@cairnkeep/cli 2.22.3 → 2.22.5

package/scripts/setup.mjs

@@ -1,13 +1,8 @@
 import { spawnSync } from "node:child_process";
 import {
-  closeSync,
-  constants,
   existsSync,
-  fstatSync,
   lstatSync,
   mkdirSync,
-  openSync,
-  readFileSync,
 } from "node:fs";
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
@@ -25,6 +20,7 @@ import { reconcileSetupPlan } from "./setup-reconcile.mjs";
 import { HARNESS_IDS, HARNESS_REGISTRY, machineSyncCommand, machineSyncCommands, requiredHarnessAssetPaths } from "./harness-registry.mjs";
 import { reconcilePlaybookInstructions } from "./playbook-instructions.mjs";
 import { selectManyPrompt, selectOnePrompt, supportsTerminalPrompts } from "./terminal-prompts.mjs";
+import { readStableFile, readStableJson, readStableText } from "./lib/stable-file.mjs";
 
 const HARNESSES = HARNESS_IDS;
 const GIT_MODES = Object.freeze(["init", "existing", "none"]);
@@ -360,33 +356,14 @@ function safeRequiredAsset(project, path, launcher) {
 }
 
 function readPrivateState(path) {
-  const info = lstatSync(path);
-  if (!info.isFile() || info.isSymbolicLink() || info.size > 1024 * 1024) throw new Error("unsafe");
-  if (process.platform !== "win32" && (info.mode & 0o777) !== 0o600) throw new Error("unsafe");
-  let descriptor;
-  try {
-    descriptor = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-    const opened = fstatSync(descriptor);
-    if (!opened.isFile() || opened.dev !== info.dev || opened.ino !== info.ino || opened.size > 1024 * 1024) throw new Error("unsafe");
-    return JSON.parse(readFileSync(descriptor, "utf8"));
-  } finally {
-    if (descriptor !== undefined) closeSync(descriptor);
-  }
+  return readStableJson(path, { label: "Setup state", maxBytes: 1024 * 1024, privateMode: 0o600 });
 }
 
 function readTomlConfig(path) {
   if (!existsSync(path)) return null;
-  const info = lstatSync(path);
-  if (!info.isFile() || info.isSymbolicLink() || info.size > 1024 * 1024) return null;
-  let descriptor;
   try {
-    descriptor = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-    const opened = fstatSync(descriptor);
-    if (!opened.isFile() || opened.dev !== info.dev || opened.ino !== info.ino || opened.size > 1024 * 1024) return null;
-    return readFileSync(descriptor, "utf8");
-  } finally {
-    if (descriptor !== undefined) closeSync(descriptor);
-  }
+    return readStableText(path, { label: "Harness configuration", maxBytes: 1024 * 1024 }).text;
+  } catch { return null; }
 }
 
 function codexMemorySection(text, id) {
@@ -457,10 +434,9 @@ export function diagnoseSetup(target = ".") {
       if (!safeStateAsset(path, record)) return incompleteDiagnosis(recovery);
       const destination = join(project, ...path.split("/"));
       if (!existsSync(destination)) return incompleteDiagnosis(recovery);
-      const info = lstatSync(destination);
-      if (!info.isFile() || info.isSymbolicLink()) return incompleteDiagnosis(recovery);
-      const digest = createHash("sha256").update(readFileSync(destination)).digest("hex");
-      if (digest !== record.digest || (process.platform !== "win32" && (info.mode & 0o777) !== record.mode)) return incompleteDiagnosis(recovery);
+      const current = readStableFile(destination, { label: "Setup asset", maxBytes: 1024 * 1024 });
+      const digest = createHash("sha256").update(current.bytes).digest("hex");
+      if (digest !== record.digest || (process.platform !== "win32" && (current.stat.mode & 0o777) !== record.mode)) return incompleteDiagnosis(recovery);
     }
     const requiredAssets = [...COMMON_SETUP_ASSETS, ...requiredHarnessAssetPaths(state.harnesses, state.memory)];
     const launchers = new Set(state.harnesses.map((id) => HARNESS_REGISTRY.find((harness) => harness.id === id).launcher.path));

