@entrorove/skill 0.1.73 → 0.1.81

package/releases.json

@@ -1,4 +1,52 @@
 [
+  {
+    "version": "0.1.81",
+    "date": "2026-10-23",
+    "zh": "仓库不再保留自动化测试与调试脚本，发布内容与安装包只包含运行所需文件。八个核心技能的实现与权限边界保持不变。",
+    "en": "The repository no longer carries automated tests or debugging scripts; the published tarball contains runtime files only. The eight core skill implementations and their authority boundaries are unchanged."
+  },
+  {
+    "version": "0.1.80",
+    "date": "2026-10-22",
+    "zh": "更新了技能运行和受管安装、能力覆盖映射、本地执行命令。",
+    "en": "Updated skill runtime and managed installation, capability coverage map, local execution command."
+  },
+  {
+    "version": "0.1.79",
+    "date": "2026-10-22",
+    "zh": "修复干净安装后首次范围连接的服务公钥发现与私有绑定；补齐原任务本地观察的中断恢复并保留失败、未知和真实回执。配套服务修复范围修订路径排序，避免数据库语言环境误拒合法签名。八个核心技能的原实现与权限边界保持。",
+    "en": "Fix authenticated public authority discovery and private pinning on the first scope connection after a clean install. Complete original-task local observation recovery while preserving failures, unknown outcomes and real receipts. The companion service fixes canonical scope revision path ordering across database locales. Preserve the eight original skill implementations and authority boundaries."
+  },
+  {
+    "version": "0.1.78",
+    "date": "2026-10-21",
+    "zh": "完整交付原八技能的一次入口授权、范围内衔接与有界恢复；修复已实际取消的弹窗先于点击回执关闭时的原窗口接续，不重发点击，原父窗口、精确路由、安全签名、快照及回执保护保持。",
+    "en": "Deliver the original eight skills with one task entrance approval, scoped handoffs and bounded recovery. Preserve the original opener when an actual popup cancellation closes before its click acknowledgement, without replaying the click or weakening exact routes, signatures, snapshots or receipts."
+  },
+  {
+    "version": "0.1.77",
+    "date": "2026-10-21",
+    "zh": "未发布候选，内容并入 0.1.78：正式发布八技能一次入口授权、范围内衔接和有界恢复，保留原八技能核心、安全签名、快照及回执；兼容旧范围续签，并验证已发现能力清单复用时仍拒绝非法输入。",
+    "en": "Unpublished candidate, incorporated into 0.1.78: Publish the complete original eight skills with one task entrance approval, scoped handoffs and bounded recovery, preserving native cores, signatures, snapshots and receipts; retain legacy scope renewal compatibility and verify invalid input rejection with reused capability discovery."
+  },
+  {
+    "version": "0.1.76",
+    "date": "2026-10-21",
+    "zh": "未发布候选，内容并入 0.1.78：正式交付八技能的一次入口授权、范围内衔接与有界恢复；兼容旧凭据续签的独立写入计量，保留签名、快照、回执和原批准范围校验。",
+    "en": "Unpublished candidate, incorporated into 0.1.78: Ship the eight-skill single-entrance authorization, scoped handoff and bounded recovery; preserve signed write accounting across legacy proof renewal without changing approved scope, signatures, snapshots or receipt checks."
+  },
+  {
+    "version": "0.1.75",
+    "date": "2026-10-21",
+    "zh": "未发布候选，内容并入 0.1.78：正式发布复用已验证的八技能任务衔接与恢复改进；移除发布测试中未发布法律模块的夹具耦合。八技能核心实现保持原版。",
+    "en": "Unpublished candidate, incorporated into 0.1.78: Release the verified eight-skill task handoff and recovery improvements; remove unreleased legal-module coupling from release test fixtures. The eight original skill cores remain unchanged."
+  },
+  {
+    "version": "0.1.74",
+    "date": "2026-10-21",
+    "zh": "未发布候选，内容并入 0.1.78：八技能衔接共用一次明确的任务入口批准，范围内复用原审批与已完成计算；修复范围状态读取、元数据扫描、独立可写计量及带查询参数/弹窗的设计验收。恢复次数持久有界，合法前置进度可继续，保留签名、快照、回执与未知结果只查询的保护，禁止跨项目耦合。",
+    "en": "Unpublished candidate, incorporated into 0.1.78: Reuse one explicit task entrance approval and completed skill computations within the approved boundary. Fix scope state reads, metadata scanning, independently signed write-role metering and query/popup design acceptance. Bound recovery durably while allowing verified prerequisite progress, preserving signatures, snapshots, receipts, GET-only unknown recovery and project isolation."
+  },
   {
     "version": "0.1.73",
     "date": "2026-10-20",

package/remote-capability-cache.mjs

@@ -0,0 +1,20 @@
+import { createHash } from 'node:crypto';
+
+// Schemas are discovery data, never authority. Each process still validates
+// actual request/response bindings and the service enforces current permissions.
+const entries = new Map(), maximumEntries = 8, lifetimeMs = 300_000;
+const key = (origin, credential, home) => createHash('sha256').update(JSON.stringify([origin, credential, home])).digest('hex');
+export async function discoveredCapabilities(origin, credential, home, fetch, { refresh = false } = {}) {
+  const identity = key(origin, credential, home), previous = entries.get(identity);
+  if (!refresh && previous && previous.expiresAt > Date.now()) return structuredClone(previous.value);
+  // Coalesce concurrent discovery for the same authenticated endpoint.
+  if (!refresh && previous?.pending) return structuredClone(await previous.pending);
+  const pending = fetch();
+  if (!entries.has(identity) && entries.size >= maximumEntries) entries.delete(entries.keys().next().value);
+  entries.set(identity, { pending });
+  try {
+    const value = structuredClone(await pending);
+    if (entries.get(identity)?.pending === pending) entries.set(identity, { value, expiresAt: Date.now() + lifetimeMs });
+    return structuredClone(value);
+  } catch (error) { if (entries.get(identity)?.pending === pending) entries.delete(identity); throw error; }
+}

