@entrorove/skill 0.1.73 → 0.1.78

package/CAPABILITY-MAP.md

@@ -1,5 +1,10 @@
 # 能力对账图（WP-02 / AC-20）
 
+## Task entrance authorization and finite handoff recovery
+
+New tasks declare their concrete `task.authorization` boundary at entrance and obtain one original-user approval. Covered design/role/context/discipline/visual decisions reuse its audit automatically; uncovered permissions remain explicit. Planning reuses timely admitted signed evidence while current mutation checks remain fresh. Completed native skill results survive interrupted handoffs. SDK/API recovery is durably limited to two retries, with GET-only recovery of unknown results; exhaustion preserves the original state. See [IDE-EXECUTION.md](IDE-EXECUTION.md#one-task-entrance-approval). This is local source behavior until deployed; it does not claim that old tasks have a new authorization or that an installation/publication occurred.
+
+
 中英文退出治理声明：`entrorove exit` 或当前会话的实际用户明确退出原文，只结束本轮治理，保留源码、原清单顺序、审批及全部失败记录；不取消或完成剩余业务，不从翻译问题、引用、截图、条件句或报错推断退出。英文示例：`From now on, do not use the skill to execute the remaining tasks.`
 
 直接 SDK 会话缺少 IDE 记录时，`exit` 仅为当前已支持主机/会话和实际目录保存 inactive/user-exited 标记，不创建 flow、任务、审批或回执。已有原目录绑定及历史保留；损坏、不匹配或不安全的记录仍明确拒绝覆盖。

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+## 0.1.78 — 2026-10-21
+
+- 完整交付原八技能的一次入口授权、范围内衔接与有界恢复；修复已实际取消的弹窗先于点击回执关闭时的原窗口接续，不重发点击，原父窗口、精确路由、安全签名、快照及回执保护保持。
+- Deliver the original eight skills with one task entrance approval, scoped handoffs and bounded recovery. Preserve the original opener when an actual popup cancellation closes before its click acknowledgement, without replaying the click or weakening exact routes, signatures, snapshots or receipts.
+
+## 0.1.77 — 2026-10-21
+
+- 未发布候选，正式内容并入 0.1.78。
+- Unpublished candidate; incorporated into 0.1.78.
+
+- 正式发布八技能一次入口授权、范围内衔接和有界恢复，保留原八技能核心、安全签名、快照及回执；兼容旧范围续签，并验证已发现能力清单复用时仍拒绝非法输入。
+- Publish the complete original eight skills with one task entrance approval, scoped handoffs and bounded recovery, preserving native cores, signatures, snapshots and receipts; retain legacy scope renewal compatibility and verify invalid input rejection with reused capability discovery.
+
+## 0.1.76 — 2026-10-21
+
+- 未发布候选，正式内容并入 0.1.78。
+- Unpublished candidate; incorporated into 0.1.78.
+
+- 正式交付八技能的一次入口授权、范围内衔接与有界恢复；兼容旧凭据续签的独立写入计量，保留签名、快照、回执和原批准范围校验。
+- Ship the eight-skill single-entrance authorization, scoped handoff and bounded recovery; preserve signed write accounting across legacy proof renewal without changing approved scope, signatures, snapshots or receipt checks.
+
+## 0.1.75 — 2026-10-21
+
+- 未发布候选，正式内容并入 0.1.78。
+- Unpublished candidate; incorporated into 0.1.78.
+
+- 正式发布复用已验证的八技能任务衔接与恢复改进；移除发布测试中未发布法律模块的夹具耦合。八技能核心实现保持原版。
+- Release the verified eight-skill task handoff and recovery improvements; remove unreleased legal-module coupling from release test fixtures. The eight original skill cores remain unchanged.
+
+## 0.1.74 — 2026-10-21
+
+- 未发布候选，正式内容并入 0.1.78。
+- Unpublished candidate; incorporated into 0.1.78.
+
+- 八技能衔接共用一次明确的任务入口批准，范围内复用原审批与已完成计算；修复范围状态读取、元数据扫描、独立可写计量及带查询参数/弹窗的设计验收。恢复次数持久有界，合法前置进度可继续，保留签名、快照、回执与未知结果只查询的保护，禁止跨项目耦合。
+- Reuse one explicit task entrance approval and completed skill computations within the approved boundary. Fix scope state reads, metadata scanning, independently signed write-role metering and query/popup design acceptance. Bound recovery durably while allowing verified prerequisite progress, preserving signatures, snapshots, receipts, GET-only unknown recovery and project isolation.
+
 ## 0.1.73 — 2026-10-20
 
 - 修复通用范围连接在长时间扫描后的签名期限绑定：原 S 证明到期时间不晚于原云端挑战，保留原随机数、完整范围、独立验签和失败历史；已过期挑战仍明确拒绝。

package/DESIGN-GATES.md

@@ -39,7 +39,7 @@ never silently relabel them as a supported framework.
 References are bounded, credential-free public reads. They grant no business
 source, account, database, runtime, deployment or write access.
 
-## 3. Create mockups or prototypes and get actual user confirmation
+## 3. Create mockups or prototypes under the original task authorization
 
 Respect the user's choice: an effect mockup (`kind: mockup`) or a prototype /
 wireframe (`kind: prototype`) is a valid visual baseline. Use the host's actual
@@ -76,16 +76,13 @@ layout bounds, computed styles and a success-message selector.
 
 Show the flow, research links, images and concrete rules to the user. Submit
 `continue` → `workflow-design-review` with the exact `design`. Present the
-returned interaction using the host question UI and submit only the user's
-actual answer to its original callback. No default, timeout, remembered answer,
-model-generated `approved:true` or another account can approve it. Do not
-prepare UI implementation code before this confirmation.
+returned decision. If the task entrance explicitly delegated interface design within these paths and requirements, `approvalReused: true` continues without a new question. Otherwise present the concrete uncovered design decision using the host question UI and submit only the user's actual answer to its callback. No default, timeout, caller `approved:true` or foreign account can approve it. Implementation requires the recorded original authorization or actual additional confirmation.
 
 The response's `approvedDesign` contains `design` and `designApproval`. Carry
 both into the original `policy.discipline`. This approval grants no execution,
 scope or write authority. Original scope, candidate source hashes, signed plan,
 budget, mutation pass and any separate sensitive-change approval still apply.
-Changing the design needs a new revision and genuine confirmation. Keep every
+Changing the design records a new revision and rechecks the same task authorization; request a new decision only for a concrete change outside it. Keep every
 old proposal, rejection and approval. An existing planned task may instead use
 the combined `workflow-discipline-review`, with the same original proof checks.
 
@@ -134,8 +131,7 @@ Keep preview requests restricted to isolated authorized fixture data.
 