package/scripts/test-ci-sharding.sh

@@ -29,5 +29,10 @@ for (const shard of ["1/3", "2/3", "3/3"]) assert.ok(workflow.includes(`shard: "
 assert.match(workflow, /run-smoke-suite\.mjs --shard \$\{\{ matrix\.shard \}\}/);
 assert.doesNotMatch(workflow.match(/  native-windows:[\s\S]*?\n  repository:/)?.[0] ?? "",
   /npm --prefix mcp-memory-server test/);
+const native = workflow.match(/  native-windows:[\s\S]*?\n  repository:/)?.[0] ?? "";
+const focused = native.indexOf("run: node mcp-memory-server/scripts/smoke-bounded-input-reads.mjs");
+assert.ok(focused > native.indexOf("npm --prefix mcp-memory-server run build"));
+assert.ok(focused < native.indexOf("- name: Native Windows CLI contracts"));
+assert.ok(focused < native.indexOf("- name: Sharded memory-server contracts"));
 console.log(`PASS: ${smokeChecks.length} memory-server contracts split once across balanced Windows shards (${weights.join(", ")})`);
 NODE

package/scripts/test-container-health.mjs

@@ -0,0 +1,56 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, writeFileSync, chmodSync, rmSync, symlinkSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { hardenPrivatePath } from "../mcp-memory-server/dist/platform-security.js";
+
+const source = readFileSync(new URL("../containers/healthcheck.mjs", import.meta.url), "utf8");
+const containerfile = readFileSync(new URL("../Containerfile", import.meta.url), "utf8");
+const quadlet = readFileSync(new URL("../containers/quadlet/cairnkeep.container", import.meta.url), "utf8");
+assert.match(quadlet, /^Secret=cairnkeep-http-token,type=mount,target=http-token,uid=10001,gid=10001,mode=0400$/m,
+  "the managed container secret must satisfy the probe's private-file contract");
+assert.match(containerfile, /COPY --chmod=644 containers\/healthcheck\.mjs \/opt\/cairnkeep\/containers\/healthcheck\.mjs/, "probe imports must resolve within the packaged server");
+assert.match(containerfile, /ln -s \/opt\/cairnkeep\/containers\/healthcheck\.mjs \/usr\/local\/lib\/cairnkeep\/container-healthcheck\.mjs/, "keep the established container probe path");
+assert.match(source, /parseHttpPort/, "health destination must use the server's numeric port parser");
+assert.match(source, /resolveHttpToken/, "health tokens must use the server's bounded resolver");
+const { containerHealthcheck } = await import("../containers/healthcheck.mjs");
+const root = mkdtempSync(join(tmpdir(), "cairn-health-security-"));
+const originalFetch = globalThis.fetch;
+const token = "synthetic-health-token-0123456789";
+const requests = [];
+try {
+  globalThis.fetch = async (url, options) => {
+    requests.push({ url: String(url), options });
+    return Response.json({ result: {} });
+  };
+  assert.equal(await containerHealthcheck({}), 0);
+  for (const port of ["7801@external.example.test", "1/path", "-1", "65536", " 7801 "]) {
+    assert.equal(await containerHealthcheck({ MCP_HTTP_PORT: port, CAIRN_MEMORY_HTTP_TOKEN: token }), 1);
+  }
+  assert.equal(requests.length, 0, "disabled or invalid configuration must not fetch");
+  assert.equal(await containerHealthcheck({ MCP_HTTP_PORT: "7801", CAIRN_MEMORY_HTTP_TOKEN: token }), 0);
+  assert.equal(requests[0].url, "http://127.0.0.1:7801/mcp");
+  assert.equal(requests[0].options.redirect, "manual");
+  assert.equal(requests[0].options.headers.Authorization, `Bearer ${token}`);
+  assert.equal(JSON.parse(requests[0].options.body).method, "initialize");
+  const tokenFile = join(root, "token");
+  writeFileSync(tokenFile, token + "\n", { mode: 0o600 });
+  hardenPrivatePath(tokenFile);
+  assert.equal(await containerHealthcheck({ MCP_HTTP_PORT: "7801", CAIRN_MEMORY_HTTP_TOKEN_FILE: tokenFile }), 0);
+  if (process.platform !== "win32") {
+    chmodSync(tokenFile, 0o644);
+    assert.equal(await containerHealthcheck({ MCP_HTTP_PORT: "7801", CAIRN_MEMORY_HTTP_TOKEN_FILE: tokenFile }), 1);
+    chmodSync(tokenFile, 0o600);
+    const link = join(root, "linked-token");
+    symlinkSync(tokenFile, link);
+    assert.equal(await containerHealthcheck({ MCP_HTTP_PORT: "7801", CAIRN_MEMORY_HTTP_TOKEN_FILE: link }), 1);
+  }
+  writeFileSync(tokenFile, "x".repeat(64 * 1024 + 1));
+  assert.equal(await containerHealthcheck({ MCP_HTTP_PORT: "7801", CAIRN_MEMORY_HTTP_TOKEN_FILE: tokenFile }), 1);
+  globalThis.fetch = async () => new Response(null, { status: 302, headers: { Location: "https://external.example.test" } });
+  assert.equal(await containerHealthcheck({ MCP_HTTP_PORT: "7801", CAIRN_MEMORY_HTTP_TOKEN: token }), 1);
+} finally {
+  globalThis.fetch = originalFetch;
+  rmSync(root, { recursive: true, force: true });
+}
+console.log("PASS: container health checks remain loopback-only with bounded, safe credentials and no redirects");