package/remote-client.mjs

@@ -7,6 +7,8 @@ import { acknowledgeAutomaticFeedback, verifyAutomaticFeedback } from './automat
 import { ideClientHeaders, presentInvocationNotices } from './ide-presentation.mjs';
 import { routeTaskEntry } from './task-entry-client.mjs';
 import { cleanupCompletedSnapshots } from './snapshot-retention.mjs';
+import { prerequisiteError, discoveryPrerequisite } from './service-prerequisite.mjs';
+import { discoveredCapabilities } from './remote-capability-cache.mjs';
 
 export const apiUrl = 'https://entrorove.com/api/skill/invoke';
 
@@ -98,9 +100,16 @@ async function invokeDiscovered(data, token, { home, apiOrigin }) {
   const call = { ...buildInvocation(data.operation, data.input), url: `${trustedOrigin(apiOrigin())}/api/skill/invoke` };
   let feedbackRequired = false;
   if (data.operation !== 'capabilities') {
-    const discovery = await postInvocation({ ...buildInvocation('capabilities', {}), url: call.url }, token, home);
-    if (!discovery.response.ok || discovery.result.output.status !== 'succeeded') throw new Error(`Capability discovery failed: HTTP ${discovery.response.status}`);
-    const capabilities = discovery.result.output.capabilities;
+    const fetch = async () => {
+      let discovery;
+      try { discovery = await postInvocation({ ...buildInvocation('capabilities', {}), url: call.url }, token, home); }
+      catch (error) { throw discoveryPrerequisite(error, call.requestId); }
+      if (!discovery.response.ok || discovery.result.output.status !== 'succeeded') throw new Error(`Capability discovery failed: HTTP ${discovery.response.status}`);
+      return discovery.result.output.capabilities;
+    };
+    let capabilities = await discoveredCapabilities(new URL(call.url).origin, token, home, fetch);
+    if (!capabilities?.operations?.includes(data.operation) || !capabilities?.operationSchemas?.[data.operation]) capabilities = await discoveredCapabilities(new URL(call.url).origin,
+      token, home, fetch, { refresh: true });
     feedbackRequired = requiresAutomaticFeedback(data.operation,data.input,capabilities);
     const schema = capabilities?.operationSchemas?.[data.operation];
     if (!capabilities?.operations?.includes(data.operation) || !schema) throw new Error(`Capability discovery does not support ${data.operation}`);
@@ -135,6 +144,11 @@ export async function postInvocation(call, token, home, feedbackRequired = false
     await logged({ event: 'outcome-unknown' }); throw unknownInvocation(call.requestId);
   }
   if (!response.ok && !result?.output) {
+    const prerequisite = prerequisiteError(response, result, { requestId: call.requestId });
+    if (prerequisite) {
+      await logged({ event: 'rejected', servicePrerequisite: prerequisite.servicePrerequisite });
+      throw Object.assign(prerequisite, prerequisite.knownBeforeEffects ? {} : { outcomeUnknown: true });
+    }
     await logged({ event: response.status >= 500 ? 'outcome-unknown' : 'rejected' });
     if (response.status >= 500) throw unknownInvocation(call.requestId);
     const code = typeof result?.error === 'string' && /^[a-z][a-z0-9-]{0,63}$/.test(result.error) ? result.error : 'request-rejected';
@@ -199,7 +213,9 @@ export function createTaskMessageClient(dependencies) {
       let feedbackRequired = false;
       if (operation !== 'capabilities') {
         const discovery = buildInvocation('capabilities', {});
-        const discovered = await postInvocation({ ...discovery, url: `${origin}/api/skill/invoke` }, token, dependencies.home);
+        let discovered;
+        try { discovered = await postInvocation({ ...discovery, url: `${origin}/api/skill/invoke` }, token, dependencies.home); }
+        catch (error) { throw discoveryPrerequisite(error, original.requestId); }
         if (!discovered.response.ok || discovered.result.output.status !== 'succeeded') throw new Error('Task message capability discovery failed');
         validateMachineCapability(operation, input, discovered.result.output.capabilities);
         feedbackRequired = requiresAutomaticFeedback(operation,input,discovered.result.output.capabilities);
@@ -218,6 +234,8 @@ export function createTaskMessageClient(dependencies) {
       const response = await readOnlyGet(machineOrigin(dependencies), `/api/skill/status/${id}`,
         { authorization: `Bearer ${token}` }, 'original task message status');
       const result = await readResponse(response, 'task message status');
+      const prerequisite = prerequisiteError(response, result, { requestId: id, outcomeUnknown: true });
+      if (prerequisite) throw prerequisite;
       if (!response.ok || !result?.output || result.output.requestId !== id) throw new Error('Original task message status is unavailable or invalid');
       if (result.feedback) verifyAutomaticFeedback(result.feedback,id);
       presentInvocationNotices(result,dependencies.onIdeEvent);
@@ -232,6 +250,8 @@ export async function queryStatus(requestId, dependencies) {
   const token = await dependencies.readCredential(dependencies.home);
   const response = await readOnlyGet(dependencies.apiOrigin(), `/api/skill/status/${encodeURIComponent(requestId)}`, { authorization: `Bearer ${token}` }, 'status')
   const result = await readResponse(response, 'status');
+  const prerequisite = prerequisiteError(response, result, { requestId, outcomeUnknown: true });
+  if (prerequisite) throw prerequisite;
   if (!response.ok || result?.output?.requestId !== requestId) throw new Error(`entrorove status failed: HTTP ${response.status}; requestId=${requestId}`);
   await appendInvocation({ kind: 'remote', operation: 'status', requestId, event: 'status', usage: result.usage ?? [] }, dependencies.home);
   if (result.feedback) verifyAutomaticFeedback(result.feedback,requestId);