 The result is `needs-visual-confirmation`, never an aesthetic pass. Show real
 screenshots alongside approved mockups, then submit the exact report through
-`continue` → `workflow-design-acceptance` and obtain the original user's actual
-visual answer. Final verdict rechecks original approval, tests and source
+`continue` → `workflow-design-acceptance`. An entrance authorization explicitly delegating visual acceptance can be reused after the actual source-bound functional/browser checks pass. Otherwise obtain the original user's actual visual answer. A reused decision is not a claim that the user personally inspected the screenshots. Final verdict rechecks original approval, tests and source
 bindings. Later source/test changes require fresh acceptance.
 
 ## Failure and enforcement boundaries
@@ -149,7 +145,7 @@ historical missing process results.
 Static rules cover the implemented HTML/JS/TS/JSX/Vue/Svelte and CSS subset.
 Unsupported preprocessors/native UI syntax fail explicitly; official research
 does not prove every framework API or language scenario was verified. Browser
-checks and a user's visual judgment remain necessary.
+checks remain necessary; visual judgment follows the original user's retained or explicitly delegated acceptance boundary.
 
 SDK checks govern SDK operations. Optional host hooks can add interception, but
 neither a hook nor a generic process runner is an OS sandbox. A generic runner's

package/DESIGN-STAGED-ACCEPTANCE.md

@@ -0,0 +1,103 @@
+# Staged acceptance and navigation handoffs
+
+This reference describes local source support. It does not grant execution,
+write, account, deployment, or business completion authority. Preserve the
+original flow, task, scope, approvals, source hashes, and every prior attempt.
+Discover the actual schemas through `local capabilities` before use.
+
+## Compatibility
+
+The default contract continues to require whole-site functional coverage.
+An existing-schema navigation handoff uses `step.readBack` with
+`kind: "local-storage"`, an exact `key`, complete JSON `before`/`after` objects
+or `null`, and `afterReload` assertions. It applies only to an actual `open`
+or `navigate` edge. The local runner verifies the entire JSON value, including
+its absence, without promoting private handoff fields into visible UI fields.
+It checks one matching storage operation and all other storage keys remain
+unchanged. It never permits HTTP mutation or a commit-success message.
+
+This representation uses existing schema fields. It does not remove the
+previous server's whole-site coverage requirement. A save/delete retains its
+original persistence proof and explicit action requirements.
+Compatibility of these fields alone does not prove that an original project
+can pass an older server's other validators. In particular, the original
+0.1.73 validator treats multiple workspace versions of one framework as a
+conflict. Keep actual workspace bindings and report that separate dependency;
+do not remove a real framework to make a proposal fit the old validator.
+
+The new `rules.stage` and `step.storageHandoffs` fields require the same shared
+validator on the original server. An older strict server rejects them. Do not
+submit a known unsupported request, remove the fields before signing, fabricate
+approval, or silently bypass server validation. A local source update does not
+deploy server code. Preserve any deployment restriction and report this
+dependency explicitly.
+
+## A stage within the original whole site
+
+`rules.stage` contains:
+
+- `id`: the immutable stage identity.
+- `requirementIds`: references to the original site's requirements.
+- `pageIds`: all executable pages for this stage.
+- `edgeIds`: all executable original edges, with both endpoints executable.
+- `readOnlyPages`: every other original page, each with `pageId` and nonempty
+  `sources` entries containing exact existing `path` and `sha256` values.
+
+Every original page belongs to exactly one group. Keep the full original
+`site.pages`, `site.edges`, roles, public/internal fields, and task scope.
+Read-only source paths must remain in `verificationPaths`. Their actual hashes
+are checked at proposal, guarded writes, runner boundaries, and before/after
+browser acceptance. They cannot be overwritten, removed, moved, or relabeled
+as writable merely because they also appear in `uiPaths`.
+
+Every executable page/state/theme needs its original mockup or prototype and
+one scenario. Every executable edge must be tested. Context-only mockups may
+remain in the proposal without executable scenarios; optional context browser
+scenarios must contain no interaction steps. A source-bound context baseline
+is not proof that its deferred interactions ran or passed.
+
+Retain the stage and its read-only source bindings under the original task authorization. Reuse an entrance approval that explicitly covers the design decision; present a new question only for a concrete permission outside that boundary. Keep genuine visual acceptance after
+real tests. Returned `acceptanceScope` identifies the limited coverage and
+always has `claimsWholeBusinessCompletion: false`. Later stages require their
+own truthful baseline and original approvals. They cannot reuse acceptance as
+new write authority.
+
+## Exact navigation storage declarations
+
+For multiple keys or session storage, declare `step.storageHandoffs`, a list of
+at most eight entries:
+
+```json
+{"area":"local-storage","key":"navigationDraft","method":"setItem","before":null,"after":"{\"itemIds\":[7]}","count":1}
+```
+
+The area is `local-storage` or `session-storage`. The method is `setItem` or
+`removeItem`; removal has `after: null`. Values are exact raw strings or null,
+bounded to 8192 characters. Keys are unique within an action. Identical
+before/after values can describe an idempotent navigation handoff; they never
+prove a successful business commit. Do not combine this declaration with `readBack`.
+Credential and privilege-state declarations are rejected. Never place actual
+credentials in rules, fixtures, reports, or output.
+
+Only an explicit click or key action on an `open`/`navigate` edge can perform
+these handoffs. Edit/fill/validation/cancel, save/delete, HTTP mutations,
+IndexedDB writes, `clear`, extra keys, duplicate writes, wrong values, and
+unacknowledged success messages are not covered by this permission. A handoff
+does not save an order or other business record.
+
+The runner records storage operations across navigation and window closure,
+captures bounded real before/after storage snapshots, checks the original
+triggering/destination pages, and compares all other local/session keys.
+Direct property assignments cannot hide an additional persistent key.
+Snapshot observation is bounded to 256 keys and 1 MiB per page; unsupported
+or oversized states fail explicitly. Reports contain failure identifiers,
+not captured unexpected storage values.
+
+## Failures remain failures
+
+The exact browser identity, isolated preview origin, source-bound successful
+tests, signed original plan/context, public field projection, original budget
+and deadline, save/delete read-back, and unknown-attempt prohibition remain.
+Preserve failed reports and screenshots. A stage or navigation declaration
+cannot repair missing history, renew authority, approve a design, or report
+the original business project complete.

package/IDE-EXECUTION.md

@@ -31,6 +31,23 @@ On first use or after a material agreement revision, the CLI returns a Confirm P
 
