deadbyte-mcp 0.15.39 → 0.15.42

package/test/r65-authority-epoch-cli.test.mjs

@@ -0,0 +1,125 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,rm,writeFile,readFile} from 'node:fs/promises';
+import {createHash,generateKeyPairSync} from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+
+const epoch=await import('../src/authority-continuity-r65.mjs');
+
+async function prepare(root){
+  const runtime=path.join(root,'runtime'),trust=path.join(root,'trust');
+  await mkdir(runtime,{recursive:true});await mkdir(trust,{recursive:true});
+  const {privateKey,publicKey}=generateKeyPairSync('ed25519');
+  await writeFile(path.join(trust,'ed25519-private.pem'),privateKey.export({format:'pem',type:'pkcs8'}));
+  await writeFile(path.join(trust,'ed25519-public.pem'),publicKey.export({format:'pem',type:'spki'}));
+  const policyFile=path.join(root,'coding-policy.json');
+  const policyBytes=Buffer.from(JSON.stringify({schema:'deadbyte.coding-policy.v1',enabled:true,
+    lease_file:path.join(runtime,'coding-grant.json'),evidence_dir:path.join(root,'evidence'),
+    max_read_bytes:4096,max_write_bytes:4096,roots:{core:{path:path.join(root,'project'),read:true,write:true,exec:false,deny_paths:[]}},commands:{}}));
+  await writeFile(policyFile,policyBytes);
+  return {runtime,policyFile,policyBytes,policySha:createHash('sha256').update(policyBytes).digest('hex')};
+}
+
+test('authority epoch command dispatcher binds grant then makes explicit revoke win over stale grant bytes',async()=>{
+  assert.equal(typeof epoch.authorityEpochCliMain,'function','R65 authority epoch command dispatcher is missing');
+  const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-epoch-cli-'));
+  try{
+    const {runtime,policyFile,policySha}=await prepare(dir);
+    const grantFile=path.join(runtime,'coding-grant.json');
+    const grant={schema:'deadbyte.coding-grant.v2',policy_sha256:policySha,instance_nonce:'b'.repeat(64),root_ids:['core'],granted_at_utc:'2026-10-06T00:00:00Z'};
+    await writeFile(grantFile,JSON.stringify(grant));
+    await assert.rejects(()=>epoch.authorityEpochCliMain(['grant','--plane','coding','--grant-file',grantFile]),/policy.file.*required/i);
+
+    const before=await epoch.authorityEpochCliMain(['status','--plane','coding','--grant-file',grantFile,'--policy-file',policyFile]);
+    assert.equal(before.trusted,false);
+
+    const armed=await epoch.authorityEpochCliMain(['grant','--plane','coding','--grant-file',grantFile,'--policy-file',policyFile]);
+    assert.equal(armed.action,'grant');
+
+    const trusted=await epoch.authorityEpochCliMain(['status','--plane','coding','--grant-file',grantFile,'--policy-file',policyFile]);
+    assert.equal(trusted.trusted,true);
+
+    const revoked=await epoch.authorityEpochCliMain(['user-revoke','--plane','coding','--grant-file',grantFile,'--policy-file',policyFile]);
+    assert.equal(revoked.action,'user_revoke');
+
+    const stale=await epoch.authorityEpochCliMain(['status','--plane','coding','--grant-file',grantFile,'--policy-file',policyFile]);
+    assert.equal(stale.trusted,false);
+    assert.equal(stale.reason,'epoch-revoked');
+  }finally{await rm(dir,{recursive:true,force:true});}
+});
+
+test('fabricated unsigned epoch cannot grant standing authority',async()=>{
+  const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-epoch-forgery-'));
+  try{
+    const {runtime,policyFile,policySha}=await prepare(dir);
+    const grantFile=path.join(runtime,'coding-grant.json');
+    const grant={schema:'deadbyte.coding-grant.v2',policy_sha256:policySha,instance_nonce:'b'.repeat(64),root_ids:['core'],granted_at_utc:'2026-10-06T00:00:00Z'};
+    await writeFile(grantFile,JSON.stringify(grant));
+    const revoked=await epoch.authorityEpochCliMain(['user-revoke','--plane','coding','--grant-file',grantFile,'--policy-file',policyFile]);