package/scope-amendment-client.mjs

@@ -1,3 +1,4 @@
+import { prerequisiteFields } from './service-prerequisite.mjs';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { canonical, sha256 } from './local-integrity.mjs';
@@ -10,8 +11,56 @@ import { amendmentRemote, scopeAmendmentStatus } from './scope-amendment-remote.
 import { observeScopeAmendment } from './scope-amendment-observer.mjs';
 import { retainScopeAmendmentReference } from './scope-amendment-reference.mjs';
 import { saveLocalScopeEvidence, ensureScopeEvidence, validateAppliedEvidence } from './scope-evidence-remote.mjs';
+import { consumeRecovery, recoveryFailureFields } from './local-recovery-budget.mjs';
 
 const schemaVersion = 'entrorove.scope-amendment-connection/1.0';
+const submissionFields = ['evidencePending', 'evidenceDescriptor', 'evidencePrepared', 'evidenceSignature',
+  'attestation', 'attestationDigest', 'attestationRef', 'evidenceResult', 'applied', 'rejection'];
+const signingChallenge = state => (state.signingChallenge ?? state.challenged).challenge;
+function sameChallenge(value, original, location, attemptId, options) {
+  const fresh = scopeAmendmentChallenge(value, location, options);
+  const changing = new Set(['authorityReceipt', 'attemptId', 'challengeId', 'challenge', 'issuedAt', 'expiresAt']);
+  const immutable = challenge => Object.fromEntries(Object.entries(challenge).filter(([field]) => !changing.has(field)));
+  if (canonical(immutable(fresh)) !== canonical(immutable(original)) || fresh.attemptId !== attemptId
+    || fresh.challenge === original.challenge || fresh.challengeId === original.challengeId) {
+    amendmentFail('Fresh amendment challenge changed its original task, signer, step, roles or authority head');
+  }
+  return fresh;
+}
+async function archiveSigningObservation(location, state) {
+  const checksum = sha256(canonical(state)), archive = path.join(location.directory, `${state.attemptId}-${checksum}.json`);
+  try { if (canonical(await readMutationJson14(archive)) !== canonical(state)) amendmentFail('Original signing observation history changed'); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; await atomicMutationJson14(archive, state, { privateFrom: location.stateRoot }); }
+  return checksum;
+}
+export async function renewScopeAmendmentChallenge(location, state, remote) {
+  if (submissionFields.some(field => Object.hasOwn(state, field)) || canonical(state.identity) !== canonical(location.identity)
+    || state.snapshotStarted !== true || !state.snapshot || state.snapshot.snapshotId !== state.snapshotId
+    || state.snapshot.flowId !== location.identity.flowId || state.snapshot.contractDigest !== location.identity.proposalDigest) {
+    amendmentFail('Fresh amendment challenge requires the same verified snapshot before any signed evidence or application');
+  }
+  const original = scopeAmendmentChallenge(state.challenged?.challenge, location, { allowExpired: true });
+  if (state.snapshot.stepId !== original.stepId) amendmentFail('Amendment snapshot replaced its original challenge step');
+  if (state.pending && (state.pending.stage !== 'signingChallenge' || !state.signingAttemptId)) {
+    amendmentFail('Recover the original pending amendment request before signing challenge renewal');
+  }
+  const retained = state.signingChallenge && sameChallenge(state.signingChallenge.challenge, original, location,
+    state.signingAttemptId, { allowExpired: true });
+  if (!state.pending && retained && Date.parse(retained.expiresAt) > Date.now()) {
+    return retained;
+  }
+  if (!state.pending && (!state.signingAttemptId || state.signingChallenge)) {
+    const archivedDigest = await archiveSigningObservation(location, state);
+    consumeRecovery(state, 'signing', state.signingAttemptId ?? state.attemptId);
+    delete state.signingChallenge; state.signingAttemptId = randomUUID();
+    state.signingRecovery = { archivedDigest, snapshotId: state.snapshotId, requiresSnapshotVerification: true,
+      grantsExecutionAuthority: false, recoveredAt: new Date().toISOString() };
+    await saveScopeAmendmentState(location, state);
+  }
+  const issued = await remote('signingChallenge', 'workflow-scope-challenge', { proposalId: location.identity.proposalId,
+    proposalDigest: location.identity.proposalDigest, receiverId: location.binding.runnerId, attemptId: state.signingAttemptId });
+  return sameChallenge(issued.challenge, original, location, state.signingAttemptId);
+}
 function validateProposal(status, input) {
   const proposal = status.proposal;
   if (!proposal || proposal.proposalId !== input.proposalId || proposal.proposalDigest !== input.proposalDigest
@@ -21,7 +70,7 @@ function validateProposal(status, input) {
 async function validateApplied(output, state, location) {
   const effective = output.effectiveAuthority, version = effective?.record?.schemaVersion === 'entrorove.scope-revision-authority/2.0' ? '2.0' : '1.0';
   const record = scopeRevisionAuthority(effective?.record, `entrorove.scope-revision-authority/${version}`);