 ## Work with a task
 
+### One task entrance approval
+
+The normal task entry includes `task.authorization` alongside the original goal, all requirements and risk. Construct the concrete boundary from the user's actual task and repository inspection; do not add permissions for possible future work. The entrance Confirm Protocol question displays the boundary and risk together. Submit its original user's answer once. Route acceptance is an internal admission receipt, not another question. Existing genuine business choices may require an answer, but engine questions already answered by the task/context do not need to be asked again.
+
+```json
+{"schemaVersion":"entrorove.task-authorization/1.0","readPaths":["src","test","package.json"],"writePaths":["src/components/Product.vue"],"forbiddenPaths":["src/components/protected"],"actions":["modify","interface-design","visual-acceptance"],"dataOperations":[]}
+```
+
+Paths are canonical repository-relative prefixes. Write prefixes allow reads; forbidden prefixes always win. `actions` explicitly lists needed kinds: modify/create/delete/move/format, new-definition/contract-change/rewrite/delete-in-use, interface-design and visual-acceptance. Data actions additionally name their exact operation and target. The task's declared risk is its approved ceiling. This policy does not implicitly include deployment, other repositories, credentials or data migrations. Scope contracts, original requirements, budgets, signatures, actual snapshots and acceptance checks still apply.
+
+Within this recorded boundary, design review, exact role review, read-only build-context correction, discipline review and delegated visual acceptance can return `approvalReused: true`, `humanPromptRequired: false` and `authorizationSource`. Continue their returned next operation directly. The persisted machine decision links the exact original entrance interaction, audit and policy digest; it is not a new human answer. Do not show it as another question or manufacture an `interaction-answer`. An uncovered path, action, higher risk or nondelegated business decision returns the actual additional question; explain only the concrete difference and consolidate necessary additions. A legacy task without an entrance boundary retains its real original approvals, rather than silently acquiring permissions.
+
+Initialize the SDK/task/signer/snapshot once and reuse valid records. Public key pins load offline after authenticated enrollment. In one connected run, ordinary operations share endpoint/account-bound schema discovery. Fresh discovery is needed for a missing operation or explicit contract refresh. Completed native computations checkpoint independently, so recovery continues the unfinished skill instead of rerunning already completed skills. A historical scope proof is usable for planning only after validating its original identity, signature, consumed nonce and timely admission; it is not current execution authority. Recheck current sources, permissions and original M consumption for actual writes, then settle and test real effects.
+
+Recovery has a durable bound: two automatic retries per unchanged verified prerequisite set or signing transition, three original GET recovery observations, and two retries of an explicitly known pre-admission prerequisite. Repeating the same reserved recovery after a crash does not allocate a new attempt. A known pre-effect request may continue after its original workflow records new verified execution, acceptance or approved stage progress. Preserve its original envelope, fenced generations, total attempts and append-only failures. Budgets for previous progress points remain spent; caller hints, a fresh signature, status polling, a new nonce, an empty journal or an altered task cannot reset them. `ENTROROVE_RECOVERY_EXHAUSTED` preserves the original result and pending evidence and disables retries without progress. Report the specific failure once for repair. Never replay unknown POST/PUT, clear records or repeatedly stop/ask the same permission.
+
+
 ### IDE display and cloud planning entry
 
 For a new engineering task, run `npx --yes --prefer-online @entrorove/skill@latest invoke` with `operation: "start"` and the actual task facts below. The CLI reads the authenticated account's sandbox preference before dispatch. An enabled account returns `status: "needs-input"` and a cloud choice, with no model call yet. This is a routing question, not an execution failure. Render it immediately with the host's question tool or native UI; if unavailable, display `interaction.chatFallback` and collect the answer. A collapsed command log is insufficient. Use the returned locale-specific labels for **Use cloud sandbox** and **Continue locally**. After confirmation call the returned `cloud-task` callback with its exact original payload and `sandboxChoice: "use"`; exit repeats the original `start` with top-level `sandboxChoice: "local"`. Preserve the original goal, risk, work type and requirements. A disabled account continues through its configured local workflow; unavailable preferences stop entry explicitly. Reuse a prior explicit choice while resuming this task. Silence never authorizes cloud consumption.
@@ -88,7 +105,7 @@ For a returned `flowId`, continue with `{"operation":"continue","input":{"flowId
 
 The v2 progress sequence is durable and ordered: the first runtime step reports `intake`, then the applicability `gate` is recorded and verified, then the selected contract or plan steps run. Every step can be `pending`, `running`, `reported`, `verified`, `blocked` or `failed`; only a completed verdict with trusted evidence is green.
 
-When intake returns `workflow-gate`, connect the current repository before invoking that gate: run `npx @entrorove/skill scope-connect <absolute repositoryRoot>` with JSON `{"flowId":"<original flowId>","paths":["<existing source file>"]}` on stdin. Use the concrete existing source files in the task's scope; new files belong in the later plan's declared artifacts. The adapter enrolls an OS-private Ed25519 scope signer for this accepted account and task, answers a server challenge, copies and verifies real source files, and submits the signed facts. It sends hashes and scope metadata rather than source contents or the private key. Enrollment grants scope inspection only; execution evidence and write passes retain their separate authority checks. An operator-configured signer cannot be replaced. After a successful connection, use the returned `nextInput` for `continue`, or explicitly send `payload: {"targetFiles":["<same existing source file>"]}` to the original `workflow-gate`. The connector uses `paths`; the gate uses `targetFiles`. Refresh an expired snapshot by reconnecting the same flow and path set. Show an explicit blocked result; query the original request ID after an unknown transport outcome before considering another attempt.
+When intake returns `workflow-gate`, connect the current repository before invoking that gate: run `npx @entrorove/skill scope-connect <absolute repositoryRoot>` with JSON `{"flowId":"<original flowId>","paths":["<existing source file>"]}` on stdin. Use the concrete existing source files in the task's scope; new files belong in the later plan's declared artifacts. The adapter enrolls an OS-private Ed25519 scope signer for this accepted account and task, answers a server challenge, copies and verifies real source files, and submits the signed facts. It sends hashes and scope metadata rather than source contents or the private key. Enrollment grants scope inspection only; execution evidence and write passes retain their separate authority checks. An operator-configured signer cannot be replaced. After a successful connection, use the returned `nextInput` for `continue`, or explicitly send `payload: {"targetFiles":["<same existing source file>"]}` to the original `workflow-gate`. The connector uses `paths`; the gate uses `targetFiles`. Planning reuses the timely admitted original proof; refresh only when a current execution or changed-source check requires it, using the same flow and path set. Show an explicit blocked result; query the original request ID after an unknown transport outcome before considering another attempt.
 
 Scope inspection resolves aliases from actual `tsconfig.json` or `jsconfig.json`, including relative and npm `extends` and ordered inheritance arrays. Npm configuration lookup uses the pinned TypeScript JSON-config resolver over controlled metadata reads, including scoped packages, subpaths, package `tsconfig`, `exports` and `typesVersions`. Read-only candidate probes treat a child beneath an ordinary file as absent so normal TypeScript fallbacks continue; actual sources, control files and mutation targets retain strict validation. Rejected paths report the requested path, blocking ancestor, resolved target and reason, including broken or cyclic dependency links. Configurations and package metadata enter the signed hashes; dependencies are read only, never executed. Repository-local pnpm links use their actual configuration location. Read-only external dependency packages support parents and mappings inside their reference boundary; references requiring an unrepresentable external canonical ancestor fail explicitly rather than selecting a different same-name repository package. For plugin source compiled by a host project whose config is outside the source's ancestors, include `importContexts: [{"sourcePrefix":"<plugin source directory>","configPath":"<actual host tsconfig.json>"}]` in `scope-connect` input. Inspect the real build configuration first; never invent an alias or mark an unresolved import as external. These context paths remain inside the repository, their hashes enter the signed facts, and the local task binding freezes them.
 