+    const epochDir=path.join(runtime,'authority-epochs','coding');
+    const headPath=path.join(epochDir,'head.json');
+    const head=JSON.parse(await readFile(headPath,'utf8'));
+    const eventPath=path.join(epochDir,'events',head.event_file);
+    const event=JSON.parse(await readFile(eventPath,'utf8'));
+    event.action='grant';
+    const bytes=Buffer.from(JSON.stringify(event));
+    const forgedHash=createHash('sha256').update(bytes).digest('hex');
+    const forgedName=`${String(head.seq).padStart(16,'0')}-${forgedHash}.json`;
+    await writeFile(path.join(epochDir,'events',forgedName),bytes);
+    head.action='grant';head.event_sha256=forgedHash;head.event_file=forgedName;
+    await writeFile(headPath,JSON.stringify(head));
+    const observed=await epoch.authorityEpochCliMain(['status','--plane','coding','--grant-file',grantFile,'--policy-file',policyFile]);
+    assert.equal(observed.trusted,false,'hash-only epoch must not authorize a forged grant');
+    assert.equal(revoked.action,'user_revoke');
+  }finally{await rm(dir,{recursive:true,force:true});}
+});
+
+test('replaying an earlier genuinely signed grant head cannot undo a later revoke',async()=>{
+  const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-epoch-replay-'));
+  try{
+    const {runtime,policyFile,policySha}=await prepare(dir);
+    const grantFile=path.join(runtime,'coding-grant.json');
+    const grant={schema:'deadbyte.coding-grant.v2',policy_sha256:policySha,instance_nonce:'b'.repeat(64),root_ids:['core'],granted_at_utc:'2026-10-06T00:00:00Z'};
+    await writeFile(grantFile,JSON.stringify(grant));
+    await epoch.authorityEpochCliMain(['grant','--plane','coding','--grant-file',grantFile,'--policy-file',policyFile]);
+    const headPath=path.join(runtime,'authority-epochs','coding','head.json');
+    const oldHead=await readFile(headPath);
+    await epoch.authorityEpochCliMain(['user-revoke','--plane','coding','--grant-file',grantFile,'--policy-file',policyFile]);
+    await writeFile(headPath,oldHead);
+    const observed=await epoch.authorityEpochCliMain(['status','--plane','coding','--grant-file',grantFile,'--policy-file',policyFile]);
+    assert.equal(observed.trusted,false,'a signed but stale head must not restore authority');
+  }finally{await rm(dir,{recursive:true,force:true});}
+});
+
+
+test('transaction restore CLI requires and preserves full continuity binding',async()=>{
+  const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-epoch-cli-restore-'));
+  try{
+    const {runtime,policyFile,policyBytes,policySha}=await prepare(dir);
+    const grantFile=path.join(runtime,'coding-grant.json');
+    const oldGrant={schema:'deadbyte.coding-grant.v2',policy_sha256:policySha,instance_nonce:'c'.repeat(64),root_ids:['core'],granted_at_utc:'2026-10-07T00:00:00Z'};
+    const oldBytes=Buffer.from(JSON.stringify(oldGrant));
+    await writeFile(grantFile,oldBytes);
+    const granted=await epoch.authorityEpochCliMain(['grant','--plane','coding','--grant-file',grantFile,'--policy-file',policyFile]);
+    const revoked=await epoch.authorityEpochCliMain(['transaction-revoke','--plane','coding','--grant-file',grantFile,'--policy-file',policyFile,
+      '--update-id','r65-cli-restore','--expected-head',granted.event_sha256]);
+    const newGrant={...oldGrant,instance_nonce:'d'.repeat(64),granted_at_utc:'2026-10-07T00:01:00Z'};
+    await writeFile(grantFile,JSON.stringify(newGrant));
+    await assert.rejects(()=>epoch.authorityEpochCliMain(['transaction-restore','--plane','coding','--grant-file',grantFile,'--policy-file',policyFile,
+      '--update-id','r65-cli-restore','--expected-head',revoked.event_sha256]),/restore binding/i);
+    const envelope=epoch.deriveSecurityEnvelope('coding',JSON.parse(policyBytes));