-  const challenge = scopeAmendmentChallenge(state.challenged.challenge, location, { allowExpired: true }), refresh = challenge.purpose === 'scope-revision-refresh';
+  const challenge = scopeAmendmentChallenge(signingChallenge(state), location, { allowExpired: true }), refresh = challenge.purpose === 'scope-revision-refresh';
   if (output.status !== 'succeeded' || output.grantsExecutionAuthority !== false || output.claimsCompletion !== false
     || output.scopeRevisionDigest !== sha256(canonical(record)) || effective.revisionDigest !== output.scopeRevisionDigest
     || output.revision !== effective.revision || record.revision !== effective.revision
@@ -59,18 +108,22 @@ async function archiveAttempt(location, state) {
   const archive = path.join(location.directory, `${state.attemptId}.json`);
   try { if (canonical(await readMutationJson14(archive)) !== canonical(state)) amendmentFail('Original scope amendment attempt history changed'); }
   catch (error) { if (error.code !== 'ENOENT') throw error; await atomicMutationJson14(archive, state, { privateFrom: location.stateRoot }); }
-  for (const key of Object.keys(state)) if (!['schemaVersion', 'identity'].includes(key)) delete state[key];
+  if (!state.applied) consumeRecovery(state, 'attempt', state.attemptId);
+  const completed = Boolean(state.applied);
+  for (const key of Object.keys(state)) if (!['schemaVersion', 'identity', ...(completed ? [] : ['recovery'])].includes(key)) delete state[key];
   await saveScopeAmendmentState(location, state);
 }
 async function finish(location, state, dependencies) {
   if (!state.evidenceDescriptor && !state.applied) {
-    const attestation = state.attestation ?? await observeScopeAmendment(location, state);
-    const challenge = scopeAmendmentChallenge(state.challenged.challenge, location, { allowExpired: true });
+    const attestation = state.attestation ?? await observeScopeAmendment(location, state, {
+      beforeSign: () => renewScopeAmendmentChallenge(location, state,
+        (stage, operation, payload) => amendmentRemote(stage, operation, payload, state, location, dependencies)) });
+    const challenge = scopeAmendmentChallenge(signingChallenge(state), location, { allowExpired: true });
     await saveLocalScopeEvidence(attestation, challenge.purpose === 'scope-revision-refresh' ? 'scope-refresh' : 'scope-revision',
       challenge, state, location, saveScopeAmendmentState);
   }
   if (!state.applied) {
-    const attestationRef = await ensureScopeEvidence(state, location, dependencies, state.challenged.challenge, saveScopeAmendmentState);
+    const attestationRef = await ensureScopeEvidence(state, location, dependencies, signingChallenge(state), saveScopeAmendmentState);
     await amendmentRemote('applied', 'workflow-scope-apply', { proposalId: location.identity.proposalId,
       proposalDigest: location.identity.proposalDigest, attestationRef }, state, location, dependencies);
   }
@@ -96,7 +149,8 @@ async function amend(location, dependencies) {
       requiresOriginalOwnerApproval: true, scopeExpansionAutomaticallyAuthorized: false } };
   if (state.challenged && !state.applied && !state.rejection) {
     const challenge = scopeAmendmentChallenge(state.challenged.challenge, location, { allowExpired: true });
-    if (Date.parse(challenge.expiresAt) > Date.now()) return finish(location, state, dependencies);
+    if (Date.parse(challenge.expiresAt) > Date.now() || state.snapshot && state.snapshotStarted === true
+      && !submissionFields.some(field => Object.hasOwn(state, field))) return finish(location, state, dependencies);
     state.rejection = { code: 'ENTROROVE_SCOPE_AMENDMENT_CHALLENGE_EXPIRED', effects: 'none',
       reason: 'signed-unused-challenge-expired-before-next-post' }; await saveScopeAmendmentState(location, state);
   }
@@ -123,12 +177,14 @@ export async function runScopeAmend(repositoryRoot, input, dependencies) {
   } catch (error) {
     const requestId = /^[a-f0-9]{64}$/.test(error?.requestId ?? '') ? error.requestId : undefined;
     return { schemaVersion, status: 'blocked', flowId: input?.flowId,
+      ...prerequisiteFields(error),
       code: error?.code?.startsWith('ENTROROVE_') ? error.code : 'ENTROROVE_SCOPE_AMENDMENT_PREREQUISITE',
       message: ['ENTROROVE_SCOPE_AMENDMENT_BINDING', 'ENTROROVE_SCOPE_AMENDMENT_STATE', 'ENTROROVE_SCOPE_AMENDMENT_UNKNOWN',
         'ENTROROVE_SCOPE_AMENDMENT_NOT_SENT', 'ENTROROVE_SCOPE_AMENDMENT_MUTATION_PENDING'].includes(error?.code) ? error.message
         : 'Scope amendment stopped; preserve the original proposal, signer, journal and actual evidence.',
       ...(requestId ? { requestId } : {}), ...(error?.uploadId ? { uploadId: error.uploadId } : {}), ...(error?.output ? { output: error.output } : {}),
       ...(error?.feedback ? { feedback: error.feedback } : {}),
+      ...recoveryFailureFields(error),
       ...(error?.outcomeUnknown ? { outcomeUnknown: true, nextAction: { operation: 'scope-amend', ...(requestId ? { requestId } : { uploadId: error.uploadId }),
         method: 'GET', reuseOriginalInput: true, repeatPost: false } } : {}) };
   }

