deadbyte-mcp 0.15.14 → 0.15.16

package/test/commander-remote-bridge-r47.test.mjs

@@ -0,0 +1,39 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { registerCommanderRemoteBridge } from '../src/commander-remote-bridge-r47.mjs';
+
+function fakeServer(){
+  const tools=new Map();
+  return {tools,registerTool(name,meta,handler){tools.set(name,{meta,handler});}};
+}
+function fakePlane(){
+  const calls=[];
+  const result=(op,value)=>{calls.push({op,value});return {status:'ok',op,value};};
+  return {calls,pair:async value=>result('pair',value),status:async value=>result('status',value),reportOnline:async value=>result('report_online',value),probe:async value=>result('probe',value),dispatch:async value=>result('dispatch',value),revoke:async value=>result('revoke',value),rotateCredential:async value=>result('rotate_credential',value),list:async()=>result('list',{})};
+}
+
+test('R47 remote Commander bridge routes remote_device directly to remote-device-r44 plane',async()=>{
+  const server=fakeServer(),plane=fakePlane();
+  registerCommanderRemoteBridge(server,{remoteDevicePlane:plane});
+  assert.ok(server.tools.has('remote_device'));assert.ok(server.tools.has('remote_mcp'));
+  const tool=server.tools.get('remote_device').handler;const id='a'.repeat(64);
+  await tool({op:'pair',public_key_spki_base64:'ZmFrZQ==',display_name:'lab'});
+  await tool({op:'status',device_id:id});await tool({op:'report_online',device_id:id,epoch:1,connection_id:'c'});
+  await tool({op:'probe',device_id:id,epoch:1});await tool({op:'dispatch',device_id:id,epoch:1,capability_id:'machine.status',payload:{},request_id:'b'.repeat(64)});
+  await tool({op:'revoke',device_id:id,epoch:1});await tool({op:'rotate_credential',device_id:id,epoch:1,encrypted_bundle_base64:'dG9rZW4=',expected_previous_sha256:null});await tool({op:'list'});
+  assert.deepEqual(plane.calls.map(x=>x.op),['pair','status','report_online','probe','dispatch','revoke','rotate_credential','list']);
+});
+
+test('R47 remote_mcp is a thin dispatch surface and never shells out to Commander',async()=>{
+  const server=fakeServer(),plane=fakePlane();registerCommanderRemoteBridge(server,{remoteDevicePlane:plane});
+  const id='c'.repeat(64),request='d'.repeat(64);
+  const result=await server.tools.get('remote_mcp').handler({device_id:id,epoch:7,capability_id:'coding.file_read',payload:{path:'README.md'},request_id:request});
+  assert.equal(result.status,'ok');
+  assert.deepEqual(plane.calls,[{op:'dispatch',value:{deviceId:id,epoch:7,capabilityId:'coding.file_read',payload:{path:'README.md'},requestId:request}}]);
+});
+
+test('R47 remote surfaces fail closed as unavailable when no remote-device-r44 plane is wired',async()=>{
+  const server=fakeServer();registerCommanderRemoteBridge(server,{});
+  const result=await server.tools.get('remote_device').handler({op:'list'});
+  assert.equal(result.status,'unavailable');assert.match(result.error,/remote-device-r44 plane is not configured/);
+});

package/test/commander-remote-plane-r47.test.mjs

@@ -0,0 +1,25 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+
+const sha=value=>createHash('sha256').update(value).digest('hex');
+
+test('R47 production server wires native remote device plane',async()=>{
+  const server=await readFile(new URL('../src/mcp-server.mjs',import.meta.url),'utf8');
+  assert.match(server,/createRemoteDevicePlaneR44/);
+  assert.match(server,/createCommanderRemoteRelayR47/);
+  assert.match(server,/registerCommanderRemoteBridge/);
+  assert.match(server,/DEADBYTE_REMOTE_RELAY_ENDPOINT\|\|process\.env\.DEADBYTE_REMOTE_ENDPOINT/);
+  assert.match(server,/DEADBYTE_REMOTE_CAPABILITIES/);
+  assert.match(server,/remote-device-r44/);
+  assert.equal((server.match(/commander-remote-relay-r47\.mjs/g)??[]).length,1);
+});
+
+test('R47 relay is native MCP client and contains no Desktop Commander dependency',async()=>{
+  const relay=await readFile(new URL('../src/commander-remote-relay-r47.mjs',import.meta.url),'utf8');
+  assert.match(relay,/StreamableHTTPClientTransport/);
+  assert.match(relay,/client\.callTool/);
+  assert.doesNotMatch(relay,/@wonderwhy-er\/desktop-commander/);
+  assert.equal(sha(relay).length,64);
+});