+    const priorGrantSha=createHash('sha256').update(oldBytes).digest('hex');
+    const args=['transaction-restore','--plane','coding','--grant-file',grantFile,'--policy-file',policyFile,
+      '--update-id','r65-cli-restore','--expected-head',revoked.event_sha256,
+      '--prior-grant-sha256',priorGrantSha,'--prior-grant-nonce',oldGrant.instance_nonce,
+      '--predecessor-policy-envelope',envelope.sha256,'--successor-policy-envelope',envelope.sha256,
+      '--candidate-manifest','e'.repeat(64),'--continuity-subject','f'.repeat(64)];
+    const restored=await epoch.authorityEpochCliMain(args);
+    assert.equal(restored.action,'transaction_restore');
+    assert.equal(restored.restore_binding.prior_grant_sha256,priorGrantSha);
+    assert.equal(restored.restore_binding.candidate_manifest_sha256,'e'.repeat(64));
+    const status=await epoch.authorityEpochCliMain(['status','--plane','coding','--grant-file',grantFile,'--policy-file',policyFile]);
+    assert.equal(status.trusted,true);
+  }finally{await rm(dir,{recursive:true,force:true});}
+});

package/test/r65-authority-epoch-races.test.mjs

@@ -0,0 +1,87 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp,rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+import {prepareAuthorityTestTrust} from './r65-authority-test-trust.mjs';
+
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+function restoreBinding(oldGrant,oldNonce){return {prior_grant_sha256:sha(oldGrant),prior_grant_instance_nonce:oldNonce,
+  predecessor_policy_envelope_sha256:'1'.repeat(64),successor_policy_envelope_sha256:'2'.repeat(64),
+  candidate_manifest_sha256:'3'.repeat(64),continuity_subject_sha256:'4'.repeat(64)};}
+
+function grantBytes(nonce){
+  return Buffer.from(JSON.stringify({
+    schema:'deadbyte.coding-grant.v2',policy_sha256:'a'.repeat(64),
+    instance_nonce:nonce,root_ids:['core'],granted_at_utc:'2026-10-06T00:00:00Z'
+  }));
+}
+
+test('transaction authority mutations require CAS ownership and user revoke wins',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-epoch-race-'));
+  try{
+    const store=createAuthorityEpochStore({runtimeDir:await prepareAuthorityTestTrust(root)});
+    const oldNonce='b'.repeat(64),oldGrant=grantBytes(oldNonce);
+    const granted=await store.append({plane:'coding',action:'grant',grantBytes:oldGrant,grantInstanceNonce:oldNonce,updateId:null});
+
+    await assert.rejects(
+      ()=>store.append({plane:'coding',action:'transaction_revoke',grantBytes:oldGrant,grantInstanceNonce:oldNonce,updateId:'update-a'}),
+      /compare-and-swap|expected head/i
+    );
+
+    const tx=await store.append({plane:'coding',action:'transaction_revoke',grantBytes:oldGrant,grantInstanceNonce:oldNonce,
+      updateId:'update-a',expectedHeadSha256:granted.event_sha256});
+    assert.equal(tx.action,'transaction_revoke');
+
+    const user=await store.append({plane:'coding',action:'user_revoke',grantBytes:oldGrant,grantInstanceNonce:oldNonce,updateId:null});
+    assert.equal(user.action,'user_revoke');
+
+    const newNonce='c'.repeat(64),newGrant=grantBytes(newNonce);
+    await assert.rejects(
+      ()=>store.append({plane:'coding',action:'transaction_restore',grantBytes:newGrant,grantInstanceNonce:newNonce,
+        updateId:'update-a',expectedHeadSha256:tx.event_sha256,restoreBinding:restoreBinding(oldGrant,oldNonce)}),
+      /compare-and-swap conflict/
+    );
+    assert.equal((await store.readHead({plane:'coding'})).event_sha256,user.event_sha256);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('transaction restore requires owning revoke and a fresh nonce',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-epoch-restore-'));
+  try{
+    const store=createAuthorityEpochStore({runtimeDir:await prepareAuthorityTestTrust(root)});