@@ -102,7 +119,7 @@ An unresolved alias can occur after the original local signer has been enrolled
 
 First inspect the actual host configurations and the real build source that copies or compiles the plugin mirror. Submit JSON on stdin with `action: "review"`, the original `flowId`, the complete `importContexts` list (all original mappings unchanged, followed by the concrete missing mappings), `evidencePaths` naming the actual repository build-source files, and a concrete `reason`. Each mapping still has exactly `sourcePrefix` and `configPath`. Prefixes must identify actual directories and configurations must be real repository `tsconfig` or `jsconfig` files. No generated alias or invented project configuration can substitute.
 
-The SDK signs the exact proposal with the original S key. The service checks the original accepted owner, task, repository, signer, complete target set and current context revision, then issues an original-owner Confirm Protocol question showing the exact old/new mappings and observed evidence hashes. Show that unchanged question using the host question tool. Only the user's actual answer may call its original `interaction-answer` callback. Existing task authorization does not fabricate this exact context approval; silence remains pending. These configuration and build-evidence files remain read-only and hash-bound during later scope refreshes and file-role amendments; this approval cannot authorize changing their alias semantics or source bytes.
+The SDK signs the exact proposal with the original S key. The service checks the original accepted owner, task, repository, signer, complete target set and current context revision, then issues an original-owner Confirm Protocol question showing the exact old/new mappings and observed evidence hashes. If `approvalReused` is true, continue the authorized context correction without another question. Otherwise show the concrete uncovered context question using the host question tool, and submit only the actual user's answer to its original callback. Silence remains pending; a caller flag cannot provide approval. These configuration and build-evidence files remain read-only and hash-bound during later scope refreshes and file-role amendments; this approval cannot authorize changing their alias semantics or source bytes.
 
 After approval, run `scope-context` with `{ "action": "apply", "flowId": "<original flow>", "proposalId": "<returned proposal>", "proposalDigest": "<returned digest>" }`. It prepares and independently inspects a real copied snapshot and import graph using all original target paths and the proposed contexts, then obtains a fresh server challenge before the original S signature. The short challenge lifetime remains unchanged. Its actual read set, source hashes, original missing resolver candidates, build evidence and snapshot are rechecked after that request; drift rejects signing. A local parser failure is archived, and retrying the identical approved input reuses its original snapshot only while the actual files still match. Unknown remote outcomes require the original GET recovery before any new challenge. Configuration or build-evidence drift, an unresolved actual alias, stale revision, expired/consumed nonce, foreign identity or missing approval rejects the attempt. No context approval grants writes or completes the task.
 
@@ -112,9 +129,9 @@ Successful application appends a server-signed context authority and local histo
 
 If the original selection omitted actual components or inspection files, use the discovered `workflow-scope-review` on the **same flow**, with its original gate digest, current effective revision (`0` before the first amendment), and the complete sorted exact file map. Each entry declares its real `path`, `sha256`, `access` (`write` or `read-only`), original `requirementRefs` and reason. Include all original entries even when reducing their access to read-only. Existing dependencies may become writable only through this exact new review; a directory prefix or manifest inclusion does not grant that permission.
 
-Present the returned scope-revision question and submit the original owner's actual answer through its bound `interaction-answer`. Approval is specific to that complete proposal; it does not approve a plan or perform a write. Then run `npx @entrorove/skill scope-amend <original repositoryRoot>` with `{flowId,proposalId,proposalDigest}` on stdin. It loads the **existing** S key and original repository/entry/import-context binding, obtains a W challenge, scans the real complete file set into a separate candidate snapshot and submits signed evidence. It never creates a replacement signer, answers approval itself, or overwrites the original scope history.
+For `approvalReused: true`, continue the exact approved role revision directly. Otherwise present the concrete scope difference once and submit the original owner's actual answer through its bound `interaction-answer`. Approval is specific to that complete proposal; it does not approve a plan or perform a write. Then run `npx @entrorove/skill scope-amend <original repositoryRoot>` with `{flowId,proposalId,proposalDigest}` on stdin. It loads the **existing** S key and original repository/entry/import-context binding, obtains a W challenge, scans the real complete file set into a separate candidate snapshot and submits signed evidence. It never creates a replacement signer, fabricates a human answer, or overwrites the original scope history.
 
-When exact new paths imply a higher risk, the service includes `riskReview` in the immutable proposal and explicitly shows the old and proposed risk in its original-owner question. Only that actual approval raises the exact scope risk ceiling; the original task, mode, path contract and consumed file/token/line/time budgets remain unchanged. An older approval lacking this risk question cannot authorize an upgrade: follow `risk-reassessment-required` with the same complete role map in a new `workflow-scope-review` on the original flow. Keep the old approval and failed request history; never lower observed risk or repeat an unchanged rejected apply.
+When exact new paths imply a higher risk, the service includes `riskReview` in the immutable proposal and explicitly shows the old and proposed risk in its original-owner question. An entrance authorization covering these exact paths and that risk ceiling can be reused; otherwise only the actual additional approval raises the exact scope risk ceiling; the original task, mode, path contract and consumed file/token/line/time budgets remain unchanged. An older approval lacking this risk question cannot authorize an upgrade: follow `risk-reassessment-required` with the same complete role map in a new `workflow-scope-review` on the original flow. Keep the old approval and failed request history; never lower observed risk or repeat an unchanged rejected apply.
 
 Only a successful native gate and the original approved contracts and remaining budgets can activate the immutable scope revision. Keep the original Blueprint, plan identities, task order and failure receipts. Submit the complete corrected plan with the returned `scopeRevisionDigest` under its canonical new request identity. Exact read-only files remain read-only, even if included in the manifest or a broad write contract. An unknown request outcome is recovered with the original GET; do not replay an uncertain POST or restart the flow.
 

package/REUSE-DISCIPLINE.md

@@ -9,13 +9,13 @@ Snapshot scans stream whole-repository integrity hashes and bound semantic work
 Directory inventory appends each file to one shared list instead of expanding a whole subtree into call arguments. Large ignored directories, including `.artifacts`, remain in both integrity inventories; only `.git` and `node_modules` are excluded. Symlinks remain entries without traversal, and inventory drift still rejects the observation.
 
