttestationRef, undefined, location));
+}
 export async function scopeAmendmentRefreshAction(input, pass) {
   if (!pass.scopeRevisionDigest) return undefined;
   try {
     const target = await referenceLocation(input.repositoryRoot, input.home, pass.flowId, pass.scopeRevisionDigest);
     const reference = await readMutationJson14(target.file);
-    const record = scopeRevisionAuthority(reference.record, 'entrorove.scope-revision-authority/1.0');
-    if (reference.schemaVersion !== 'entrorove.scope-amendment-reference/1.0' || sha256(canonical(record)) !== pass.scopeRevisionDigest
+    const compact = reference.schemaVersion === 'entrorove.scope-amendment-reference/2.0';
+    const record = scopeRevisionAuthority(reference.record, `entrorove.scope-revision-authority/${compact ? '2.0' : '1.0'}`);
+    if (!['entrorove.scope-amendment-reference/1.0', 'entrorove.scope-amendment-reference/2.0'].includes(reference.schemaVersion) || sha256(canonical(record)) !== pass.scopeRevisionDigest
       || record.flowId !== pass.flowId || record.taskDigest !== pass.taskDigest || record.scope.keyId !== pass.memberScopeKeyId
       || ['flowId', 'proposalId', 'proposalDigest'].some(field => reference.input[field] !== record[field])) amendmentFail('Stored refresh reference has another original authority');
+    if (compact) await readReferenceEvidence(reference, input);
     return { command: 'npx @entrorove/skill scope-amend <absolute repositoryRoot>',
       input: { ...reference.input, gatePassPath: input.gatePassPath }, resumeOriginalFlow: true, requiredBefore: 'mutation-settle' };
   } catch {

package/scope-amendment-remote.mjs

@@ -7,6 +7,8 @@ import { readInvocations } from './local-invocations.mjs';
 import { saveScopeAmendmentState } from './scope-amendment-state.mjs';
 import { amendmentFail } from './scope-amendment-wire.mjs';
 import { retireMissingChallenge } from './scope-amendment-retirement.mjs';
+import { prerequisiteError, retainPrerequisite, retryKnownPrerequisite } from './service-prerequisite.mjs';
+import { consumeRecovery } from './local-recovery-budget.mjs';
 