+    const oldNonce='d'.repeat(64),oldGrant=grantBytes(oldNonce);
+    const granted=await store.append({plane:'coding',action:'grant',grantBytes:oldGrant,grantInstanceNonce:oldNonce,updateId:null});
+    const tx=await store.append({plane:'coding',action:'transaction_revoke',grantBytes:oldGrant,grantInstanceNonce:oldNonce,
+      updateId:'update-a',expectedHeadSha256:granted.event_sha256});
+
+    await assert.rejects(
+      ()=>store.append({plane:'coding',action:'transaction_restore',grantBytes:oldGrant,grantInstanceNonce:oldNonce,
+        updateId:'update-a',expectedHeadSha256:tx.event_sha256}),
+      /restore binding/i
+    );
+    await assert.rejects(
+      ()=>store.append({plane:'coding',action:'transaction_restore',grantBytes:oldGrant,grantInstanceNonce:oldNonce,
+        updateId:'update-a',expectedHeadSha256:tx.event_sha256,restoreBinding:restoreBinding(oldGrant,oldNonce)}),
+      /fresh nonce|resurrect/i
+    );
+
+    const foreignNonce='e'.repeat(64),foreignGrant=grantBytes(foreignNonce);
+    await assert.rejects(
+      ()=>store.append({plane:'coding',action:'transaction_restore',grantBytes:foreignGrant,grantInstanceNonce:foreignNonce,
+        updateId:'update-b',expectedHeadSha256:tx.event_sha256,restoreBinding:restoreBinding(oldGrant,oldNonce)}),
+      /owner|update/i
+    );
+
+    const newNonce='f'.repeat(64),newGrant=grantBytes(newNonce);
+    const binding=restoreBinding(oldGrant,oldNonce);
+    const restored=await store.append({plane:'coding',action:'transaction_restore',grantBytes:newGrant,grantInstanceNonce:newNonce,
+      updateId:'update-a',expectedHeadSha256:tx.event_sha256,restoreBinding:binding});
+    assert.equal(restored.action,'transaction_restore');
+    assert.equal(restored.grant_instance_nonce,newNonce);
+    assert.deepEqual(restored.restore_binding,binding);
+    assert.equal((await store.verifyGrant({plane:'coding',grantBytes:newGrant,grantInstanceNonce:newNonce})).trusted,true);
+  }finally{await rm(root,{recursive:true,force:true});}
+});

package/test/r65-authority-epoch-recovery.test.mjs

@@ -0,0 +1,82 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,rm,writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+import {prepareAuthorityTestTrust} from './r65-authority-test-trust.mjs';
+
+function grantBytes(nonce){
+  return Buffer.from(JSON.stringify({
+    schema:'deadbyte.coding-grant.v2',policy_sha256:'a'.repeat(64),
+    instance_nonce:nonce,root_ids:['core'],granted_at_utc:'2026-10-06T00:00:00Z'
+  }));
+}
+
+test('dead-owner epoch lock is recovered but a live-owner lock is never stolen',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-epoch-lock-'));
+  try{
+    const runtime=await prepareAuthorityTestTrust(root);
+    const dir=path.join(runtime,'authority-epochs','coding');
+    await mkdir(dir,{recursive:true});
+    await writeFile(path.join(dir,'.lock'),JSON.stringify({schema:'deadbyte.authority-epoch-lock.r65.v1',pid:2147483647,token:'dead',created_at_utc:'2026-10-06T00:00:00Z'}));
+    const store=createAuthorityEpochStore({runtimeDir:runtime});
+    const nonce='1'.repeat(64),grant=grantBytes(nonce);
+    const head=await store.append({plane:'coding',action:'grant',grantBytes:grant,grantInstanceNonce:nonce,updateId:null});
+    assert.equal(head.seq,1);
+
+    await writeFile(path.join(dir,'.lock'),JSON.stringify({schema:'deadbyte.authority-epoch-lock.r65.v1',pid:process.pid,token:'live',created_at_utc:new Date().toISOString()}));
+    const nextNonce='2'.repeat(64),nextGrant=grantBytes(nextNonce);
+    await assert.rejects(
+      ()=>store.append({plane:'coding',action:'grant',grantBytes:nextGrant,grantInstanceNonce:nextNonce,updateId:null}),
+      /mutation locked/
+    );