 - D-1: Before another business mapping or fact definition, search actual definitions and reuse them. Snapshot planning records the whole repository comparison and AST usage review in `discipline-review.json`; its digest is covered by the signed original snapshot. Typed source-entity field mappings use the existing import/alias resolver to identify the same entity, then compare field/value sets. A conflicting second mapping is refused with the existing file and line. An unresolved semantic relation remains unknown. No overlap threshold is invented.
-- D-2: A rewrite must cite a concrete existing defect at file:line. “Clearer”, “more maintainable” and “more general” are not evidence. A necessary sensitive exception is submitted through `continue` → `workflow-discipline-review` on the original planning phase. Display the whole concrete proposal. Approval must be the original account's stored Confirm Protocol answer and audit, never a caller's `accepted:true`.
+- D-2: A rewrite must cite a concrete existing defect at file:line. “Clearer”, “more maintainable” and “more general” are not evidence. A necessary sensitive exception is submitted through `continue` → `workflow-discipline-review` on the original planning phase. Display the whole concrete proposal. Authorization is the original account's task entrance answer and audit when this exact action is covered; otherwise obtain one concrete additional decision. A caller's `accepted:true` grants nothing.
 - D-3: A parallel path requires frozen `policy.parallelPaths` and actual same-input, fieldwise equivalence evidence. Use the existing GoldenBaseline to pin baseline bytes and source hash. The approved runner reads the baseline and actual process output; the original output cannot be supplied anew by the implementation. Missing evidence yields incomplete, mismatch yields blocked with field names. Baselines come from the existing path's actual independent samples, not the new implementation's self-consistency tests.
 - D-4: `discipline-review` exposes symbols, actual references, unresolved sources, scan scope and artifact digest. States are in-use, unused and unknown. Exported/external or dynamic references remain unknown, including reflective/computed access. Unknown equals in-use for preservation. A deletion must reference the original usage review, named symbols and task requirement; known in-use deletion additionally needs the explicit approved exception. Zero static references alone never prove business removability.
-- D-5: The cloud-signed `disciplinePolicy.writes` declares modify/create/delete/move/format with reason and original requirement IDs. Deletes and moves need independent explicit approval. `guarded-delete` and `guarded-move` compare the exact original declaration and physical baseline before action. Moves record explicit source/destination/digest events. Formatting on unchanged semantic lines is refused. The rollback snapshot is limited to pass paths; `discipline-check` compares the whole repository, including ignored files and Finder metadata, excluding only `.git` and `node_modules`. Outside-scope bytes or modes refuse verification. Expired completed-write consumption has the narrowly evidenced environment-observation recovery in IDE-EXECUTION.md; it neither changes this comparison nor grants later writes. No self-score grants permission.
+- D-5: The cloud-signed `disciplinePolicy.writes` declares modify/create/delete/move/format with reason and original requirement IDs. Deletes and moves need explicit authorization in the task entrance boundary or a concrete additional approval when outside it. `guarded-delete` and `guarded-move` compare the exact original declaration and physical baseline before action. Moves record explicit source/destination/digest events. Formatting on unchanged semantic lines is refused. The rollback snapshot is limited to pass paths; `discipline-check` compares the whole repository, including ignored files and Finder metadata, excluding only `.git` and `node_modules`. Outside-scope bytes or modes refuse verification. Expired completed-write consumption has the narrowly evidenced environment-observation recovery in IDE-EXECUTION.md; it neither changes this comparison nor grants later writes. No self-score grants permission.
 - D-6: Future abstractions require concrete named fields from current requirements. Speculative extension justifications without those fields are refused.
 
-Pause for an actual same-semantic new definition, existing data/interface semantic change, data deletion/migration/rebuild, or unsubstantiated rewrite. Submit the exact proposal and reasons through the original flow. Existing data actions must pin their actual pre-execution snapshot artifact in the frozen runner manifest. Never delete to “try” a diagnosis.
+Check the original task authorization for an actual same-semantic new definition, existing data/interface semantic change, data deletion/migration/rebuild, or rewrite. Pause only for a permission outside that approved boundary or a failed safety/equivalence check. Submit the exact proposal and reasons through the original flow. Existing data actions must pin their actual pre-execution snapshot artifact in the frozen runner manifest. Never delete to “try” a diagnosis.
 
 For an independent new file with no same-semantic definition, documentation/comments/copy, or explicit one-off exploratory work, avoid unnecessary review round trips. Keep the current declared scope and run an executable assertion. Unknown size or overlap thresholds cannot enable an exemption: AC-B1 deletion ratio, AC-B2 overlap, AC-B3 small-change size and AC-B4 scan size stay null pending measurement.
 

package/SKILL.md

@@ -1,14 +1,24 @@
 ---
 name: entrorove
-description: Execute a task selected for Entrorove through explicit SDK operations, preserving scope, approvals and verifiable results. UI work requires a whole-site flow, current layout and official framework research, mockups or prototypes, original user design approval, and functional plus visual acceptance. Hooks are optional.
+description: Route a task selected for Entrorove among its eight skills, approve its concrete boundary once, and reuse that authorization and verified results at handoffs. Preserve scope, real execution evidence and functional plus visual acceptance. Hooks are optional.
 ---
 
 # entrorove · 熵巡
 
-Version: 0.1.73.
+Version: 0.1.78.
 
 Entrorove applies only to the task for which it is selected; reading these instructions, discovering capabilities or installing the package never selects or governs another task. Hooks are optional. Reading this document or calling an entry once does not execute the task. On every later turn, including after compaction, continue the original task and its required next operation before dependent work. Keep the original goal, scope, account, flow, cloud task and failure records. Never describe planning, a reported step or model output as verified delivery.
 
+Operate only on the repositories and sources explicitly selected for this task. Never embed a private business checkout, fixed unrelated chat identity or project-specific repair into the skill. Cross-project chat monitoring is outside this skill. Keep the eight skills and their necessary execution services independent of other projects.
+
+## Task entrance and handoffs
+
+Entrorove connects the eight existing skills. Select the skills that the actual task needs; a small direct task does not need a full eight-skill chain. At entrance, collect the goal, all requirements, concrete read/write prefixes, protected paths, necessary action kinds and risk together. Put that boundary in `task.authorization` using [the task entrance contract](IDE-EXECUTION.md#one-task-entrance-approval). Present and record one original-user approval. Within that boundary, follow `approvalReused: true` without another question or `interaction-answer`. Extra authorization is needed only for an actual permission or unresolved business decision outside the approved boundary; bundle the concrete differences. Never invent an approval for a legacy task lacking this record.
+
+Reuse the task binding, installed public key pin, accepted snapshot identity, schemas and completed native skill results. A handoff checks identities and required differences; it does not reinstall the SDK, reapprove the same task or replay earlier successful skills. Planning verifies that stored scope evidence was timely admitted. Current execution still needs the original valid mutation authority, current source/snapshot checks and actual receipts; a historical proof cannot authorize a write. Prepare complete payloads before the short execution challenge and group already planned writes under their original pass.
+
+Automatic recovery is finite: at most two retries with unchanged verified prerequisites, two retries of an unchanged signing transition, and three original GET recovery observations. A known pre-effect request can continue when its original workflow records new verified prerequisites; its original input, total attempts and failure history remain intact. A process restart, status poll, fresh signature or new nonce does not reset the saved counter. When exhausted without progress, preserve the original state and report the concrete failure once; do not generate further attempts, ask the same approval again, clear history or force Stop to loop. Unknown effects remain GET-only. See [IDE-EXECUTION.md](IDE-EXECUTION.md#one-task-entrance-approval).
+
 ## Required execution
 