package/test/commander-torture-r47.test.mjs

@@ -0,0 +1,146 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { generateTrustKeypair } from '../src/trust.mjs';
+import { loadCodingPolicy } from '../src/coding-plane.mjs';
+import { createMachineFsRuntime } from '../src/machine-fs.mjs';
+import { PROCESS_GRANT_SCHEMA, PROCESS_POLICY_SCHEMA, loadProcessPolicy } from '../src/process-policy.mjs';
+import { createProcessRuntime } from '../src/process-runtime.mjs';
+import { createHash } from 'node:crypto';
+
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const sleep=ms=>new Promise(r=>setTimeout(r,ms));
+
+async function fsFixture(){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-torture-fs-')), project=path.join(root,'project');
+  await mkdir(project);
+  const policyPath=path.join(root,'policy.json'), grantPath=path.join(root,'grant.json');
+  await writeFile(policyPath,JSON.stringify({schema:'deadbyte.coding-policy.v1',enabled:true,lease_file:grantPath,evidence_dir:path.join(root,'evidence'),roots:{project:{path:project,read:true,write:true,exec:false,deny_paths:['blocked']}},commands:{},max_read_bytes:65536,max_write_bytes:65536}));
+  const policy=await loadCodingPolicy(policyPath);
+  await writeFile(grantPath,JSON.stringify({schema:'deadbyte.coding-grant.v2',policy_sha256:policy.policy_sha256,instance_nonce:'c'.repeat(64),root_ids:['project'],granted_at_utc:new Date().toISOString()}));
+  const keys=await generateTrustKeypair({privateKeyPath:path.join(root,'private.pem'),publicKeyPath:path.join(root,'public.pem')});
+  return {root,project,runtime:createMachineFsRuntime({policy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath})};
+}
+
+async function processFixture(){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-torture-proc-')), project=path.join(root,'project'),trust=path.join(root,'trust');
+  await mkdir(project); await mkdir(trust);
+  const host=path.resolve('bin/deadbyte-process-host.exe'), exe='C:\\Windows\\System32\\cmd.exe';
+  const grantFile=path.join(root,'grant.json'), stateDir=path.join(root,'state'), policyPath=path.join(root,'policy.json');
+  await writeFile(policyPath,JSON.stringify({schema:PROCESS_POLICY_SCHEMA,enabled:true,grant_file:grantFile,state_dir:stateDir,native_host:{path:host,sha256:sha(await readFile(host))},roots:{core:{path:project,deny_paths:[]}},profiles:{
+    echo:{executable:exe,executable_sha256:sha(await readFile(exe)),root_ids:['core'],prefix_args:['/d','/c'],max_args:4,max_arg_bytes:256,max_sessions:8,max_input_bytes:4096,max_retained_output_bytes:65536,env_allow:['PATH','TEMP','TMP'],input_actions:{}},
+    hold:{executable:exe,executable_sha256:sha(await readFile(exe)),root_ids:['core'],transport:'pipe',prefix_args:['/d','/q'],max_args:0,max_arg_bytes:256,max_sessions:8,max_input_bytes:4096,max_retained_output_bytes:65536,env_allow:['PATH','TEMP','TMP'],input_actions:{}}
+  }}));
+  const policy=await loadProcessPolicy(policyPath);
+  await writeFile(grantFile,JSON.stringify({schema:PROCESS_GRANT_SCHEMA,policy_sha256:policy.policy_sha256,instance_nonce:'d'.repeat(64),profile_ids:['echo','hold'],root_ids:['core'],granted_at_utc:new Date().toISOString()}));
+  const keys=await generateTrustKeypair({privateKeyPath:path.join(trust,'private.pem'),publicKeyPath:path.join(trust,'public.pem')});
+  return {root,runtime:createProcessRuntime({policy,signingKeyPath:keys.privateKeyPath,verifyKeyPath:keys.publicKeyPath})};
+}
+
+test('torture: concurrent stale writers permit exactly one winner per version',async()=>{
+  const f=await fsFixture();
+  try{
+    let expected='absent', winners=0, conflicts=0;
+    for(let round=0;round<12;round++){
+      const target='race.txt';
+      const before=await f.runtime.state({rootId:'project',relativePath:target});
+      expected=before.exists?before.sha256:'absent';
+      const results=await Promise.allSettled(Array.from({length:8},(_,i)=>f.runtime.write({rootId:'project',relativePath:target,content:`round=${round};writer=${i}`,expectedSha256:expected})));
+      const ok=results.filter(x=>x.status==='fulfilled'&&x.value.status==='committed');
+      winners+=ok.length; conflicts+=results.filter(x=>x.status==='rejected').length;
+      assert.equal(ok.length,1);
+      assert.equal(conflicts>=round+7,true);
+      const current=await f.runtime.stat({rootId:'project',relativePath:target,hash:true});
+      assert.equal(current.sha256,ok[0].value.sha256);
+    }
+    assert.equal(winners,12);
+  } finally { await rm(f.root,{recursive:true,force:true}); }
+});
+
+test('torture: move/delete races cannot duplicate or silently lose an object',async()=>{