 const unknown = requestId => Object.assign(new Error('Scope amendment outcome is unknown; recover the original request with GET only'),
   { code: 'ENTROROVE_SCOPE_AMENDMENT_UNKNOWN', outcomeUnknown: true, requestId });
@@ -16,6 +18,8 @@ async function recover(pending, dependencies) {
     const response = await requestTransport(origin, `/api/skill/status/${pending.requestId}`, {
       headers: { authorization: `Bearer ${token}`, ...ideClientHeaders() } });
     const result = parseTransportResponse(response, 'original scope amendment status');
+    const prerequisite = prerequisiteError(response, result, { requestId: pending.requestId });
+    if (prerequisite) throw Object.assign(unknown(pending.requestId), { servicePrerequisite: prerequisite.servicePrerequisite });
     if (response.status === 404 && result?.error === 'request-not-found') {
       throw Object.assign(unknown(pending.requestId), { requestNotFound: true });
     }
@@ -25,7 +29,8 @@ async function recover(pending, dependencies) {
     verifyAutomaticFeedback(result.feedback, pending.requestId, pending.requestId);
     result.feedback = await acknowledgeAutomaticFeedback(result.feedback, origin, token, ideClientHeaders());
     return { response, result };
-  } catch (error) { throw error?.requestNotFound ? error : unknown(pending.requestId); }
+  } catch (error) { throw error?.requestNotFound ? error : Object.assign(unknown(pending.requestId),
+    error?.servicePrerequisite ? { servicePrerequisite: error.servicePrerequisite } : {}); }
 }
 async function notSent(pending, home) {
   try {
@@ -36,10 +41,14 @@ async function notSent(pending, home) {
 export async function amendmentRemote(stage, operation, payload, state, location, dependencies) {
   const input = { flowId: location.identity.flowId, operation, payload }, requestId = buildInvocation('continue', input).requestId;
   let response, result;
-  if (state.pending) {
+  const existing = Boolean(state.pending);
+  if (existing) {
     if (state.pending.stage !== stage || state.pending.requestId !== requestId || canonical(state.pending.input) !== canonical(input)) {
       amendmentFail('Recover the original amendment request before another operation');
     }
+  }
+  if (existing && !await retryKnownPrerequisite(state, location, saveScopeAmendmentState)) {
+    consumeRecovery(state, 'status'); await saveScopeAmendmentState(location, state);
     if (state.challengeRetirement) await retireMissingChallenge(state, location, dependencies, recover, notSent);
     try { ({ response, result } = await recover(state.pending, dependencies)); }
     catch (error) {
@@ -48,16 +57,18 @@ export async function amendmentRemote(stage, operation, payload, state, location
       ({ response, result } = await recover(state.pending, dependencies));
     }
   } else {
-    state.pending = { stage, operation: 'continue', input, requestId };
-    await saveScopeAmendmentState(location, state);
+    if (!existing) { state.pending = { stage, operation: 'continue', input, requestId };
+      await saveScopeAmendmentState(location, state); }
     try { ({ response, result } = await invokeRemoteResult({ operation: 'continue', input }, dependencies)); }
     catch (error) {
+      if (await retainPrerequisite(error, state, location, saveScopeAmendmentState)) throw error;
       if (await notSent(state.pending, dependencies.home)) {
+        state.rejection = { code: 'ENTROROVE_SCOPE_AMENDMENT_NOT_SENT', effects: 'none', requestId };
         delete state.pending; await saveScopeAmendmentState(location, state);
         throw Object.assign(new Error('Scope amendment was not transmitted; repair its prerequisite and reuse the original input'),
           { code: 'ENTROROVE_SCOPE_AMENDMENT_NOT_SENT', knownBeforeTransmission: true, requestId });
       }
-      throw unknown(requestId);
+      throw Object.assign(unknown(requestId), error?.servicePrerequisite ? { servicePrerequisite: error.servicePrerequisite } : {});
     }
   }
   if (!result?.output || result.output.requestId !== requestId) throw unknown(requestId);
@@ -80,5 +91,8 @@ export async function scopeAmendmentStatus(flowId, dependencies) {
       input: { flowId, operation: 'workflow-scope-status', payload: {} } }, dependencies);
     if (!response.ok || result?.output?.status !== 'succeeded') throw new Error();
     return result.output.result ?? result.output;
-  } catch { amendmentFail('Current account cannot read its original live scope revision; no amendment mutation was sent'); }
+  } catch (error) {
+    if (error?.servicePrerequisite) throw error;
+    amendmentFail('Current account cannot read its original live scope revision; no amendment mutation was sent');
+  }
 }

package/scope-amendment-retirement.mjs

@@ -2,6 +2,7 @@ import { canonical, sha256 } from './local-integrity.mjs';
 import { buildInvocation, invokeRemoteResult } from './remote-client.mjs';
 import { scopeRevisionAuthority, amendmentFail } from './scope-amendment-wire.mjs';
 import { saveScopeAmendmentState } from './scope-amendment-state.mjs';
+import { retainPrerequisite, retryKnownPrerequisite } from './service-prerequisite.mjs';
 
 export async function retireMissingChallenge(state, location, dependencies, recover, notSent) {
   const original = state.pending;
@@ -14,14 +15,15 @@ export async function retireMissingChallenge(state, location, dependencies, reco
   if (attempt && (attempt.requestId !== call.requestId || canonical(attempt.input) !== canonical(input))) {
     amendmentFail('Challenge retirement must retain its original preparation envelope');
   }
-  if (!attempt) {
-    attempt = state.challengeRetirement = { requestId: call.requestId, input, state: 'pending' };
+  if (!attempt || await retryKnownPrerequisite(state, location, saveScopeAmendmentState, 'challengeRetirement')) {
+    if (!attempt) attempt = state.challengeRetirement = { requestId: call.requestId, input, state: 'pending' };
     await saveScopeAmendmentState(location, state);
     try {
       const { result } = await invokeRemoteResult({ operation: 'scope-challenge-retire', input }, dependencies);
       attempt.output = result.output; attempt.feedback = result.feedback; attempt.state = 'completed';
       await saveScopeAmendmentState(location, state);
     } catch (error) {
+      if (await retainPrerequisite(error, state, location, saveScopeAmendmentState, 'challengeRetirement')) throw error;
       if (await notSent(attempt, dependencies.home)) {
         attempt.state = 'not-sent'; await saveScopeAmendmentState(location, state);
       }