package/scripts/test-container.sh

@@ -110,7 +110,14 @@ done
   exit 1
 }
 cat "$tmp/write.out"
-"$ENGINE" exec "$name" node /usr/local/lib/cairnkeep/container-healthcheck.mjs
+# Exec probes see the original container environment, not the entrypoint's
+# loaded secret. The deliberately public bind fixture must be rejected.
+if "$ENGINE" exec "$name" node /usr/local/lib/cairnkeep/container-healthcheck.mjs; then
+  echo "FAIL: healthcheck accepted a non-private token file" >&2
+  exit 1
+fi
+# Exercise the same legacy entrypoint against a private, container-owned file.
+"$ENGINE" exec "$name" sh -c 'umask 077; cat /run/secrets/http-token > /tmp/health-token; CAIRN_MEMORY_HTTP_TOKEN_FILE=/tmp/health-token node /usr/local/lib/cairnkeep/container-healthcheck.mjs; status=$?; rm -f /tmp/health-token; exit "$status"'
 "$ENGINE" rm -f "$name" >/dev/null
 
 # Replacement boot with the same volume must recover the canary.

package/scripts/test-learning-docs.sh

@@ -192,5 +192,13 @@ for phrase in \
   }
 done
 grep -qF '`cairn security` | L28' "$coverage"
+for file in "$l28" "$video28" docs/security-assurance.md; do
+  for phrase in 'smoke-note-signatures.mjs' 'smoke-runtime-file-reads.mjs' 'smoke-bounded-input-reads.mjs' 'smoke-workspace-file-security.mjs' 'smoke-outbound-security.mjs' 'test-runtime-file-security.mjs' 'test-omp-staged-security.mjs' 'test-container-health.mjs' 'coverage-guided'; do
+    grep -qF -- "$phrase" "$file" || {
+      echo "Security learning document missing runtime regression boundary: $file ($phrase)" >&2
+      exit 1
+    }
+  done
+done
 
 echo "PASS: public learning path structure, readiness, links, and version alignment"