+  const f=await fsFixture();
+  try{
+    await f.runtime.write({rootId:'project',relativePath:'source.txt',content:'immutable',expectedSha256:'absent'});
+    const s=await f.runtime.stat({rootId:'project',relativePath:'source.txt',hash:true});
+    const [a,b]=await Promise.allSettled([
+      f.runtime.move({rootId:'project',sourcePath:'source.txt',destinationPath:'a.txt',expectedSourceIdentity:s.identity_sha256}),
+      f.runtime.move({rootId:'project',sourcePath:'source.txt',destinationPath:'b.txt',expectedSourceIdentity:s.identity_sha256})
+    ]);
+    assert.equal([a,b].filter(x=>x.status==='fulfilled').length,1);
+    const stateA=await f.runtime.state({rootId:'project',relativePath:'a.txt'});
+    const stateB=await f.runtime.state({rootId:'project',relativePath:'b.txt'});
+    assert.equal(Number(stateA.exists)+Number(stateB.exists),1);
+    const winner=stateA.exists?stateA:stateB;
+    assert.equal(winner.sha256,sha(Buffer.from('immutable')));
+  } finally { await rm(f.root,{recursive:true,force:true}); }
+});
+
+test('torture: pagination remains deterministic under concurrent directory churn',async()=>{
+  const f=await fsFixture();
+  try{
+    for(let i=0;i<40;i++) await writeFile(path.join(f.project,`f${String(i).padStart(2,'0')}.txt`),String(i));
+    let cursor=null;
+    const first=await f.runtime.list({rootId:'project',relativePath:'.',limit:7,cursor});
+    assert.equal(first.entries.length,7);
+    cursor=first.next_cursor;
+    const churn=(async()=>{for(let i=0;i<20;i++){
+      const p=path.join(f.project,"z"+i+".tmp");
+      await writeFile(p,'z');
+      await rm(p,{force:true});
+    }
+    await writeFile(path.join(f.project,'persistent-churn.txt'),'changed');})(); 
+    await churn;
+    await assert.rejects(
+      ()=>f.runtime.list({rootId:'project',relativePath:'.',limit:7,cursor}),
+      /cursor snapshot changed/i
+    );
+  } finally {
+    for (let i=0;i<20;i++) {
+      try { await rm(f.root,{recursive:true,force:true}); break; }
+      catch (error) { if (error?.code!=='EBUSY' && error?.code!=='ENOTEMPTY') throw error; await sleep(50); }
+    }
+  }
+});
+
+test('torture: process cancellation race converges to one verified terminal state', {skip:process.platform!=='win32'}, async()=>{
+  const f=await processFixture();
+  try{
+    const s=await f.runtime.start({profileId:'hold',rootId:'core',cwd:'.',args:[]});
+    const results=await Promise.allSettled([
+      f.runtime.cancel({sessionId:s.session_id,reason:'race-a'}),
+      f.runtime.cancel({sessionId:s.session_id,reason:'race-b'}),
+      f.runtime.status({sessionId:s.session_id})
+    ]);
+    const cancels=results.filter(x=>x.status==='fulfilled'&&x.value.termination);
+    assert.ok(cancels.length>=1);
+    const deadline=Date.now()+5000; let status=await f.runtime.status({sessionId:s.session_id});
+    while(status.state==='running'&&Date.now()<deadline){await sleep(20);status=await f.runtime.status({sessionId:s.session_id});}
+    assert.notEqual(status.state,'running');
+    assert.ok(status.operation_receipt); assert.ok(status.operation_id);
+    assert.equal((await f.runtime.verifyEventJournal({sessionId:s.session_id})).ok,true);
+    assert.equal((await f.runtime.verifyOperationEvidence({sessionId:s.session_id})).ok,true);
+  } finally { await rm(f.root,{recursive:true,force:true}); }
+});
+
+test('torture: process session identity cannot be replaced by a foreign session id', {skip:process.platform!=='win32'}, async()=>{
+  const f=await processFixture();
+  try{
+    const a=await f.runtime.start({profileId:'echo',rootId:'core',cwd:'.',args:['echo','A']});
+    const b=await f.runtime.start({profileId:'echo',rootId:'core',cwd:'.',args:['echo','B']});
+    await assert.rejects(()=>f.runtime.read({sessionId:'f'.repeat(64),offset:0,maxBytes:64}),/session|not found|unknown/i);
+    await f.runtime.cancel({sessionId:a.session_id,reason:'cleanup'});
+    await f.runtime.cancel({sessionId:b.session_id,reason:'cleanup'});
+    for (const id of [a.session_id,b.session_id]) {
+      let s=await f.runtime.status({sessionId:id});
+      for(let i=0;i<100&&s.state==='running';i++){await sleep(20);s=await f.runtime.status({sessionId:id});}
+      assert.notEqual(s.state,'running');
+    }
+    for(let i=0;i<20;i++){
+      try { await rm(f.root,{recursive:true,force:true}); return; }
+      catch(error){ if(error?.code!=='EBUSY') throw error; await sleep(50); }
+    }
+    await rm(f.root,{recursive:true,force:true});
+  } finally { await rm(f.root,{recursive:true,force:true}); }
+});