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('transaction revoke remains authoritative even if stale grant bytes survive a crash',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-epoch-revoke-crash-'));
+  try{
+    const store=createAuthorityEpochStore({runtimeDir:await prepareAuthorityTestTrust(root)});
+    const nonce='3'.repeat(64),grant=grantBytes(nonce);
+    const armed=await store.append({plane:'coding',action:'grant',grantBytes:grant,grantInstanceNonce:nonce,updateId:null});
+    const revoked=await store.append({plane:'coding',action:'transaction_revoke',grantBytes:grant,grantInstanceNonce:nonce,
+      updateId:'update-crash',expectedHeadSha256:armed.event_sha256});
+    assert.equal(revoked.action,'transaction_revoke');
+    const stale=await store.verifyGrant({plane:'coding',grantBytes:grant,grantInstanceNonce:nonce});
+    assert.equal(stale.trusted,false);
+    assert.equal(stale.reason,'epoch-revoked');
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('prepared successor grant cannot become trusted before transaction restore commits',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-epoch-restore-crash-'));
+  try{
+    const store=createAuthorityEpochStore({runtimeDir:await prepareAuthorityTestTrust(root)});
+    const oldNonce='4'.repeat(64),oldGrant=grantBytes(oldNonce);
+    const armed=await store.append({plane:'coding',action:'grant',grantBytes:oldGrant,grantInstanceNonce:oldNonce,updateId:null});
+    await store.append({plane:'coding',action:'transaction_revoke',grantBytes:oldGrant,grantInstanceNonce:oldNonce,
+      updateId:'update-crash',expectedHeadSha256:armed.event_sha256});
+
+    const newNonce='5'.repeat(64),newGrant=grantBytes(newNonce);
+    const prepared=await store.verifyGrant({plane:'coding',grantBytes:newGrant,grantInstanceNonce:newNonce});
+    assert.equal(prepared.trusted,false);
+    assert.match(prepared.reason,/mismatch|revoked/);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+test('corrupt durable head fails closed instead of trusting grant bytes',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-epoch-corrupt-'));
+  try{
+    const runtime=await prepareAuthorityTestTrust(root);
+    const dir=path.join(runtime,'authority-epochs','coding');
+    await mkdir(dir,{recursive:true});
+    await writeFile(path.join(dir,'head.json'),'{broken');
+    const store=createAuthorityEpochStore({runtimeDir:runtime});
+    const nonce='6'.repeat(64),grant=grantBytes(nonce);
+    const verdict=await store.verifyGrant({plane:'coding',grantBytes:grant,grantInstanceNonce:nonce});
+    assert.equal(verdict.trusted,false);
+    assert.match(verdict.reason,/head invalid/);
+    await assert.rejects(()=>store.readHead({plane:'coding'}),/head invalid/);
+  }finally{await rm(root,{recursive:true,force:true});}
+});

package/test/r65-authority-epoch-store.test.mjs

@@ -0,0 +1,94 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,rm,writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+import {prepareAuthorityTestTrust} from './r65-authority-test-trust.mjs';
+
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+async function fixture(run){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-canonical-epoch-'));
+  try{
+    const runtime=await prepareAuthorityTestTrust(root);
+    const workspace=path.join(root,'workspace');await mkdir(workspace,{recursive:true});
+    const grantFile=path.join(runtime,'process-grant.json');
+    const policy={
+      schema:'deadbyte.process-policy.v1',enabled:true,grant_file:grantFile,
+      state_dir:path.join(root,'evidence','process'),
+      native_host:{path:'C:\\slot\\host.exe',sha256:'a'.repeat(64)},
+      roots:{core:{path:workspace,deny_paths:[]}},
+      profiles:{ping:{executable:'C:\\Windows\\cmd.exe',executable_sha256:'b'.repeat(64),
+        root_ids:['core'],prefix_args:['/d'],max_input_bytes:4096}}
+    };