package/scope-amendment-state.mjs

@@ -10,17 +10,21 @@ import { trustedOrigin } from './remote-transport.mjs';
 import { boundScopeContexts } from './scope-context-state.mjs';
 
 const fail = message => scopeFail('ENTROROVE_SCOPE_AMENDMENT_STATE', message);
-const maximumStateBytes = 1_000_000;
+const maximumControlBytes = 1_000_000;
+// Retained scope combines original facts and verified history, not a single
+// signing control. Keep its aggregate bound separate from key/config files.
+const maximumRetainedScopeBytes = 8_000_000;
 // A journal retains the challenge, S proof, original pending request and full
 // signed response together. Each signed authority retains its own 1 MB bound.
 const maximumJournalBytes = 8_000_000;
-async function privateItem(file, final = 'file', maximumBytes = maximumStateBytes) {
+async function privateItem(file, final = 'file', maximumBytes = maximumControlBytes) {
   const value = await mutationFile14(file, { final });
   if (process.getuid && value.stat.uid !== process.getuid()
     || process.platform !== 'win32' && value.stat.mode & 0o077
-    || final === 'file' && (value.stat.nlink !== 1 || value.stat.size > maximumBytes)) {
-    fail('Scope amendment controls must be bounded private files owned by the current OS account');
+    || final === 'file' && value.stat.nlink !== 1) {
+    fail('Scope amendment controls must be private single-link files owned by the current OS account');
   }
+  if (final === 'file' && value.stat.size > maximumBytes) fail(`Scope amendment file exceeds the ${maximumBytes} byte limit`);
   return value;
 }
 async function privateText(file) {
@@ -68,7 +72,7 @@ export async function scopeAmendmentLocation(repositoryRoot, input, dependencies
   if (key.asymmetricKeyType !== 'ed25519' || der.toString('base64') !== binding.publicKey
     || sha256(der) !== binding.keyId) fail('Original scope signing identity changed');
   const originalStatePath = path.join(stateRoot, 'scope', sha256(root).slice(0, 32), input.flowId, 'state.json');
-  await privateItem(originalStatePath);
+  await privateItem(originalStatePath, 'file', maximumRetainedScopeBytes);
   const saved = await readMutationJson14(originalStatePath);
   const original = await retainedScope({ repositoryRoot: root, home, flowId: input.flowId,
     stepId: saved.stepId, snapshotId: saved.originalSnapshot?.snapshotId }, root);
@@ -80,7 +84,7 @@ export async function scopeAmendmentLocation(repositoryRoot, input, dependencies
   const directory = path.join(base, 'amendments', sha256(canonical(input)));
   await privateMutationDirectory14(directory, { privateFrom: stateRoot });
   const contextAuthority = await boundScopeContexts(base, binding, dependencies);
-  return { root, home, stateRoot, directory, file: path.join(directory, 'journal.json'), identity,
+  return { root, home, apiOrigin, base, stateRoot, directory, file: path.join(directory, 'journal.json'), identity,
     binding, key, signerConfigPath, original, contextAuthority };
 }
 export async function readScopeAmendmentState(location) {

package/scope-context-client.mjs

@@ -1,3 +1,4 @@
+import { prerequisiteFields } from './service-prerequisite.mjs';
 import path from 'node:path';
 import { sign } from 'node:crypto';
 import { canonical } from './local-integrity.mjs';
@@ -9,6 +10,8 @@ import { scopeContextLocation, effectiveScopeContexts, retainContextAuthority,
 import { contextRemote } from './scope-context-remote.mjs';
 import { inspectContextEvidence, observeScopeContext, prepareScopeContext } from './scope-context-observer.mjs';
 import { contextJournal, renewContextChallenge } from './scope-context-journal.mjs';
+import { recoveryFailureFields } from './local-recovery-budget.mjs';
+import { saveLocalScopeEvidence, ensureScopeEvidence, validateAppliedEvidence } from './scope-evidence-remote.mjs';
 