package/test/full-max-catalog-r46.test.mjs

@@ -15,7 +15,7 @@ const desktopPolicyPath=path.join(repoRoot,'controller','deadbyte-desktop-policy
 const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
 const absent=async p=>{try{await access(p);return false;}catch(e){if(e?.code==='ENOENT')return true;throw e;}};
 
-test('R46 real max-runtime full stdio catalog is exactly 83 with skill and four Desktop primitives while authority remains disarmed',async()=>{
+test.skip('R46 historical max-runtime full stdio catalog contract is frozen at 84; current R47 runtime intentionally supersedes it',async()=>{
   const f=await createR34Fixture({authority:'disarmed'});
   const processPolicyPath=path.join(f.root,'process-policy.json');
   const processGrant=path.join(f.root,'process-grant.json');

package/test/full-max-catalog-r47.test.mjs

@@ -0,0 +1,78 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { access, mkdir, readFile, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { Client } from '@modelcontextprotocol/client';
+import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotocol/client/stdio';
+import { createR34Fixture } from './helpers/autonomous-r34-fixture.mjs';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repoRoot=path.resolve(here,'..');
+const serverPath=path.join(repoRoot,'src','mcp-server.mjs');
+const desktopPolicyPath=path.join(repoRoot,'controller','deadbyte-desktop-policy.json');
+const catalogPath=path.join(repoRoot,'docs','R47-FULL-TOOL-CATALOG.json');
+const absent=async p=>{try{await access(p);return false;}catch(e){if(e?.code==='ENOENT')return true;throw e;}};
+
+test('R47 runtime full stdio catalog exactly matches canonical registration surface',async()=>{
+  const canonical=JSON.parse(await readFile(catalogPath,'utf8'));
+  assert.equal(canonical.schema,'deadbyte.r47-full-catalog.v1');
+  assert.equal(canonical.train,'R47');
+  assert.ok(Array.isArray(canonical.tools));
+  assert.equal(canonical.tool_count,canonical.tools.length);
+  assert.equal(new Set(canonical.tools).size,canonical.tools.length);
+  assert.deepEqual([...canonical.tools].sort(),canonical.tools);
+
+  const f=await createR34Fixture({authority:'disarmed'});
+  const processPolicyPath=path.join(f.root,'process-policy.json');
+  const processGrant=path.join(f.root,'process-grant.json');
+  const processState=path.join(f.root,'process-state');
+  const hostPolicyPath=path.join(f.root,'host-policy.json');
+  const hostArm=path.join(f.root,'host-arm.json');
+  const desktopRaw=JSON.parse(await readFile(desktopPolicyPath,'utf8'));
+  const desktopGrant=desktopRaw.grant_file;
+  await mkdir(processState,{recursive:true});
+  const nodeSha=createHash('sha256').update(await readFile(process.execPath)).digest('hex');
+  await writeFile(processPolicyPath,JSON.stringify({
+    schema:'deadbyte.process-policy.v1',enabled:true,grant_file:processGrant,state_dir:processState,
+    native_host:{path:process.execPath,sha256:nodeSha},
+    roots:{core:{path:f.project,deny_paths:[]}},
+    profiles:{node:{executable:process.execPath,executable_sha256:nodeSha,root_ids:['core'],prefix_args:[],transport:'pipe',max_args:8,max_arg_bytes:1024,max_sessions:2,max_input_bytes:65536,max_retained_output_bytes:262144,env_allow:['PATH','TEMP','TMP'],input_actions:{ping:'PING\\r\\n'}}}
+  },null,2));
+  await writeFile(hostPolicyPath,JSON.stringify({
+    schema:'deadbyte.host-policy.v1',enabled:true,arm_file:hostArm,max_read_bytes:262144,max_write_bytes:1048576,
+    roots:{core:{path:f.project,read:true,write:true,exec:true}},
+    commands:{node_script:{kind:'script',executable:process.execPath,executable_sha256:nodeSha,root_ids:['core'],prefix_args:[],extensions:['.mjs'],timeout_ms:5000,max_output_bytes:65536}}
+  },null,2));
+  const codingLease=f.codingPolicy.lease_file;
+  const autonomousLease=f.policy.lease_file;
+  for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority unexpectedly armed before start: '+q);
+
+  const client=new Client({name:'deadbyte-r47-full-catalog',version:'0.15.16'},{versionNegotiation:{mode:{pin:'2026-07-28'}}});
+  const env={
+    ...getDefaultEnvironment(),DEADBYTE_CAPABILITY_PROFILE:'full',DEADBYTE_AUDIT_RUNTIME:'0',
+    DEADBYTE_STATE_ROOT:path.join(f.root,'state'),DEADBYTE_WORKSPACE_ROOT:f.root,
+    DEADBYTE_SIGNING_KEY:f.keys.privateKeyPath,DEADBYTE_VERIFY_KEY:f.keys.publicKeyPath,
+    DEADBYTE_PRIVILEGED_POLICY:hostPolicyPath,DEADBYTE_MACHINE_RUNTIME:'1',DEADBYTE_AGENT_RUNTIME:'1',
+    DEADBYTE_PROCESS_RUNTIME:'1',DEADBYTE_PROCESS_POLICY:processPolicyPath,DEADBYTE_CODING_RUNTIME:'1',
+    DEADBYTE_CODING_POLICY:path.join(f.root,'coding-policy.json'),DEADBYTE_MACHINE_FS_RUNTIME:'1',
+    DEADBYTE_OBSERVATION_RUNTIME:'1',DEADBYTE_DESKTOP_RUNTIME:'1',DEADBYTE_DESKTOP_POLICY:desktopPolicyPath,
+    DEADBYTE_AUTONOMOUS_RUNTIME:'1',DEADBYTE_AUTONOMOUS_POLICY:path.join(f.root,'autonomous-policy.json'),
+    DEADBYTE_AUTONOMOUS_SUPERVISOR_MODE:'external'
+  };
+  const transport=new StdioClientTransport({command:process.execPath,args:[serverPath],cwd:repoRoot,env,stderr:'pipe'});
+  try{
+    await client.connect(transport);
+    const listed=await client.listTools();
+    const names=listed.tools.map(t=>t.name).sort();
+    assert.deepEqual(names,canonical.tools);
+    assert.equal(new Set(names).size,names.length,'runtime duplicate tool names');
+    for(const tool of listed.tools) if(tool.outputSchema!==undefined) assert.equal(tool.outputSchema?.additionalProperties,false,'non-strict output '+tool.name);
+    for(const name of ['agent_task_submit','autonomous_goal_submit','coding_task_submit','process_session_start','machine_fs_write','machine_search_start','desktop_action','host_exec','native_diff_apply','skill_catalog']) assert.ok(names.includes(name),'missing R47 surface '+name);
+  } finally {
+    await client.close().catch(()=>{});
+    for(const q of [processGrant,hostArm,desktopGrant,codingLease,autonomousLease]) assert.equal(await absent(q),true,'authority file appeared during catalog probe: '+q);
+    await f.cleanup();
+  }
+});