package/scope-amendment-observer.mjs

@@ -21,12 +21,14 @@ async function inspectFiles(location, challenge) {
     physical.add(identity);
   }
 }
-export async function observeScopeAmendment(location, state) {
-  const challenge = scopeAmendmentChallenge(state.challenged.challenge, location);
+export async function observeScopeAmendment(location, state, { beforeSign } = {}) {
+  const original = scopeAmendmentChallenge(state.challenged.challenge, location, { allowExpired: beforeSign !== undefined });
+  let challenge = original;
   await inspectFiles(location, challenge);
   if (!state.snapshotId) { state.snapshotId = `scope-amend-${randomUUID()}`; await saveScopeAmendmentState(location, state); }
   const input = { repositoryRoot: location.root, home: location.home, flowId: challenge.flowId, stepId: challenge.stepId,
     snapshotId: state.snapshotId, paths: challenge.files.map(file => file.path).sort(),
+    scopeWritePaths: challenge.files.filter(file => file.access !== 'read-only').map(file => file.path).sort(),
     contractDigest: challenge.proposalDigest, importContexts: location.contextAuthority?.record.importContexts ?? location.binding.importContexts,
     ...(location.contextAuthority ? { contextRevisionDigest: location.contextAuthority.revisionDigest,
       contextEvidence: location.contextAuthority.record.evidence } : {}),
@@ -56,7 +58,11 @@ export async function observeScopeAmendment(location, state) {
   const observed = await attestScopeFacts({ ...input, ownerId: challenge.ownerId, taskDigest: challenge.taskDigest,
     chainDigest: challenge.chainDigest, repositoryId: challenge.repositoryId, challenge: challenge.challenge,
     signerConfigPath: location.signerConfigPath }, { repositoryRoot: location.root, facts,
-    snapshotDigest: facts.snapshotEvidence.snapshotDigest }, { maximumExpiresAt: Date.parse(challenge.expiresAt) });
+    snapshotDigest: facts.snapshotEvidence.snapshotDigest }, { maximumExpiresAt: Date.parse(challenge.expiresAt),
+    ...(beforeSign === undefined ? {} : { beforeSign: async () => {
+      challenge = await beforeSign();
+      return { challenge: challenge.challenge, maximumExpiresAt: Date.parse(challenge.expiresAt) };
+    } }) });
   const memberMutation = await scopeAmendmentMutation(location, state, challenge, facts);
   const core = { schemaVersion: 'entrorove.scope-revision-attestation/1.0', purpose: challenge.purpose,
     proposalId: challenge.proposalId, proposalDigest: challenge.proposalDigest, expectedRevision: challenge.expectedRevision,

package/scope-amendment-remote.mjs

@@ -7,6 +7,8 @@ import { readInvocations } from './local-invocations.mjs';
 import { saveScopeAmendmentState } from './scope-amendment-state.mjs';
 import { amendmentFail } from './scope-amendment-wire.mjs';
 import { retireMissingChallenge } from './scope-amendment-retirement.mjs';
+import { prerequisiteError, retainPrerequisite, retryKnownPrerequisite } from './service-prerequisite.mjs';
+import { consumeRecovery } from './local-recovery-budget.mjs';
 