+    const policyBytes=Buffer.from(JSON.stringify(policy));
+    const grant={schema:'deadbyte.process-grant.v1',policy_sha256:sha(policyBytes),instance_nonce:'c'.repeat(64),
+      profile_ids:['ping'],root_ids:['core'],granted_at_utc:'2026-10-07T00:00:00Z'};
+    const grantBytes=Buffer.from(JSON.stringify(grant));
+    const store=createAuthorityEpochStore({runtimeDir:runtime,policyBytes});
+    return await run({root,runtime,policyBytes,grant,grantBytes,store});
+  }finally{await rm(root,{recursive:true,force:true});}
+}
+
+function restoreBinding(oldGrant,oldNonce){
+  return {prior_grant_sha256:sha(oldGrant),prior_grant_instance_nonce:oldNonce,
+    predecessor_policy_envelope_sha256:'1'.repeat(64),successor_policy_envelope_sha256:'2'.repeat(64),
+    candidate_manifest_sha256:'3'.repeat(64),continuity_subject_sha256:'4'.repeat(64)};
+}
+
+test('canonical durable store trusts only the exact signed grant head',()=>fixture(async f=>{
+  const head=await f.store.append({plane:'process',action:'grant',grantBytes:f.grantBytes,grantInstanceNonce:f.grant.instance_nonce});
+  const verified=await f.store.verifyGrant({plane:'process',grantBytes:f.grantBytes,grantInstanceNonce:f.grant.instance_nonce,policyBytes:f.policyBytes});
+  assert.equal(verified.trusted,true);
+  assert.equal(verified.event_sha256,head.event_sha256);
+  const changed={...f.grant,instance_nonce:'d'.repeat(64)},changedBytes=Buffer.from(JSON.stringify(changed));
+  assert.equal((await f.store.verifyGrant({plane:'process',grantBytes:changedBytes,grantInstanceNonce:changed.instance_nonce,policyBytes:f.policyBytes})).trusted,false);
+}));
+
+test('committed user revoke makes stale grant bytes untrusted',()=>fixture(async f=>{
+  await f.store.append({plane:'process',action:'grant',grantBytes:f.grantBytes,grantInstanceNonce:f.grant.instance_nonce});
+  await f.store.append({plane:'process',action:'user_revoke',grantBytes:f.grantBytes,grantInstanceNonce:f.grant.instance_nonce});
+  const verified=await f.store.verifyGrant({plane:'process',grantBytes:f.grantBytes,grantInstanceNonce:f.grant.instance_nonce,policyBytes:f.policyBytes});
+  assert.equal(verified.trusted,false);
+  assert.equal(verified.action,'user_revoke');
+}));
+
+test('stale transaction CAS cannot overwrite a later user revoke',()=>fixture(async f=>{
+  const granted=await f.store.append({plane:'process',action:'grant',grantBytes:f.grantBytes,grantInstanceNonce:f.grant.instance_nonce});
+  const tx=await f.store.append({plane:'process',action:'transaction_revoke',grantBytes:f.grantBytes,
+    grantInstanceNonce:f.grant.instance_nonce,updateId:'r65-store-test',expectedHeadSha256:granted.event_sha256});
+  await f.store.append({plane:'process',action:'user_revoke',grantBytes:f.grantBytes,grantInstanceNonce:f.grant.instance_nonce});
+  const nextNonce='e'.repeat(64),nextGrant=Buffer.from(JSON.stringify({...f.grant,instance_nonce:nextNonce}));
+  await assert.rejects(()=>f.store.append({plane:'process',action:'transaction_restore',grantBytes:nextGrant,
+    grantInstanceNonce:nextNonce,updateId:'r65-store-test',expectedHeadSha256:tx.event_sha256,
+    restoreBinding:restoreBinding(f.grantBytes,f.grant.instance_nonce)}),/compare-and-swap conflict/);
+}));
+
+test('replaying an older signed head fails closed when a later event remains',()=>fixture(async f=>{
+  await f.store.append({plane:'process',action:'grant',grantBytes:f.grantBytes,grantInstanceNonce:f.grant.instance_nonce});
+  const epochDir=path.join(f.runtime,'authority-epochs','process'),oldHead=await readFile(path.join(epochDir,'head.json'));
+  await f.store.append({plane:'process',action:'user_revoke',grantBytes:f.grantBytes,grantInstanceNonce:f.grant.instance_nonce});
+  await writeFile(path.join(epochDir,'head.json'),oldHead);