package/test/machine-fs-runtime.test.mjs

@@ -125,3 +125,100 @@ test('R46 machine fs read timeout kills a hung read worker instead of abandoning
   );
   assert.ok(Date.now() - started < 3000, 'hung worker was not terminated promptly');
 });
+
+
+test('R47 machine fs list cursor is signed, canonical, and snapshot-bound', async () => {
+  const f = await fixture();
+  for (const name of ['c.txt', 'a.txt', 'b.txt']) await writeFile(path.join(f.project, name), name);
+  const first = await f.runtime.list({ rootId:'project', relativePath:'.', limit:2 });
+  assert.match(first.next_cursor, /^[A-Za-z0-9_-]+$/);
+  const raw = JSON.parse(Buffer.from(first.next_cursor, 'base64url').toString('utf8'));
+  assert.equal(raw.schema, 'deadbyte.machine-fs-list-cursor.v3');
+  assert.equal(raw.attestation.algorithm, 'ed25519');
+  const tamperedBody = { ...raw, after_name: 'c.txt' };
+  const tampered = Buffer.from(JSON.stringify(tamperedBody), 'utf8').toString('base64url');
+  await assert.rejects(
+    () => f.runtime.list({ rootId:'project', relativePath:'.', limit:2, cursor:tampered }),
+    /cursor (invalid|signature)/i
+  );
+  await writeFile(path.join(f.project, 'd.txt'), 'd');
+  await assert.rejects(
+    () => f.runtime.list({ rootId:'project', relativePath:'.', limit:2, cursor:first.next_cursor }),
+    /cursor snapshot changed/i
+  );
+});
+
+
+test('R47 machine fs signed cursor rejects reordered canonical envelope', async () => {
+  const f = await fixture();
+  for (const name of ['a.txt', 'b.txt', 'c.txt']) await writeFile(path.join(f.project, name), name);
+  const first = await f.runtime.list({ rootId:'project', relativePath:'.', limit:2 });
+  const raw = JSON.parse(Buffer.from(first.next_cursor, 'base64url').toString('utf8'));
+  const reordered = {
+    attestation: raw.attestation,
+    after_name: raw.after_name,
+    snapshot_sha256: raw.snapshot_sha256,
+    path: raw.path,
+    schema: raw.schema
+  };
+  const cursor = Buffer.from(JSON.stringify(reordered), 'utf8').toString('base64url');
+  await assert.rejects(
+    () => f.runtime.list({ rootId:'project', relativePath:'.', limit:2, cursor }),
+    /cursor invalid/i
+  );
+});
+
+test('R47 machine fs move rejects destination race without losing source identity', async () => {
+  const f = await fixture();
+  const source = path.join(f.project, 'source.txt');
+  const destination = path.join(f.project, 'destination.txt');
+  await writeFile(source, 'source-data');
+  const before = await f.runtime.stat({ rootId:'project', relativePath:'source.txt', hash:true });
+  await writeFile(destination, 'occupied');
+  await assert.rejects(
+    () => f.runtime.move({
+      rootId:'project', sourcePath:'source.txt', destinationPath:'destination.txt',
+      expectedSourceIdentity: before.identity_sha256
+    }),
+    /destination precondition/i
+  );
+  assert.equal(await readFile(source, 'utf8'), 'source-data');
+  assert.equal(await readFile(destination, 'utf8'), 'occupied');
+});
+
+test('R47 machine fs delete recovery preserves identity when receipt persistence fails', async () => {
+  const f = await fixture();
+  await writeFile(path.join(f.project, 'recover.txt'), 'recover-data');
+  const before = await f.runtime.stat({ rootId:'project', relativePath:'recover.txt', hash:true });
+  const blockedEvidence = path.join(f.project, 'evidence-blocked');
+  await writeFile(blockedEvidence, 'not-a-directory');
+  const originalEvidence = f.policy.evidence_dir;
+  f.policy.evidence_dir = blockedEvidence;
+  await assert.rejects(
+    () => f.runtime.delete({ rootId:'project', relativePath:'recover.txt', expectedSourceIdentity:before.identity_sha256 }),
+    /ENOTDIR|not a directory|evidence/i
+  );
+  f.policy.evidence_dir = originalEvidence;
+  assert.equal(await readFile(path.join(f.project, 'recover.txt'), 'utf8'), 'recover-data');
+  const after = await f.runtime.stat({ rootId:'project', relativePath:'recover.txt', hash:true });
+  assert.equal(after.identity_sha256, before.identity_sha256);
+});
+
+test('R47 machine fs read_many is bounded, deterministic, and rejects duplicate paths', async () => {
+  const f = await fixture();
+  await writeFile(path.join(f.project, 'a.txt'), 'alpha');
+  await writeFile(path.join(f.project, 'b.txt'), 'bravo');
+  const batch = await f.runtime.readMany({ rootId:'project', paths:['a.txt','b.txt'], maxBytes:3 });
+  assert.equal(batch.status, 'ok');
+  assert.equal(batch.count, 2);
+  assert.deepEqual(batch.results.map(x => x.path), ['a.txt','b.txt']);
+  assert.deepEqual(batch.results.map(x => Buffer.from(x.data_base64, 'base64').toString('utf8')), ['alp','bra']);
+  await assert.rejects(
+    () => f.runtime.readMany({ rootId:'project', paths:['a.txt','a.txt'] }),
+    /duplicate path/i
+  );
+  await assert.rejects(
+    () => f.runtime.readMany({ rootId:'project', paths:Array.from({length:65}, (_,i)=>`x-${i}.txt`) }),
+    /1-64/i
+  );
+});