 const schemaVersion = 'entrorove.scope-context-connection/1.0';
 function proposalFor(status, input, location) {
@@ -22,6 +25,9 @@ function proposalFor(status, input, location) {
 }
 function waiting(value, flowId) {
   const status = value.proposal?.approval?.status;
+  if (status === 'approved') return { ...value, schemaVersion, status: 'succeeded', flowId,
+    grantsExecutionAuthority: false, claimsCompletion: false, nextOperation: 'scope-context',
+    nextInput: { action: 'apply', flowId, proposalId: value.proposal.proposalId, proposalDigest: value.proposal.proposalDigest } };
   return { ...value, schemaVersion, status: status === 'declined' ? 'blocked' : 'needs-input', flowId,
     grantsExecutionAuthority: false, claimsCompletion: false,
     nextStep: value.nextStep ?? { operation: 'interaction-answer', requiresOriginalOwnerApproval: true,
@@ -56,8 +62,10 @@ async function review(location, state, dependencies) {
 async function applied(location, state) {
   const effective = state.applied.contextAuthority;
   const challenge = contextChallenge((state.signingChallenge ?? state.challenged).challenge, location, state.proposal, { allowExpired: true });
+  const compact = effective?.record?.schemaVersion === 'entrorove.scope-context-authority/2.0';
+  if (compact) await validateAppliedEvidence(effective.record, state, location, challenge, 'scope-context');
   if (state.applied.grantsExecutionAuthority !== false || !effective?.record
-    || canonical(effective.record.attestation) !== canonical(state.attestation)
+    || !compact && canonical(effective.record.attestation) !== canonical(state.attestation)
     || ['proposalId', 'proposalDigest', 'ownerId', 'taskDigest', 'chainDigest'].some(field => effective.record[field] !== challenge[field])
     || canonical(effective.record.importContexts) !== canonical(challenge.importContexts)
     || canonical(effective.record.evidence) !== canonical(challenge.evidence)) contextFail('Applied context authority differs from this exact actual candidate');
@@ -76,14 +84,20 @@ async function apply(location, state, dependencies) {
   state.proposal = proposal; await saveContextJournal(location, state);
   if (!state.challenged) await contextRemote('challenged', 'scope-runner-context-challenge', { flowId: location.binding.flowId,
     proposalId: proposal.proposalId, proposalDigest: proposal.proposalDigest, attemptId: state.attemptId }, state, location, dependencies);
-  if (!state.attestation) {
+  if (!state.evidenceDescriptor) {
+    let attestation = state.attestation;
+    if (!attestation) {
     const prepared = await prepareScopeContext(location, state, proposal);
-    state.attestation = await observeScopeContext(location, state, proposal, prepared,
+    attestation = await observeScopeContext(location, state, proposal, prepared,
       () => renewContextChallenge(location, state, proposal, dependencies));
-    await saveContextJournal(location, state);
+    }
+    await saveLocalScopeEvidence(attestation, 'scope-context', (state.signingChallenge ?? state.challenged).challenge,
+      state, location, saveContextJournal);
   }
+  const attestationRef = await ensureScopeEvidence(state, location, dependencies,
+    (state.signingChallenge ?? state.challenged).challenge, saveContextJournal);
   await contextRemote('applied', 'scope-runner-context-apply', { flowId: location.binding.flowId,
-    proposalId: proposal.proposalId, proposalDigest: proposal.proposalDigest, attestation: state.attestation }, state, location, dependencies);
+    proposalId: proposal.proposalId, proposalDigest: proposal.proposalDigest, attestationRef }, state, location, dependencies);
   return applied(location, state);
 }
 async function run(location, input, dependencies) {
@@ -96,7 +110,7 @@ async function run(location, input, dependencies) {
     state.completed = true; await saveContextJournal(location, state);
     return { schemaVersion, ...status, status: 'succeeded', flowId: input.flowId, grantsExecutionAuthority: false, claimsCompletion: false };
   } catch (error) {
-    if (!state.pending) { state.rejection ??= { code: error.code, message: error.message }; await saveContextJournal(location, state); }
+    if (!state.pending && !state.evidencePending) { state.rejection ??= { code: error.code, message: error.message }; await saveContextJournal(location, state); }
     throw error;
   }
 }
@@ -109,10 +123,12 @@ export async function runScopeContext(repositoryRoot, input, dependencies) {
     return await withStateLock(path.join(location.base, 'connection'), () => run(location, input, dependencies));
   } catch (error) {
     return { schemaVersion, status: 'blocked', flowId: input?.flowId,
+      ...prerequisiteFields(error),
       code: error?.code?.startsWith('ENTROROVE_') ? error.code : 'ENTROROVE_SCOPE_CONTEXT_PREREQUISITE',
       message: error?.code?.startsWith('ENTROROVE_') ? error.message : 'Context recovery stopped; preserve original signer, binding, journal and evidence.',
-      ...(error?.requestId ? { requestId: error.requestId } : {}), ...(error?.output ? { output: error.output } : {}),
+      ...(error?.requestId ? { requestId: error.requestId } : {}), ...(error?.uploadId ? { uploadId: error.uploadId } : {}), ...(error?.output ? { output: error.output } : {}),
+      ...recoveryFailureFields(error),
       ...(error?.outcomeUnknown ? { outcomeUnknown: true, nextAction: { operation: 'scope-context', method: 'GET',
-        requestId: error.requestId, reuseOriginalInput: true, repeatPost: false } } : {}) };
+        ...(error.requestId ? { requestId: error.requestId } : { uploadId: error.uploadId }), reuseOriginalInput: true, repeatPost: false } } : {}) };
   }
 }