 const unknown = requestId => Object.assign(new Error('Scope amendment outcome is unknown; recover the original request with GET only'),
   { code: 'ENTROROVE_SCOPE_AMENDMENT_UNKNOWN', outcomeUnknown: true, requestId });
@@ -16,6 +18,8 @@ async function recover(pending, dependencies) {
     const response = await requestTransport(origin, `/api/skill/status/${pending.requestId}`, {
       headers: { authorization: `Bearer ${token}`, ...ideClientHeaders() } });
     const result = parseTransportResponse(response, 'original scope amendment status');
+    const prerequisite = prerequisiteError(response, result, { requestId: pending.requestId });
+    if (prerequisite) throw Object.assign(unknown(pending.requestId), { servicePrerequisite: prerequisite.servicePrerequisite });
     if (response.status === 404 && result?.error === 'request-not-found') {
       throw Object.assign(unknown(pending.requestId), { requestNotFound: true });
     }
@@ -25,7 +29,8 @@ async function recover(pending, dependencies) {
     verifyAutomaticFeedback(result.feedback, pending.requestId, pending.requestId);
     result.feedback = await acknowledgeAutomaticFeedback(result.feedback, origin, token, ideClientHeaders());
     return { response, result };
-  } catch (error) { throw error?.requestNotFound ? error : unknown(pending.requestId); }
+  } catch (error) { throw error?.requestNotFound ? error : Object.assign(unknown(pending.requestId),
+    error?.servicePrerequisite ? { servicePrerequisite: error.servicePrerequisite } : {}); }
 }
 async function notSent(pending, home) {
   try {
@@ -36,10 +41,14 @@ async function notSent(pending, home) {
 export async function amendmentRemote(stage, operation, payload, state, location, dependencies) {
   const input = { flowId: location.identity.flowId, operation, payload }, requestId = buildInvocation('continue', input).requestId;
   let response, result;
-  if (state.pending) {
+  const existing = Boolean(state.pending);
+  if (existing) {
     if (state.pending.stage !== stage || state.pending.requestId !== requestId || canonical(state.pending.input) !== canonical(input)) {
       amendmentFail('Recover the original amendment request before another operation');
     }
+  }
+  if (existing && !await retryKnownPrerequisite(state, location, saveScopeAmendmentState)) {
+    consumeRecovery(state, 'status'); await saveScopeAmendmentState(location, state);
     if (state.challengeRetirement) await retireMissingChallenge(state, location, dependencies, recover, notSent);
     try { ({ response, result } = await recover(state.pending, dependencies)); }
     catch (error) {
@@ -48,16 +57,18 @@ export async function amendmentRemote(stage, operation, payload, state, location
       ({ response, result } = await recover(state.pending, dependencies));
     }
   } else {
-    state.pending = { stage, operation: 'continue', input, requestId };
-    await saveScopeAmendmentState(location, state);
+    if (!existing) { state.pending = { stage, operation: 'continue', input, requestId };
+      await saveScopeAmendmentState(location, state); }
     try { ({ response, result } = await invokeRemoteResult({ operation: 'continue', input }, dependencies)); }
     catch (error) {
+      if (await retainPrerequisite(error, state, location, saveScopeAmendmentState)) throw error;
       if (await notSent(state.pending, dependencies.home)) {
+        state.rejection = { code: 'ENTROROVE_SCOPE_AMENDMENT_NOT_SENT', effects: 'none', requestId };
         delete state.pending; await saveScopeAmendmentState(location, state);
         throw Object.assign(new Error('Scope amendment was not transmitted; repair its prerequisite and reuse the original input'),
           { code: 'ENTROROVE_SCOPE_AMENDMENT_NOT_SENT', knownBeforeTransmission: true, requestId });
       }
-      throw unknown(requestId);
+      throw Object.assign(unknown(requestId), error?.servicePrerequisite ? { servicePrerequisite: error.servicePrerequisite } : {});
     }
   }
   if (!result?.output || result.output.requestId !== requestId) throw unknown(requestId);
@@ -80,5 +91,8 @@ export async function scopeAmendmentStatus(flowId, dependencies) {
       input: { flowId, operation: 'workflow-scope-status', payload: {} } }, dependencies);
     if (!response.ok || result?.output?.status !== 'succeeded') throw new Error();
     return result.output.result ?? result.output;
-  } catch { amendmentFail('Current account cannot read its original live scope revision; no amendment mutation was sent'); }
+  } catch (error) {
+    if (error?.servicePrerequisite) throw error;
+    amendmentFail('Current account cannot read its original live scope revision; no amendment mutation was sent');
+  }
 }

package/scope-amendment-retirement.mjs

@@ -2,6 +2,7 @@ import { canonical, sha256 } from './local-integrity.mjs';
 import { buildInvocation, invokeRemoteResult } from './remote-client.mjs';
 import { scopeRevisionAuthority, amendmentFail } from './scope-amendment-wire.mjs';
 import { saveScopeAmendmentState } from './scope-amendment-state.mjs';
+import { retainPrerequisite, retryKnownPrerequisite } from './service-prerequisite.mjs';
 
 export async function retireMissingChallenge(state, location, dependencies, recover, notSent) {
   const original = state.pending;
@@ -14,14 +15,15 @@ export async function retireMissingChallenge(state, location, dependencies, reco
   if (attempt && (attempt.requestId !== call.requestId || canonical(attempt.input) !== canonical(input))) {
     amendmentFail('Challenge retirement must retain its original preparation envelope');
   }
-  if (!attempt) {
-    attempt = state.challengeRetirement = { requestId: call.requestId, input, state: 'pending' };
+  if (!attempt || await retryKnownPrerequisite(state, location, saveScopeAmendmentState, 'challengeRetirement')) {
+    if (!attempt) attempt = state.challengeRetirement = { requestId: call.requestId, input, state: 'pending' };
     await saveScopeAmendmentState(location, state);
     try {
       const { result } = await invokeRemoteResult({ operation: 'scope-challenge-retire', input }, dependencies);
       attempt.output = result.output; attempt.feedback = result.feedback; attempt.state = 'completed';
       await saveScopeAmendmentState(location, state);
     } catch (error) {
+      if (await retainPrerequisite(error, state, location, saveScopeAmendmentState, 'challengeRetirement')) throw error;
       if (await notSent(attempt, dependencies.home)) {
         attempt.state = 'not-sent'; await saveScopeAmendmentState(location, state);
       }

package/scope-amendment-state.mjs

@@ -10,17 +10,21 @@ import { trustedOrigin } from './remote-transport.mjs';
 import { boundScopeContexts } from './scope-context-state.mjs';
 