+  const verified=await f.store.verifyGrant({plane:'process',grantBytes:f.grantBytes,grantInstanceNonce:f.grant.instance_nonce,policyBytes:f.policyBytes});
+  assert.equal(verified.trusted,false);
+  assert.match(String(verified.reason),/replay|incomplete|head/i);
+}));
+
+test('transaction restore requires a fresh nonce and becomes the trusted head',()=>fixture(async f=>{
+  const updateId='r65-store-restore';
+  const granted=await f.store.append({plane:'process',action:'grant',grantBytes:f.grantBytes,grantInstanceNonce:f.grant.instance_nonce});
+  const revoked=await f.store.append({plane:'process',action:'transaction_revoke',grantBytes:f.grantBytes,
+    grantInstanceNonce:f.grant.instance_nonce,updateId,expectedHeadSha256:granted.event_sha256});
+  await assert.rejects(()=>f.store.append({plane:'process',action:'transaction_restore',grantBytes:f.grantBytes,
+    grantInstanceNonce:f.grant.instance_nonce,updateId,expectedHeadSha256:revoked.event_sha256,
+    restoreBinding:restoreBinding(f.grantBytes,f.grant.instance_nonce)}),/fresh nonce|resurrect/i);
+  const newNonce='f'.repeat(64),newGrant=Buffer.from(JSON.stringify({...f.grant,instance_nonce:newNonce}));
+  const restored=await f.store.append({plane:'process',action:'transaction_restore',grantBytes:newGrant,
+    grantInstanceNonce:newNonce,updateId,expectedHeadSha256:revoked.event_sha256,
+    restoreBinding:restoreBinding(f.grantBytes,f.grant.instance_nonce)});
+  const verified=await f.store.verifyGrant({plane:'process',grantBytes:newGrant,grantInstanceNonce:newNonce,policyBytes:f.policyBytes});
+  assert.equal(verified.trusted,true);
+  assert.equal(verified.event_sha256,restored.event_sha256);
+}));

package/test/r65-authority-fixture.mjs

@@ -0,0 +1,41 @@
+import {mkdir,readFile,readdir,writeFile} from 'node:fs/promises';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+import {prepareAuthorityTestTrust} from './r65-authority-test-trust.mjs';
+
+export async function bindStandingGrantEpoch(plane,grantFile){
+  const bytes=await readFile(grantFile);
+  const grant=JSON.parse(bytes.toString('utf8'));
+  if(typeof grant?.instance_nonce!=='string')throw new Error('fixture grant instance_nonce missing');
+  const runtimeDir=path.dirname(path.resolve(grantFile));
+  if(path.basename(runtimeDir).toLowerCase()!=='runtime')throw new Error('fixture grant must be under isolated stateRoot/runtime');
+  const stateRoot=path.dirname(runtimeDir);
+  await prepareAuthorityTestTrust(stateRoot);
+  const files=(await readdir(stateRoot,{withFileTypes:true})).filter(item=>item.isFile()&&item.name.endsWith('.json'));
+  if(files.length>128)throw new Error('fixture policy discovery budget exceeded');
+  let policyBytes=null;
+  for(const file of files){
+    const candidate=await readFile(path.join(stateRoot,file.name));
+    if(createHash('sha256').update(candidate).digest('hex')===grant.policy_sha256){
+      if(policyBytes)throw new Error('fixture policy digest ambiguous');
+      policyBytes=candidate;
+    }
+  }
+  if(!policyBytes)throw new Error(`fixture exact ${plane} policy bytes missing for standing grant`);
+  const store=createAuthorityEpochStore({runtimeDir,policyBytes});
+  const prior=await store.readHead({plane});
+  if(prior){
+    const verified=await store.verifyGrant({plane,grantBytes:bytes,grantInstanceNonce:grant.instance_nonce,policyBytes});
+    if(verified.trusted)return verified;
+  }
+  return store.append({plane,action:'grant',grantBytes:bytes,grantInstanceNonce:grant.instance_nonce,updateId:null});
+}
+
+export async function writeBoundStandingGrant(plane,grantFile,value,{space=0}={}){
+  const text=JSON.stringify(value,null,space);
+  await mkdir(path.dirname(path.resolve(grantFile)),{recursive:true});
+  await writeFile(grantFile,text);
+  await bindStandingGrantEpoch(plane,grantFile);
+  return value;