package/scope-context-journal.mjs

@@ -5,6 +5,7 @@ import { atomicMutationJson14, readMutationJson14 } from './local-mutation-files
 import { contextFail } from './scope-context-wire.mjs';
 import { readContextJournal, saveContextJournal } from './scope-context-state.mjs';
 import { contextRemote } from './scope-context-remote.mjs';
+import { consumeRecovery } from './local-recovery-budget.mjs';
 
 export async function archiveContextAttempt(location, state) {
   if (!state.attemptId) return;
@@ -13,28 +14,34 @@ export async function archiveContextAttempt(location, state) {
   catch (error) { if (error.code !== 'ENOENT') throw error; await atomicMutationJson14(file, state, { privateFrom: location.stateRoot }); }
 }
 function reusableSnapshot(state, input) {
-  return input.action === 'apply' && state.snapshot && state.challenged && !state.pending && !state.completed && !state.applied
+  return input.action === 'apply' && state.snapshot && state.challenged && !state.pending && !state.evidencePending && !state.completed && !state.applied
     && state.rejection && !state.rejection.requestId && !state.rejection.output;
 }
 export async function contextJournal(location, input) {
   let state = await readContextJournal(location, input);
   if (!state.previous && reusableSnapshot(state, input)) {
     await archiveContextAttempt(location, state);
-    for (const field of ['rejection', 'checked', 'attestation', 'signingChallenge', 'signingAttemptId']) delete state[field];
+    consumeRecovery(state, 'attempt', state.signingAttemptId ?? state.attemptId);
+    for (const field of ['rejection', 'checked', 'attestation', 'signingChallenge', 'signingAttemptId',
+      'evidenceDescriptor', 'evidenceSignature', 'evidencePrepared', 'attestationRef', 'evidenceResult']) delete state[field];
     await saveContextJournal(location, state);
-  } else if (state.previous || !state.pending && !state.applied && (state.rejection
+  } else if (state.previous || !state.pending && !state.evidencePending && !state.applied && (state.rejection
     || input.action === 'status' && state.completed || input.action === 'apply' && state.completed)) {
-    await archiveContextAttempt(location, state.previous ?? state); state = {};
+    const previous = state.previous ?? state;
+    await archiveContextAttempt(location, previous);
+    const recovery = previous.completed ? undefined : consumeRecovery(previous, 'attempt', previous.attemptId);
+    state = { ...(recovery ? { recovery } : {}) };
   }
   if (!state.attemptId) {
     state = { schemaVersion: 'entrorove.scope-context-journal/1.0', localBindingDigest: location.localBindingDigest,
-      input, attemptId: randomUUID() }; await saveContextJournal(location, state);
+      input, attemptId: randomUUID(), ...(state.recovery ? { recovery: state.recovery } : {}) }; await saveContextJournal(location, state);
   }
   return state;
 }
 export async function renewContextChallenge(location, state, proposal, dependencies) {
-  if (state.pending) contextFail('Recover the original pending request before any challenge renewal');
+  if (state.pending || state.evidencePending) contextFail('Recover the original pending request before any challenge renewal');
   await archiveContextAttempt(location, state);
+  consumeRecovery(state, 'signing', state.signingAttemptId ?? state.attemptId);
   delete state.signingChallenge;
   state.signingAttemptId = randomUUID(); await saveContextJournal(location, state);
   const output = await contextRemote('signingChallenge', 'scope-runner-context-challenge', { flowId: location.binding.flowId,