 1. Install `npx --yes --prefer-online @entrorove/skill@latest install --host codex` only when the user chooses to install this skill. The default installs the skill with hooks disabled and removes its recorded Codex hooks on upgrade, preserving other host settings. SDK calls work directly in an IDE without a hook callback or supported hook adapter; retain the actual host identity. Missing credentials, failed discovery and the SDK/API's scope, approval and evidence checks still return explicit failures.
@@ -16,11 +26,11 @@ Entrorove applies only to the task for which it is selected; reading these instr
    `entrorove unlock` is the break-glass path: run the installed CLI directly in the affected IDE terminal. It writes a short-lived lease for that IDE session only, without a hook callback, network request, credential read, agreement check or protocol lookup. The current session ID must be available from the host environment or `ENTROROVE_SESSION`. The lease permits `flow-cancel` and `flow-abandon` recovery, never project writes or another session's calls. A successful `flow-abandon` clears that session's old binding locally even without a hook callback and preserves its queued requests.
    To remove this skill and its host hooks, run `entrorove uninstall` directly. It works offline and preserves unrelated host settings, credentials and task records. If a managed file was edited, it reports the preserved path instead of deleting it.
 2. Read [IDE-EXECUTION.md](IDE-EXECUTION.md) for the exact entry, cloud callbacks, account agreement and operation contracts. Use the stored account credential; never put it in arguments, URLs, project files, output or fixtures. Entrorove is independent of other systems.
-3. Discover `capabilities`, then invoke `start` with the actual goal, task type, risk and scope facts. An enabled account returns a cloud choice before charging a model. Show that choice visibly using the host question tool. Confirmation calls its original callback; exit adopts the local route for this task. Never treat silence as permission, invent acceptance, or create both routes. Existing explicit authorization for this task persists.
+3. Discover `capabilities`, then invoke `start` with the actual goal, requirements, task type, risk, scope facts and `task.authorization` boundary. An enabled account returns a cloud choice before charging a model. Include that route in the entrance decision; reuse an explicit choice already made by the user. Confirmation calls its original callback; exit adopts the local route for this task. Never treat silence as permission, invent acceptance, or create both routes. Existing explicit authorization for this task persists.
    With cloud sandbox disabled, the IDE performs its own planning and continues the original API flow. Do not require a cloud model call or create a sandbox task to perform local work. The service freezes eligible member plans with `verificationMode: member-local` and `runnerKeyId: null`; successful original IDE execution and tests satisfy local acceptance. This mode comes from the stored account preference and enrolled scope, never a caller flag or an unavailable validator key. An already frozen independent plan keeps its original acceptance contract.
    When the model produces a task contract, preserve its `workType`, `risk`, `difficulty`, `crossModule`, `parallel`, `unclear`, `architectureContract`, optional `baselineRef`, and optional `interaction` as returned. Valid work types are `implementation`, `documentation`, `calculation`, `merge`, `review`, `decision`, and `diagnosis`. A `merge` requires a concrete `baselineRef` identifying the branch, tag, commit, or review baseline; keep that baseline unchanged through independent verification. A `decision` requires `interaction`, including a risk description for medium or high risk. Do not fill missing required fields by guessing.
 4. After real cloud acceptance, immediately display the returned entering status in the task’s selected language, including its **taskNumber**. Preserve `taskNumber` verbatim: it is the homepage sandbox tab number. Keep its UUID `taskId` separately. Run the returned `cloud-watch`, show each real public event and its cursor, and continue the original accepted flow from status. A command log alone is insufficient. No accepted cloud task means no cloud ID or model-execution claim.
-5. For an accepted `flowId`, execute the returned `nextStep` with its required payload. Discover the schema before constructing input. An empty payload is valid only when that operation's schema allows it. Reconnect and refresh only the original flow. A changed snapshot is a binding failure to investigate; do not invent a fresh successful baseline, rebuild a flow to evade it, or erase the old failure. If a fresh scope proof returns `ENTROROVE_SCOPE_PLANNING_REASSESSMENT_REQUIRED` before plan freeze, follow its explicit `workflow-scope-reassess` recovery and retry the original complete request; a local reassessment or snapshot refresh alone does not renew the accepted gate. If the terminal flow truly owns a stale task slot, use the explicit `flow-abandon` lifecycle operation described below before routing the original task again.
+5. For an accepted `flowId`, execute the returned `nextStep` with its required payload. Use the bound discovered schema; ordinary steps reuse discovery instead of fetching it repeatedly. An empty payload is valid only when that operation's schema allows it. Reconnect and refresh only the original flow. A changed snapshot is a binding failure to investigate; do not invent a fresh successful baseline, rebuild a flow to evade it, or erase the old failure. If a fresh scope proof returns `ENTROROVE_SCOPE_PLANNING_REASSESSMENT_REQUIRED` before plan freeze, follow its explicit `workflow-scope-reassess` recovery and retry the original complete request; a local reassessment or snapshot refresh alone does not renew the accepted gate. If the terminal flow truly owns a stale task slot, use the explicit `flow-abandon` lifecycle operation described below before routing the original task again.
 6. All governed mutations use the original authority: `local guarded-write`, `local guarded-delete`, `local guarded-move`, or the original frozen approved runner plan. Native patches, scripts, terminal writes, database mutations and unknown MCP operations must not substitute for the controlled entry. User-authorized task messages use the host's message tool and remain subject to host approval; sending a report does not change the flow or grant execution authority. **A failed gate or unknown outcome must never be replaced with another executor or reported as local success.** Query the original request read-only, repair the cause, and obtain the original flow's valid authority before proceeding. If the original scope challenge preparation is absent from authenticated status, `scope-amend` may use the discovered `scope-challenge-retire` lifecycle operation. The server validates the same approved proposal and receiver, atomically fences only an unadmitted challenge, and records a signed retirement without executing that challenge. Recover and acknowledge the original retirement result with GET before a fresh challenge attempt; retain both requests and all failures. An admitted request, issued nonce, scope application or mutation has no missing-challenge retirement path. An uncertain retirement itself permits only its original GET.
    For a member scope, follow a returned `localAction` before submitting execution evidence. `mutation-connect` obtains only the original task's limited editing pass. Its non-structural modify role requires known target source imports, preserves source imports and public contracts, and keeps unresolved origins, other observed dependencies and project configuration read only. Build scripts, macros and generated sources can remain opaque; source observations and this editing role never prove a complete compiled dependency graph or successful tests. After actual writes, refresh the original scope and run `mutation-settle`. Use the returned `previousPassId` for further edits. In a signed member-local plan, `workflow-observe-step` runs the original frozen command and tests without a validator private key. A server-signed `localAcceptance` advances local dependencies; a failed test does not. A frozen independent plan retains its independent validation requirement. Preserve the raw observation and its absent independent receipt. See [IDE-EXECUTION.md](IDE-EXECUTION.md#local-ide-acceptance).
 7. Read [REUSE-DISCIPLINE.md](REUSE-DISCIPLINE.md) when modifying an existing system. The comparison baseline is the existing implementation in that same repository. It never means another project, another account, or copying external systems.