package/scripts/test-omp-staged-security.mjs

@@ -0,0 +1,110 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import { syncBuiltinESMExports } from "node:module";
+import { tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const repository = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const root = fs.mkdtempSync(join(tmpdir(), "cairn-omp-staged-security-"));
+const originalRead = fs.readFileSync;
+const originalDescriptorRead = fs.readSync;
+const originalOpen = fs.openSync;
+const failures = [];
+function restore() {
+  fs.readFileSync = originalRead;
+  fs.readSync = originalDescriptorRead;
+  fs.openSync = originalOpen;
+  syncBuiltinESMExports();
+}
+function mock() {
+  const handlers = new Map();
+  const commands = new Map();
+  const messages = [];
+  return {
+    handlers, commands, messages,
+    pi: {
+      on(event, handler) { handlers.set(event, handler); },
+      registerCommand(name, command) { commands.set(name, command); },
+      getAllTools() { return []; },
+      sendMessage(payload) { messages.push(payload); },
+    },
+  };
+}
+function context(project, ui) {
+  return { cwd: project, agent: { kind: "main" }, hasUI: true, ui: { notify(text) { ui.push(text); } } };
+}
+async function control(name, operation) {
+  try { await operation(); }
+  catch (error) { failures.push(`${name}: ${error.message}`); }
+}
+try {
+  fs.writeFileSync(join(root, "package.json"), '{"type":"module"}');
+  const extension = join(root, "capture.ts");
+  fs.writeFileSync(extension, fs.readFileSync(join(repository, "omp", "extensions", "cairnkeep-capture.ts"), "utf8").replaceAll("@@INFRA_ROOT@@", repository.replaceAll("\\", "/")));
+  const { default: factory } = await import(pathToFileURL(extension).href);
+  const project = join(root, "project");
+  const staging = join(project, ".planning", "memory-staging");
+  fs.mkdirSync(staging, { recursive: true });
+  const staged = join(staging, "fixture.json");
+  const payload = '{"candidates":[{"value":"reviewed fixture"}]}';
+  fs.writeFileSync(staged, payload);
+  let instance = mock();
+  factory(instance.pi);
+  let ui = [];
+  await instance.handlers.get("session_start")({}, context(project, ui));
+  assert.equal(instance.messages.length, 1);
+  assert.match(ui[0], /1 memory candidate file/);
+  assert.match(instance.messages[0].content, /memory_write/);
+
+  const outside = join(root, "outside.json");
+  fs.writeFileSync(outside, '{"candidates":[{"value":"private-external-sentinel"}]}');
+  if (process.platform !== "win32") {
+    fs.symlinkSync(outside, join(staging, "linked.json"));
+    await control("OMP staged symlink exclusion", async () => {
+      instance = mock(); factory(instance.pi); ui = [];
+      await instance.handlers.get("session_start")({}, context(project, ui));
+      assert.match(ui[0], /1 memory candidate file/);
+      ui = [];
+      await instance.commands.get("cairn-staged").handler("", context(project, ui));
+      assert.equal(ui.join("\n").includes("private-external-sentinel"), false);
+    });
+    fs.unlinkSync(join(staging, "linked.json"));
+  }
+  await control("OMP staged growth", async () => {
+    const descriptors = new Set();
+    let grew = false;
+    let unbounded = false;
+    const change = () => {
+      if (!grew) { grew = true; fs.appendFileSync(staged, " ".repeat(64 * 1024)); }
+    };
+    fs.openSync = (path, ...args) => {
+      const fd = originalOpen(path, ...args);
+      if (path === staged) descriptors.add(fd);
+      return fd;
+    };
+    fs.readSync = (fd, ...args) => { if (descriptors.has(fd)) change(); return originalDescriptorRead(fd, ...args); };
+    fs.readFileSync = (path, ...args) => {
+      if (path === staged || descriptors.has(path)) { unbounded = true; change(); }
+      return originalRead(path, ...args);
+    };
+    syncBuiltinESMExports();
+    instance = mock(); factory(instance.pi); ui = [];
+    try {
+      await instance.handlers.get("session_start")({}, context(project, ui));
+      assert.equal(grew, true);
+      assert.equal(unbounded, false);
+      assert.equal(instance.messages.length, 0, "changed staged content must not become wakeup evidence");
+    } finally { restore(); }
+  });
+  fs.writeFileSync(staged, payload);
+  fs.writeFileSync(join(staging, "oversized.json"), '{"candidates":[{"value":"oversized-sentinel"}]}' + " ".repeat(8192));
+  ui = []; instance = mock(); factory(instance.pi);
+  await instance.commands.get("cairn-staged").handler("", context(project, ui));
+  await control("OMP listing bound", () => { assert.equal(ui.join("\n").includes("oversized-sentinel"), false); });
+  assert.deepEqual(failures, [], "staged inspection must be bounded, contained and fail open without trusting unsafe content");
+} finally {
+  restore();
+  fs.rmSync(root, { recursive: true, force: true });
+}
+console.log("PASS: OMP staged inspection rejects symlinks, growth and oversized content without blocking the session");