 const fail = message => scopeFail('ENTROROVE_SCOPE_AMENDMENT_STATE', message);
-const maximumStateBytes = 1_000_000;
+const maximumControlBytes = 1_000_000;
+// Retained scope combines original facts and verified history, not a single
+// signing control. Keep its aggregate bound separate from key/config files.
+const maximumRetainedScopeBytes = 8_000_000;
 // A journal retains the challenge, S proof, original pending request and full
 // signed response together. Each signed authority retains its own 1 MB bound.
 const maximumJournalBytes = 8_000_000;
-async function privateItem(file, final = 'file', maximumBytes = maximumStateBytes) {
+async function privateItem(file, final = 'file', maximumBytes = maximumControlBytes) {
   const value = await mutationFile14(file, { final });
   if (process.getuid && value.stat.uid !== process.getuid()
     || process.platform !== 'win32' && value.stat.mode & 0o077
-    || final === 'file' && (value.stat.nlink !== 1 || value.stat.size > maximumBytes)) {
-    fail('Scope amendment controls must be bounded private files owned by the current OS account');
+    || final === 'file' && value.stat.nlink !== 1) {
+    fail('Scope amendment controls must be private single-link files owned by the current OS account');
   }
+  if (final === 'file' && value.stat.size > maximumBytes) fail(`Scope amendment file exceeds the ${maximumBytes} byte limit`);
   return value;
 }
 async function privateText(file) {
@@ -68,7 +72,7 @@ export async function scopeAmendmentLocation(repositoryRoot, input, dependencies
   if (key.asymmetricKeyType !== 'ed25519' || der.toString('base64') !== binding.publicKey
     || sha256(der) !== binding.keyId) fail('Original scope signing identity changed');
   const originalStatePath = path.join(stateRoot, 'scope', sha256(root).slice(0, 32), input.flowId, 'state.json');
-  await privateItem(originalStatePath);
+  await privateItem(originalStatePath, 'file', maximumRetainedScopeBytes);
   const saved = await readMutationJson14(originalStatePath);
   const original = await retainedScope({ repositoryRoot: root, home, flowId: input.flowId,
     stepId: saved.stepId, snapshotId: saved.originalSnapshot?.snapshotId }, root);

package/scope-context-client.mjs

@@ -1,3 +1,4 @@
+import { prerequisiteFields } from './service-prerequisite.mjs';
 import path from 'node:path';
 import { sign } from 'node:crypto';
 import { canonical } from './local-integrity.mjs';
@@ -9,6 +10,7 @@ import { scopeContextLocation, effectiveScopeContexts, retainContextAuthority,
 import { contextRemote } from './scope-context-remote.mjs';
 import { inspectContextEvidence, observeScopeContext, prepareScopeContext } from './scope-context-observer.mjs';
 import { contextJournal, renewContextChallenge } from './scope-context-journal.mjs';
+import { recoveryFailureFields } from './local-recovery-budget.mjs';
 import { saveLocalScopeEvidence, ensureScopeEvidence, validateAppliedEvidence } from './scope-evidence-remote.mjs';
 
 const schemaVersion = 'entrorove.scope-context-connection/1.0';
@@ -23,6 +25,9 @@ function proposalFor(status, input, location) {
 }
 function waiting(value, flowId) {
   const status = value.proposal?.approval?.status;
+  if (status === 'approved') return { ...value, schemaVersion, status: 'succeeded', flowId,
+    grantsExecutionAuthority: false, claimsCompletion: false, nextOperation: 'scope-context',
+    nextInput: { action: 'apply', flowId, proposalId: value.proposal.proposalId, proposalDigest: value.proposal.proposalDigest } };
   return { ...value, schemaVersion, status: status === 'declined' ? 'blocked' : 'needs-input', flowId,
     grantsExecutionAuthority: false, claimsCompletion: false,
     nextStep: value.nextStep ?? { operation: 'interaction-answer', requiresOriginalOwnerApproval: true,
@@ -118,9 +123,11 @@ export async function runScopeContext(repositoryRoot, input, dependencies) {
     return await withStateLock(path.join(location.base, 'connection'), () => run(location, input, dependencies));
   } catch (error) {
     return { schemaVersion, status: 'blocked', flowId: input?.flowId,
+      ...prerequisiteFields(error),
       code: error?.code?.startsWith('ENTROROVE_') ? error.code : 'ENTROROVE_SCOPE_CONTEXT_PREREQUISITE',
       message: error?.code?.startsWith('ENTROROVE_') ? error.message : 'Context recovery stopped; preserve original signer, binding, journal and evidence.',
       ...(error?.requestId ? { requestId: error.requestId } : {}), ...(error?.uploadId ? { uploadId: error.uploadId } : {}), ...(error?.output ? { output: error.output } : {}),
+      ...recoveryFailureFields(error),
       ...(error?.outcomeUnknown ? { outcomeUnknown: true, nextAction: { operation: 'scope-context', method: 'GET',
         ...(error.requestId ? { requestId: error.requestId } : { uploadId: error.uploadId }), reuseOriginalInput: true, repeatPost: false } } : {}) };
   }

package/scope-context-journal.mjs

@@ -5,6 +5,7 @@ import { atomicMutationJson14, readMutationJson14 } from './local-mutation-files
 import { contextFail } from './scope-context-wire.mjs';
 import { readContextJournal, saveContextJournal } from './scope-context-state.mjs';
 import { contextRemote } from './scope-context-remote.mjs';
+import { consumeRecovery } from './local-recovery-budget.mjs';
 