package/cli.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { localSourceArguments, localSourceInstall, cliErrorText, startFsTrace } from './local-source-execution.mjs';
 import { createHash, randomUUID } from 'node:crypto';
 import { promises as fs, realpathSync } from 'node:fs';
 import os from 'node:os';
@@ -26,6 +27,7 @@ import { exitIdeSession } from './ide-exit.mjs';
 import { installOptions } from './ide-command.mjs';
 import { readCliInput } from './cli-input.mjs';
 const markerName = '.entrorove-managed.json';
+let localSourceExecution = false, stopFsTrace = () => {};
 const installFiles = ['SKILL.md', 'CAPABILITY-MAP.md', 'AGREEMENT.md', 'manifest.json', 'IDE-EXECUTION.md', 'REUSE-DISCIPLINE.md', 'DELIVERY-BOUNDARIES.md', 'DESIGN-GATES.md'];
 const markerSchema = 'entrorove.managed-install/1.0';
 const agreementSchema = 'entrorove.agreement-acceptance/1.0';
@@ -260,6 +262,7 @@ export async function install({ home = os.homedir(), cwd = process.cwd(), explic
   const selected = ideAdapters.find(adapter => adapter.id === (hostId ?? 'codex'));
   if (hostId !== undefined && hostId !== 'codex') throw new Error('Install host must be codex');
   const target = globalInstallPath(home);
+  if (localSourceExecution) return localSourceInstall(target, await managedState(target), await sourceBundle(), { explicit, hostId, hooks });
   if (!explicit && !(await managedState(target))) return { installed: false, updated: false };
   const parent = path.dirname(target);
   await fs.mkdir(parent, { recursive: true, mode: 0o700 });
@@ -297,7 +300,7 @@ export async function uninstall({ home = os.homedir() } = {}) {
 
 async function stdinJson() {
   const args = process.argv.slice(2);
-  const value = await readCliInput(process.stdin, args);
+  const value = await readCliInput(process.stdin, localSourceArguments(args).args);
   if (!['configure','agreement','review'].includes(args[0])) await assertIdeExecution(args, value);
   return value;
 }
@@ -432,7 +435,8 @@ async function runAccountCommand(command, args) {
 }
 
 async function main() {
-  const [command, ...args] = process.argv.slice(2);
+  const selected = localSourceArguments(process.argv.slice(2)); localSourceExecution = selected.localSource; const [command, ...args] = selected.args;
+  if (localSourceExecution) { if (selected.traceFs) stopFsTrace = startFsTrace(); await install(); }
   if (command === 'exit' && args.length === 0) {
     process.stdout.write(`${JSON.stringify(await exitIdeSession())}\n`);
   } else if (command === 'unlock' && args.length === 0) {
@@ -490,7 +494,7 @@ async function main() {
 }
 if (process.argv[1] && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) { const { captureIdeResults } = await import('./ide-results.mjs');
   const finish = captureIdeResults();
-  main().catch((error) => { process.stderr.write(`${error instanceof SyntaxError ? 'Invalid JSON data' : error.message}\n`);
+  main().catch((error) => { process.stderr.write(`${cliErrorText(error)}\n`);
     process.exitCode = 1;
-  }).finally(finish).catch(() => { process.stderr.write('Entrorove IDE completion could not be saved; recover the original request.\n'); process.exitCode = 1; });
+  }).finally(async () => { stopFsTrace(); await finish(); }).catch(() => { process.stderr.write('Entrorove IDE completion could not be saved; recover the original request.\n'); process.exitCode = 1; });
 }

package/cloud-mutation-authority.mjs

@@ -6,6 +6,7 @@ import { mutationStateRoot14, mutationFile14, mutationFail14, privateMutationDir
   readMutationJson14, atomicMutationJson14 } from './local-mutation-files.mjs';
 import { invokeRemoteResult } from './remote-client.mjs';
 import { trustedOrigin } from './remote-transport.mjs';
+import { prerequisiteFields } from './service-prerequisite.mjs';
 
 const pinSchema = 'entrorove.cloud-mutation-authority-pin/1.0';
 const keySchema = 'entrorove.mutation-authority-key/1.0';
@@ -71,13 +72,18 @@ export async function hydrateCloudMutationAuthority(home, apiOrigin) {
   process.env[keyEnvironment] = pin.authority.publicKey;
   return true;
 }
-export async function bootstrapCloudMutationAuthority(dependencies) {
+export async function bootstrapCloudMutationAuthority(dependencies, { refresh = false } = {}) {
   const origin = authorityOrigin(dependencies.apiOrigin()), location = await pinLocation(dependencies.home);
   const previous = await readPin(location, origin);
   if (process.env[keyEnvironment] !== undefined) publicIdentity(process.env[keyEnvironment]);
+  if (previous && !refresh) {
+    process.env[keyEnvironment] = previous.authority.publicKey;
+    return { keyId: previous.authority.keyId, apiOrigin: origin };
+  }
   let result, response;
   try { ({ result, response } = await invokeRemoteResult({ operation: 'capabilities', input: {} }, dependencies)); }
-  catch {
+  catch (error) {
+    if (prerequisiteFields(error).servicePrerequisite) throw error;
     throw Object.assign(new Error('Authenticated cloud mutation authority discovery is unavailable; no mutation operation was transmitted'),
       { code: 'ENTROROVE_MUTATION_AUTHORITY_DISCOVERY', knownBeforeTransmission: true });
   }

package/cloud-task-client.mjs

@@ -1,3 +1,4 @@
+import { prerequisiteError, prerequisiteFields } from './service-prerequisite.mjs';
 import { createHash } from 'node:crypto';
 import { appendInvocation } from './local-invocations.mjs';
 import { parseTransportResponse, requestTransport, trustedOrigin } from './remote-transport.mjs';
@@ -144,6 +145,12 @@ export async function runCloudTask(input, dependencies) {
     });
   }
   if (!response.ok) {
+    const prerequisite = prerequisiteError(response, result, { requestId: id });
+    if (prerequisite) {
+      await appendInvocation({ ...metadata, event: 'rejected', servicePrerequisite: prerequisite.servicePrerequisite }, dependencies.home);
+      return envelope(task, 'blocked', { code: prerequisite.code, message: prerequisite.message,
+        ...prerequisiteFields(prerequisite), requestId: id, httpStatus: response.status });
+    }
     await appendInvocation({ ...metadata, event: response.status >= 500 ? 'outcome-unknown' : 'rejected' }, dependencies.home);
     const code = typeof result?.error === 'string' ? result.error : 'cloud-task-rejected';
     const rawMessage = typeof result?.message === 'string' ? result.message : code;
@@ -197,6 +204,9 @@ export async function queryCloudTask(taskId, dependencies) {
   const taskResponse = await requestTransport(origin, `/api/cloud-sandbox/tasks/${id}`, { headers: authenticatedHeaders(token) });
   let taskBody;
   try { taskBody = await responseBody(taskResponse); } catch { taskBody = null; }
+  const prerequisite = prerequisiteError(taskResponse, taskBody);
+  if (prerequisite) return { schemaVersion: CLOUD_STATUS_SCHEMA, status: 'blocked', taskId: id,
+    code: prerequisite.code, message: prerequisite.message, ...prerequisiteFields(prerequisite) };
   if (!taskResponse.ok || !taskBody?.task || taskBody.task.id !== id) {
     await appendInvocation({ ...metadata, event: 'rejected' }, dependencies.home);
     return { schemaVersion: CLOUD_STATUS_SCHEMA, status: taskResponse.status === 403 ? 'blocked' : taskResponse.status === 404 ? 'missing' : 'failed', taskId: id,