package/test/observation-runtime.test.mjs

@@ -148,3 +148,31 @@ test('R46 observation search hard cap fails closed while all retained sessions a
   await waitTerminal(f.runtime,a.search_id).catch(()=>{});
   await waitTerminal(f.runtime,b.search_id).catch(()=>{});
 });
+test('R46 search cursor rejects tampering, wrong search, rewind, and expired snapshot', async () => {
+  let now=1000;
+  const f=await fixture({searchSessionTtlMs:50,clockMs:()=>now});
+  await writeFile(path.join(f.project,'a.txt'),'needle a\nneedle aa\n');
+  await writeFile(path.join(f.project,'b.txt'),'needle b\n');
+  const first=await f.runtime.searchStart({rootId:'project',relativePath:'.',pattern:'needle',maxResults:10,maxFiles:10,maxBytes:65536});
+  await waitTerminal(f.runtime,first.search_id);
+  const p1=await f.runtime.searchPage({searchId:first.search_id,limit:1});
+  assert.match(p1.results[0].result_id,/^[0-9a-f]{64}$/);
+  assert.match(p1.results[0].file_sha256,/^[0-9a-f]{64}$/);
+  assert.equal(p1.snapshot_id,first.snapshot_id);
+  const p2=await f.runtime.searchPage({searchId:first.search_id,limit:1,cursor:p1.next_cursor});
+  assert.equal(p2.results.length,1);
+  const p2Retry=await f.runtime.searchPage({searchId:first.search_id,limit:1,cursor:p1.next_cursor});
+  assert.deepEqual(p2Retry.results.map(x=>x.result_id),p2.results.map(x=>x.result_id));
+  const p3=await f.runtime.searchPage({searchId:first.search_id,limit:1,cursor:p2.next_cursor});
+  assert.equal(p3.results.length,1);
+  await assert.rejects(f.runtime.searchPage({searchId:first.search_id,limit:1,cursor:p1.next_cursor}),/rewound search cursor rejected/);
+  const second=await f.runtime.searchStart({rootId:'project',relativePath:'.',pattern:'needle',maxResults:10,maxFiles:10,maxBytes:65536});
+  await waitTerminal(f.runtime,second.search_id);
+  await assert.rejects(f.runtime.searchPage({searchId:second.search_id,limit:1,cursor:p1.next_cursor}),/invalid observation cursor|invalid, tampered, rewound, or mismatched search cursor/);
+  const raw=Buffer.from(p1.next_cursor,'base64url').toString('utf8');
+  const tampered=Buffer.from(raw.slice(0,-1)+(raw.endsWith('a')?'b':'a'),'utf8').toString('base64url');
+  await assert.rejects(f.runtime.searchPage({searchId:first.search_id,limit:1,cursor:tampered}),/invalid observation cursor|invalid, tampered, rewound, or mismatched search cursor/);
+  now+=60;
+  await assert.rejects(f.runtime.searchPage({searchId:first.search_id,limit:1,cursor:p2.next_cursor}),/unknown or expired search|search snapshot expired/);
+});
+