 export async function archiveContextAttempt(location, state) {
   if (!state.attemptId) return;
@@ -20,22 +21,27 @@ export async function contextJournal(location, input) {
   let state = await readContextJournal(location, input);
   if (!state.previous && reusableSnapshot(state, input)) {
     await archiveContextAttempt(location, state);
+    consumeRecovery(state, 'attempt', state.signingAttemptId ?? state.attemptId);
     for (const field of ['rejection', 'checked', 'attestation', 'signingChallenge', 'signingAttemptId',
       'evidenceDescriptor', 'evidenceSignature', 'evidencePrepared', 'attestationRef', 'evidenceResult']) delete state[field];
     await saveContextJournal(location, state);
   } else if (state.previous || !state.pending && !state.evidencePending && !state.applied && (state.rejection
     || input.action === 'status' && state.completed || input.action === 'apply' && state.completed)) {
-    await archiveContextAttempt(location, state.previous ?? state); state = {};
+    const previous = state.previous ?? state;
+    await archiveContextAttempt(location, previous);
+    const recovery = previous.completed ? undefined : consumeRecovery(previous, 'attempt', previous.attemptId);
+    state = { ...(recovery ? { recovery } : {}) };
   }
   if (!state.attemptId) {
     state = { schemaVersion: 'entrorove.scope-context-journal/1.0', localBindingDigest: location.localBindingDigest,
-      input, attemptId: randomUUID() }; await saveContextJournal(location, state);
+      input, attemptId: randomUUID(), ...(state.recovery ? { recovery: state.recovery } : {}) }; await saveContextJournal(location, state);
   }
   return state;
 }
 export async function renewContextChallenge(location, state, proposal, dependencies) {
   if (state.pending || state.evidencePending) contextFail('Recover the original pending request before any challenge renewal');
   await archiveContextAttempt(location, state);
+  consumeRecovery(state, 'signing', state.signingAttemptId ?? state.attemptId);
   delete state.signingChallenge;
   state.signingAttemptId = randomUUID(); await saveContextJournal(location, state);
   const output = await contextRemote('signingChallenge', 'scope-runner-context-challenge', { flowId: location.binding.flowId,

package/scope-context-remote.mjs

@@ -6,6 +6,8 @@ import { acknowledgeAutomaticFeedback, queryAutomaticFeedback, verifyAutomaticFe
 import { readInvocations } from './local-invocations.mjs';
 import { saveContextJournal } from './scope-context-state.mjs';
 import { contextFail } from './scope-context-wire.mjs';
+import { prerequisiteError, retainPrerequisite, retryKnownPrerequisite } from './service-prerequisite.mjs';
+import { consumeRecovery } from './local-recovery-budget.mjs';
 
 const unknown = requestId => Object.assign(new Error('Context recovery outcome is unknown; query its original request with GET only'),
   { code: 'ENTROROVE_SCOPE_CONTEXT_UNKNOWN', outcomeUnknown: true, requestId });
@@ -15,6 +17,8 @@ async function recover(pending, dependencies) {
     const response = await requestTransport(origin, `/api/skill/status/${pending.requestId}`, {
       headers: { authorization: `Bearer ${token}`, ...ideClientHeaders() } });
     const result = parseTransportResponse(response, 'original context recovery status');
+    const prerequisite = prerequisiteError(response, result, { requestId: pending.requestId });
+    if (prerequisite) throw Object.assign(unknown(pending.requestId), { servicePrerequisite: prerequisite.servicePrerequisite });
     if (result?.output?.requestId !== pending.requestId || !response.ok || ['running', 'pending'].includes(result.output.status)) throw unknown(pending.requestId);
     if (pending.operation !== 'scope-runner-context-status' || result.feedback) {
       result.feedback ??= await queryAutomaticFeedback(pending.requestId, dependencies);
@@ -22,7 +26,8 @@ async function recover(pending, dependencies) {
       result.feedback = await acknowledgeAutomaticFeedback(result.feedback, origin, token, ideClientHeaders());
     }
     return { response, result };
-  } catch { throw unknown(pending.requestId); }
+  } catch (error) { throw Object.assign(unknown(pending.requestId),
+    error?.servicePrerequisite ? { servicePrerequisite: error.servicePrerequisite } : {}); }
 }
 async function notSent(pending, home) {
   try {
@@ -32,20 +37,26 @@ async function notSent(pending, home) {
 }
 export async function contextRemote(stage, operation, input, state, location, dependencies, save = saveContextJournal) {
   const requestId = buildInvocation(operation, input).requestId; let response, result;
-  if (state.pending) {
+  const existing = Boolean(state.pending);
+  if (existing) {
     if (state.pending.stage !== stage || state.pending.requestId !== requestId || state.pending.operation !== operation
       || canonical(state.pending.input) !== canonical(input)) contextFail('Recover the original context POST before another operation');
+  }
+  if (existing && !await retryKnownPrerequisite(state, location, save)) {
+    consumeRecovery(state, 'status'); await save(location, state);
     ({ response, result } = await recover(state.pending, dependencies));
-  } else {
-    state.pending = { stage, operation, input, requestId }; await save(location, state);
+  }
+  else {
+    if (!existing) { state.pending = { stage, operation, input, requestId }; await save(location, state); }
     try { ({ response, result } = await invokeRemoteResult({ operation, input }, dependencies)); }
     catch (error) {
+      if (await retainPrerequisite(error, state, location, save)) throw error;
       if (await notSent(state.pending, dependencies.home)) {
         delete state.pending; await save(location, state);
         throw Object.assign(new Error('Context request was not transmitted; repair its prerequisite and reuse the original input'),
           { code: 'ENTROROVE_SCOPE_CONTEXT_NOT_SENT', knownBeforeTransmission: true, requestId });
       }
-      throw unknown(requestId);
+      throw Object.assign(unknown(requestId), error?.servicePrerequisite ? { servicePrerequisite: error.servicePrerequisite } : {});
     }
   }
   if (!result?.output || result.output.requestId !== requestId) throw unknown(requestId);