package/scripts/test-release-verification.mjs

@@ -0,0 +1,109 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { releaseAttestationArguments, validateReleaseOptions, verifyPublishedRelease } from "./lib/release-verification.mjs";
+
+const options = { repo: "example/project", version: "1.2.3", commit: "a".repeat(40), tree: "b".repeat(40), ciRun: "12", publishRun: "13", securityRun: "14" };
+const hash = bytes => createHash("sha256").update(bytes).digest("hex");
+function fixture() {
+  const tar = Buffer.from("synthetic-package");
+  const sbom = Buffer.from(JSON.stringify({ bomFormat: "CycloneDX", specVersion: "1.6", metadata: { component: { version: options.version } } }));
+  const sums = Buffer.from(`${hash(tar)}  ./cairnkeep-cli-1.2.3.tgz\n${hash(sbom)}  ./cairnkeep-cli-1.2.3.cdx.json\n`);
+  const candidate = new Map([["cairnkeep-cli-1.2.3.tgz", tar], ["cairnkeep-cli-1.2.3.cdx.json", sbom], ["SHA256SUMS", sums],
+    ["RELEASE-CANDIDATE.json", Buffer.from(JSON.stringify({ schema_version: 1, tree: options.tree, version: options.version }))]]);
+  const released = new Map([...candidate].filter(([name]) => name !== "RELEASE-CANDIDATE.json"));
+  const api = new Map([
+    ["actions/runs/12", { conclusion: "success", path: ".github/workflows/ci.yml", head_sha: options.commit }],
+    ["actions/runs/13", { conclusion: "success", path: ".github/workflows/publish.yml", head_sha: options.commit, event: "release" }],
+    ["actions/runs/14", { conclusion: "success", path: ".github/workflows/security.yml", head_sha: options.commit }],
+    [`git/commits/${options.commit}`, { tree: { sha: options.tree } }],
+    ["git/ref/tags/v1.2.3", { object: { type: "commit", sha: options.commit } }],
+    ["actions/runs/12/artifacts?per_page=100", { artifacts: [{ id: 5, name: `release-candidate-${options.tree}`, expired: false }] }],
+    ["releases/tags/v1.2.3", { draft: false, prerelease: false, tag_name: "v1.2.3" }],
+  ]);
+  const objects = new Map();
+  const add = value => { const digest = `sha256:${hash(Buffer.from(JSON.stringify(value)))}`; objects.set(digest, value); return digest; };
+  const manifests = [];
+  for (const architecture of ["amd64", "arm64"]) {
+    const config = add({ os: "linux", architecture, config: { Labels: { "org.opencontainers.image.revision": options.commit } } });
+    const image = add({ config: { digest: config } });
+    manifests.push({ digest: image, platform: { os: "linux", architecture } });
+    const statement = add({ predicateType: "https://spdx.dev/Document", subject: [{ digest: { sha256: image.slice(7) } }], predicate: { spdxVersion: "SPDX-2.3" } });
+    const attestation = add({ layers: [{ digest: statement }] });
+    manifests.push({ digest: attestation, annotations: { "vnd.docker.reference.digest": image, "vnd.docker.reference.type": "attestation-manifest" } });
+  }
+  const index = add({ manifests });
+  let signed = 0, signatures = 0;
+  const io = {
+    api: async path => { assert(api.has(path), `unexpected API request ${path}`); return api.get(path); },
+    candidate: async () => candidate, release: async () => released,
+    registry: async () => ({ version: options.version, dist: { tarball: "https://registry.npmjs.org/package.tgz", integrity: `sha512-${createHash("sha512").update(tar).digest("base64")}` } }),
+    tarball: async () => tar,
+    oci: async (_image, _kind, ref) => { const digest = ref.startsWith("sha256:") ? ref : index; return { digest, value: objects.get(digest) }; },
+    verifyAttestation: async (_image, digest, expected) => { assert.equal(digest, index); assert.deepEqual(expected, options); signed++; return true; },
+    verifyNpm: async bytes => { assert(bytes.equals(tar)); signatures++; return true; },
+  };
+  return { io, api, candidate, released, objects, manifests, index, counts: () => ({ signed, signatures }) };
+}
+const originalFetch = globalThis.fetch;
+globalThis.fetch = () => { throw new Error("offline release controls must not use the network"); };
+try {
+  for (const invalid of [{ repo: "../.." }, { repo: "owner/../secret" }, { version: "01.2.3" }, { version: "1.2.3-beta" },
+    { commit: "main" }, { ciRun: "0" }, { publishRun: "not-a-run" }]) {
+    assert.throws(() => validateReleaseOptions({ ...options, ...invalid }));
+  }
+  const attestationArgs = releaseAttestationArguments("example/project", `sha256:${"d".repeat(64)}`, options);
+  for (const [flag, value] of [["--source-digest", options.commit], ["--source-ref", "refs/tags/v1.2.3"],
+    ["--cert-identity", "https://github.com/example/project/.github/workflows/publish.yml@refs/tags/v1.2.3"],