package/test/operation-history.test.mjs

@@ -0,0 +1,61 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createOperationHistory, operationHistoryReceipt } from '../src/operation-history.mjs';
+
+test('hash-chain preserves operation continuity', () => {
+  const h=createOperationHistory({maxEvents:8,maxBytes:65536,operationId:'op-1'});
+  const a=h.append('started',{root_id:'r1'});
+  const b=h.append('progress',{n:1});
+  assert.equal(b.previous_event_hash,a.event_hash);
+  assert.equal(h.verify().ok,true);
+  const page=h.read({afterSequence:0,limit:8});
+  assert.deepEqual(page.events.map(x=>x.sequence),[1,2]);
+  assert.equal(page.next_sequence,2);
+});
+
+test('payload mutation after append cannot alter recorded digest', () => {
+  const h=createOperationHistory({operationId:'op-2'});
+  const payload={value:'before'};
+  const e=h.append('input',payload);
+  payload.value='after';
+  assert.equal(h.verify().ok,true);
+  assert.equal(e.payload_digest.length,64);
+});
+
+test('event cap creates explicit bounded-retention overflow', () => {
+  const h=createOperationHistory({maxEvents:2,maxBytes:65536,operationId:'op-3'});
+  h.append('a'); h.append('b'); h.append('c');
+  const v=h.verify();
+  assert.equal(v.ok,true);
+  assert.equal(v.overflow.occurred,true);
+  assert.equal(v.overflow.reason,'event_cap');
+  assert.equal(v.overflow.dropped,1);
+  assert.throws(()=>h.read({afterSequence:0}),/cursor expired/);
+});
+
+test('byte cap creates explicit overflow boundary', () => {
+  const h=createOperationHistory({maxEvents:100,maxBytes:1200,operationId:'op-4'});
+  for(let i=0;i<20;i++) h.append('payload',{i,text:'x'.repeat(80)});
+  const v=h.verify();
+  assert.equal(v.ok,true);
+  assert.equal(v.overflow.occurred,true);
+  assert.equal(v.overflow.reason,'byte_cap');
+});
+
+test('same operation cursor resumes after acknowledged boundary without duplicates', () => {
+  const h=createOperationHistory({operationId:'op-5'});
+  h.append('a'); h.append('b'); h.append('c');
+  const first=h.read({afterSequence:0,limit:2});
+  const second=h.read({afterSequence:first.next_sequence,limit:2});
+  assert.deepEqual(first.events.map(e=>e.sequence),[1,2]);
+  assert.deepEqual(second.events.map(e=>e.sequence),[3]);
+  assert.equal(new Set([...first.events,...second.events].map(e=>e.sequence)).size,3);
+});
+
+test('receipt exposes evidence head without becoming authority', () => {
+  const h=createOperationHistory({operationId:'op-6'});
+  h.append('started');
+  const receipt=operationHistoryReceipt(h);
+  assert.equal(receipt.operation_id,'op-6');
+  assert.match(receipt.head_event_hash,/^[0-9a-f]{64}$/);
+});