package/cloud-watch-client.mjs

@@ -5,6 +5,7 @@ import { queryCloudTask } from './cloud-task-client.mjs';
 import { acknowledgeAutomaticFeedback } from './automatic-feedback-client.mjs';
 import { sandboxTaskNumber } from './task-identity.mjs';
 import { cloudMessage, cloudOutputLocale } from './cloud-locale.mjs';
+import { fetchPrerequisiteError, streamPrerequisiteError } from './service-prerequisite.mjs';
 
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function inputOptions(input) {
@@ -30,10 +31,15 @@ export async function watchCloudTask(input, dependencies) {
     const response = await fetch(`${trustedOrigin(dependencies.apiOrigin())}/api/cloud-sandbox/tasks/${taskId}/events`, {
       redirect: 'error',signal: controller.signal,headers: { authorization: `Bearer ${token}`,
         accept: 'text/event-stream','last-event-id': afterId,...ideClientHeaders() } });
-    if (!response.ok) throw new Error(`Cloud event stream unavailable: HTTP ${response.status}; taskId=${taskId}`);
+    if (!response.ok) {
+      const prerequisite = await fetchPrerequisiteError(response, { taskId });
+      if (prerequisite) throw prerequisite;
+      throw new Error(`Cloud event stream unavailable: HTTP ${response.status}; taskId=${taskId}`);
+    }
     if (!response.headers.get('content-type')?.startsWith('text/event-stream')) throw new Error('Cloud event response is not an event stream');
     await consumeCloudStream(response.body,frame => {
-      if (frame.event === 'stream-error') throw new Error(`Cloud event stream stopped: ${frame.data?.code ?? 'stream-failed'}`);
+      if (frame.event === 'stream-error') throw streamPrerequisiteError(frame.data, { taskId })
+        ?? new Error(`Cloud event stream stopped: ${frame.data?.code ?? 'stream-failed'}`);
       if (frame.event === 'status') {
         if (frame.data?.taskId !== taskId || !['running','completed','blocked','failed','cancelled'].includes(frame.data.status)) throw new Error('Invalid cloud task status event');
         taskStatus = frame.data.status; return taskStatus === 'running';

package/design-browser-checks.mjs

@@ -1,4 +1,5 @@
 import { designFail } from './design-policy.mjs';
+import { checkNonCommitStorage } from './design-browser-state.mjs';
 
 export async function browserAssertion(page, check) {
   const locator = page.locator(check.selector);
@@ -33,20 +34,25 @@ export function networkCheck(actual, expected, failures) {
   if (actual.length !== expected.reduce((sum, item) => sum + item.count, 0)
     || expected.some(item => actual.filter(event => event.method === item.method && event.path === item.path && event.status === item.status).length !== item.count)) failures.push('unexpected-http-mutation');
 }
-export async function installSuccessMonitor(page, successSelector) {
-  await page.addInitScript(selector => {
+export async function installSuccessMonitor(target, successSelector, recordBinding, handoffKeys = []) {
+  await target.addInitScript(({ selector, binding, keys }) => {
     const events = [], acknowledgements = [], storage = [], original = window.fetch.bind(window);
+    const record = event => { if (binding) window[binding](event).catch(() => {}); };
     Object.defineProperty(window, '__entroroveDesignMonitor', { value: { events, acknowledgements, storage } });
     for (const method of ['setItem', 'removeItem', 'clear']) {
       const apply = Storage.prototype[method];
       Storage.prototype[method] = function(...args) {
+        const area = this === localStorage ? 'local-storage' : this === sessionStorage ? 'session-storage' : 'unknown';
+        const key = typeof args[0] === 'string' ? args[0] : null, declared = keys.some(item => item.area === area && item.key === key);
+        const before = declared && method !== 'clear' ? this.getItem(key) : undefined;
         const result = apply.apply(this, args); storage.push({ method, at: performance.now() });
+        record({ kind: 'storage', area, key, method, ...(declared ? { before, after: this.getItem(key) } : {}) });
         acknowledgements.push({ at: performance.now(), ok: true }); return result;
       };
     }
     if (typeof IDBObjectStore !== 'undefined') for (const method of ['add', 'put', 'delete', 'clear']) {
       const apply = IDBObjectStore.prototype[method];
-      IDBObjectStore.prototype[method] = function(...args) { storage.push({ method: 'indexed-db-write', at: performance.now() }); return apply.apply(this, args); };
+      IDBObjectStore.prototype[method] = function(...args) { storage.push({ method: 'indexed-db-write', at: performance.now() }); record({ kind: 'storage' }); return apply.apply(this, args); };
     }
     window.fetch = async (...args) => {
       const response = await original(...args);
@@ -66,13 +72,20 @@ export async function installSuccessMonitor(page, successSelector) {
     const observe = () => {
       const node = document.querySelector(selector), style = node && getComputedStyle(node);
       const next = Boolean(node && style.display !== 'none' && style.visibility !== 'hidden' && node.getClientRects().length);
-      if (next && !visible) events.push({ at: performance.now(), successfulAcknowledgement: acknowledgements.some(item => item.ok) });
+      if (next && !visible) {
+        const event = { at: performance.now(), successfulAcknowledgement: acknowledgements.some(item => item.ok) };
+        events.push(event); record({ kind: 'success', ...event });
+      }
       visible = next;
     };
     document.addEventListener('DOMContentLoaded', () => {
       new MutationObserver(observe).observe(document.documentElement, { attributes: true, childList: true, subtree: true, characterData: true }); observe();
     });
-  }, successSelector);
+  }, { selector: successSelector, binding: recordBinding, keys: handoffKeys });
+}
+export async function checkBrowserMonitors(page, commits, canSucceed, failures) {
+  await checkNonCommitStorage(page, commits, failures);
+  await monitorSuccess(page, failures, canSucceed);
 }
 export async function monitorSuccess(page, failures, canSucceed) {
   const observed = await page.evaluate(() => window.__entroroveDesignMonitor?.events ?? []);