+    ["--cert-oidc-issuer", "https://token.actions.githubusercontent.com"], ["--predicate-type", "https://slsa.dev/provenance/v1"]]) {
+    assert.equal(attestationArgs[attestationArgs.indexOf(flag) + 1], value);
+  }
+  assert(attestationArgs.includes("--deny-self-hosted-runners"));
+  assert(!attestationArgs.includes("--signer-workflow"), "mutually exclusive identity flags cannot be combined");
+  assert.throws(() => releaseAttestationArguments("other/project", `sha256:${"d".repeat(64)}`, options));
+  const valid = fixture();
+  const report = await verifyPublishedRelease(options, valid.io);
+  assert.equal(report.status, "verified"); assert.equal(report.images.length, 2);
+  assert.equal(report.deployment_verified, false); assert.equal(report.full_image_layer_pull_verified, false);
+  assert.deepEqual(valid.counts(), { signed: 2, signatures: 1 });
+  for (const [name, mutate] of [
+    ["failed CI", f => { f.api.get("actions/runs/12").conclusion = "failure"; }],
+    ["wrong CI workflow", f => { f.api.get("actions/runs/12").path = ".github/workflows/other.yml"; }],
+    ["failed security", f => { f.api.get("actions/runs/14").conclusion = "failure"; }],
+    ["wrong security workflow", f => { f.api.get("actions/runs/14").path = ".github/workflows/other.yml"; }],
+    ["different security tree", f => { const sha = "c".repeat(40); f.api.get("actions/runs/14").head_sha = sha; f.api.set(`git/commits/${sha}`, { tree: { sha: "d".repeat(40) } }); }],
+    ["different tree", f => { f.api.get(`git/commits/${options.commit}`).tree.sha = "c".repeat(40); }],
+    ["different tag", f => { f.api.get("git/ref/tags/v1.2.3").object.sha = "c".repeat(40); }],
+    ["expired candidate", f => { f.api.get("actions/runs/12/artifacts?per_page=100").artifacts[0].expired = true; }],
+    ["failed publication", f => { f.api.get("actions/runs/13").conclusion = "failure"; }],
+    ["wrong publish source", f => { f.api.get("actions/runs/13").head_sha = "c".repeat(40); }],
+    ["draft release", f => { f.api.get("releases/tags/v1.2.3").draft = true; }],
+    ["candidate tampering", f => { f.candidate.set("cairnkeep-cli-1.2.3.tgz", Buffer.from("tampered")); }],
+    ["asset tampering", f => { f.released.set("cairnkeep-cli-1.2.3.cdx.json", Buffer.from("tampered")); }],
+    ["undeclared candidate", f => { f.candidate.set("extra", Buffer.from("extra")); }],
+    ["checksum traversal", f => { f.candidate.set("SHA256SUMS", Buffer.from(`${"a".repeat(64)}  ../escape\n`)); }],
+    ["registry mismatch", f => { f.io.tarball = async () => Buffer.from("different"); }],
+    ["registry credentials", f => { f.io.registry = async () => ({ version: "1.2.3", dist: { tarball: "https://secret@registry.npmjs.org/package.tgz" } }); }],
+    ["signature failure", f => { f.io.verifyNpm = async () => false; }],
+    ["missing architecture", f => { f.objects.get(f.index).manifests = f.manifests.filter(m => m.platform?.architecture !== "arm64"); }],
+    ["wrong image revision", f => { for (const value of f.objects.values()) if (value.config?.Labels) value.config.Labels["org.opencontainers.image.revision"] = "c".repeat(40); }],
+    ["unbound SBOM", f => { for (const value of f.objects.values()) if (value.subject) value.subject[0].digest.sha256 = "c".repeat(64); }],
+    ["provenance failure", f => { f.io.verifyAttestation = async () => false; }],
+  ]) { const f = fixture(); mutate(f); await assert.rejects(() => verifyPublishedRelease(options, f.io), undefined, name); }
+  const scratch = mkdtempSync(join(tmpdir(), "cairn-release-report-test-"));
+  try {
+    const output = join(scratch, "existing.json"); writeFileSync(output, "retained-report\n");
+    const command = fileURLToPath(new URL("verify-published-release.mjs", import.meta.url));
+    const result = spawnSync(process.execPath, [command, "--version", options.version, "--commit", options.commit,
+      "--tree", options.tree, "--ci-run", options.ciRun, "--security-run", options.securityRun, "--publish-run", options.publishRun,
+      "--out", output, "--gh", join(scratch, "missing-command")], { encoding: "utf8", timeout: 3000 });
+    assert.notEqual(result.status, 0); assert.match(result.stderr, /output already exists/);
+    assert.equal(readFileSync(output, "utf8"), "retained-report\n");
+    assert.equal(result.stdout, "");
+  } finally { rmSync(scratch, { recursive: true, force: true }); }
+  console.log("PASS: offline exact-tree release, assets, registry, signatures, architectures, SBOM and provenance controls");
+} finally { globalThis.fetch = originalFetch; }

package/scripts/test-release-verification.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+node "$ROOT/scripts/test-release-verification.mjs"