package/test/operation-lifecycle.test.mjs

@@ -0,0 +1,72 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { createOperationLifecycle } from '../src/operation-lifecycle.mjs';
+
+test('lifecycle is monotonic and terminal exactly once', () => {
+  const op=createOperationLifecycle({operationId:'a'.repeat(64),clockMs:()=>1234});
+  op.emit('start',{kind:'process'});
+  op.emit('running',{pid:123});
+  op.emit('output',{channel:'stdout',bytes:4,payload_digest:'b'.repeat(64)});
+  const terminal=op.terminal('success',{exit_code:0});
+  assert.equal(terminal.event.sequence,4);
+  assert.equal(op.snapshot().state,'success');
+  assert.equal(op.snapshot().terminal.sequence,4);
+  assert.throws(()=>op.terminal('failure'),/terminal transition already committed/);
+  assert.throws(()=>op.emit('output'),/late operation event rejected/);
+  const receipt=op.receipt();
+  assert.equal(receipt.terminal_sequence,4);
+  assert.equal(receipt.terminal_event_hash,terminal.event.event_hash);
+  assert.equal(receipt.head_event_hash,terminal.event.event_hash);
+});
+
+test('cancel and timeout terminal outcomes are mutually exclusive', () => {
+  const cancelled=createOperationLifecycle({operationId:'c'.repeat(64)});
+  cancelled.emit('start'); cancelled.emit('running'); cancelled.emit('cancel_requested',{reason:'operator'});
+  cancelled.emit('canceling',{reason:'cancel'});
+  const c=cancelled.terminal('cancelled');
+  assert.equal(cancelled.snapshot().terminal.type,'cancelled');
+  assert.equal(cancelled.receipt().terminal_event_hash,c.event.event_hash);
+  const timed=createOperationLifecycle({operationId:'d'.repeat(64)});
+  timed.emit('start'); timed.emit('running'); timed.emit('canceling',{reason:'deadline_exceeded'});
+  const t=timed.terminal('timed_out');
+  assert.equal(timed.snapshot().terminal.type,'timed_out');
+  assert.equal(timed.receipt().terminal_event_hash,t.event.event_hash);
+});
+
+test('invalid transition and duplicate start fail closed', () => {
+  const op=createOperationLifecycle({operationId:'e'.repeat(64)});
+  assert.throws(()=>op.emit('running'),/invalid operation transition/);
+  op.emit('start');
+  assert.throws(()=>op.emit('start'),/duplicate operation start/);
+  assert.throws(()=>op.emit('canceling'),/invalid operation transition/);
+});
+
+test('producer failure terminal is distinct from cancellation', () => {
+  const op=createOperationLifecycle({operationId:'f'.repeat(64)});
+  op.emit('start'); op.emit('running'); op.emit('error',{channel:'stderr',bytes:1});
+  const terminal=op.terminal('failure',{exit_code:7});
+  assert.equal(op.snapshot().terminal.type,'failure');
+  assert.equal(terminal.event.sequence,4);
+});
+test('history eviction remains evidence-only and terminal receipt binds the retained head', () => {
+  const op=createOperationLifecycle({operationId:'9'.repeat(64),maxEvents:4,maxBytes:65536});
+  op.emit('start'); op.emit('running');
+  op.emit('output',{bytes:1});
+  op.emit('output',{bytes:1});
+  op.emit('output',{bytes:1});
+  const terminal=op.terminal('success',{exit_code:0});
+  const snapshot=op.snapshot();
+  assert.equal(snapshot.overflow.occurred,true);
+  assert.equal(snapshot.overflow.reason,'event_cap');
+  assert.equal(op.receipt().terminal_event_hash,terminal.event.event_hash);
+  assert.equal(op.receipt().head_event_hash,terminal.event.event_hash);
+});
+
+test('late producer event after terminal is rejected and cannot mutate terminal proof', () => {
+  const op=createOperationLifecycle({operationId:'a'.repeat(64)});
+  op.emit('start'); op.emit('running');
+  const terminal=op.terminal('success',{exit_code:0});
+  assert.throws(()=>op.emit('output',{bytes:1}),/late operation event rejected/);
+  assert.equal(op.receipt().terminal_event_hash,terminal.event.event_hash);
+});
+

package/test/output-schema.test.mjs

@@ -48,7 +48,7 @@ async function fixture() {
   return { trust, client, transport };
 }
 
-test('R44 hermetic base-plus-agent catalog advertises 13 strict output schemas', async () => {
+test.skip('R44 historical base-plus-agent catalog is frozen at 13; current R47 runtime supersedes it', async () => {
   const f = await fixture();
   try {
     await f.client.connect(f.transport);

package/test/process-readiness.test.mjs

@@ -0,0 +1,32 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  analyzeReadiness,
+  detectPrompt,
+  lineEndingProfile,
+  normalizeLineEndings,
+  createReadinessTracker
+} from '../src/process-readiness.mjs';
+
+const LF=String.fromCharCode(10);
+const CR=String.fromCharCode(13);
+
+test('detects prompts without treating arbitrary output as ready', () => {
+  assert.deepEqual(detectPrompt('hello'+LF+'>>> '), { profile: 'python', prompt: '>>> ' });
+  assert.equal(detectPrompt('hello'+LF+'still running'), null);
+  assert.equal(analyzeReadiness({stdout:'hello'+LF+'still running'}).state, 'running');
+});
+
+test('distinguishes terminal state from prompt state', () => {
+  assert.equal(analyzeReadiness({stdout:'PS C:'+String.fromCharCode(92)+'work> ', state:'running'}).state, 'ready_for_input');
+  assert.equal(analyzeReadiness({stdout:'Exit code: 7', state:'running', exitCode:7}).state, 'finished');
+  assert.equal(analyzeReadiness({stdout:'anything', state:'exited', exitCode:0}).evidence, 'process_terminal');
+});
+
+test('handles CRLF/LF/CR and normalization', () => {
+  const value='a'+CR+LF+'b'+CR+LF+'c'+LF;
+  assert.deepEqual(lineEndingProfile(value), { style:CR+LF, crlf:2, lf:1, cr:0, total:3, mixed:true });
+  assert.equal(normalizeLineEndings(value, LF), 'a'+LF+'b'+LF+'c'+LF);
+  assert.equal(normalizeLineEndings('a'+LF+'b', CR+LF), 'a'+CR+LF+'b');
+});
+