+}

package/test/r65-authority-grant-capture.test.mjs

@@ -0,0 +1,37 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {captureStandingGrant} from '../src/authority-continuity-r65.mjs';
+
+const digest=bytes=>createHash('sha256').update(bytes).digest('hex');
+const policy={schema:'deadbyte.process-policy.v1',enabled:true,grant_file:'C:\\state\\runtime\\process-grant.json',
+  state_dir:'C:\\state\\evidence\\process',native_host:{path:'C:\\slot\\bin\\host.exe',sha256:'a'.repeat(64)},
+  roots:{core:{path:'D:\\Projects\\core',deny_paths:['secrets']}},profiles:{ping:{executable:'C:\\Windows\\cmd.exe',executable_sha256:'b'.repeat(64),root_ids:['core'],prefix_args:['/d'],max_input_bytes:4096}}};
+const policyBytes=Buffer.from(JSON.stringify(policy));
+const grant={schema:'deadbyte.process-grant.v1',policy_sha256:digest(policyBytes),instance_nonce:'c'.repeat(64),
+  profile_ids:['ping'],root_ids:['core'],granted_at_utc:'2026-10-06T00:00:00.000Z'};
+const options={plane:'process',policyBytes,grantBytes:Buffer.from(JSON.stringify(grant)),
+  predecessor:{release_id:'v0.15.41-parent',generation_manifest_sha256:'d'.repeat(64)},
+  candidate:{version:'0.15.42',manifest_sha256:'e'.repeat(64)},updateId:'r65-test-1'};
+
+test('exact standing grant capture binds policy bytes, scope, nonce and release lineage',()=>{
+  const record=captureStandingGrant(options);
+  assert.equal(record.schema,'deadbyte.authority-continuity.r65.v1');
+  assert.equal(record.grant_sha256,digest(options.grantBytes));
+  assert.equal(record.grant_instance_nonce,grant.instance_nonce);
+  assert.deepEqual(record.granted_scope,{profile_ids:['ping'],root_ids:['core']});
+  assert.equal(record.prior_policy_sha256,digest(policyBytes));
+  assert.equal(Object.hasOwn(record,'captured_revocation_epoch'),false);
+});
+test('grant with stale policy digest or out-of-policy scope is rejected',()=>{
+  const wrongPolicy={...grant,policy_sha256:'f'.repeat(64)};
+  assert.throws(()=>captureStandingGrant({...options,grantBytes:Buffer.from(JSON.stringify(wrongPolicy))}),/policy/i);
+  const wrongScope={...grant,root_ids:['other']};
+  assert.throws(()=>captureStandingGrant({...options,grantBytes:Buffer.from(JSON.stringify(wrongScope))}),/scope|root/i);
+});
+test('changed nonce, malformed grant and foreign candidate identity cannot become captured authority',()=>{
+  const wrongNonce={...grant,instance_nonce:'not-a-nonce'};
+  assert.throws(()=>captureStandingGrant({...options,grantBytes:Buffer.from(JSON.stringify(wrongNonce))}),/nonce/i);
+  assert.throws(()=>captureStandingGrant({...options,grantBytes:Buffer.from('{')}),/grant/i);
+  assert.throws(()=>captureStandingGrant({...options,candidate:{version:'0.15.42',manifest_sha256:'bad'}}),/candidate/i);
+});

package/test/r65-authority-observation-epoch.test.mjs

@@ -0,0 +1,25 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {parseAuthorityObservation} from '../src/remote-authority.mjs';
+
+function observation(entry){
+  const authority=Object.fromEntries(['process','coding','autonomous','desktop','host'].map(plane=>[plane,{configured:true,armed:false,reason:'disarmed'}]));
+  authority.coding={configured:true,armed:true,reason:'standing-grant',...entry};
+  return {schema:'deadbyte.controller-observation.v1',state:'ONLINE',local_ready:true,
+    bridge:{alive:true,reason:'verified',pid:1},core:{alive:true,reason:'verified',pid:2},
+    cloud:{alive:true,reason:'verified',pid:3},supervisor:{running:true},authority};
+}
+
+test('R65 authority observation preserves a complete epoch identity but accepts legacy absence',()=>{
+  const sha='a'.repeat(64);
+  const parsed=parseAuthorityObservation(observation({epoch_seq:7,epoch_sha256:sha}));
+  assert.equal(parsed.authority.coding.epoch_seq,7);
+  assert.equal(parsed.authority.coding.epoch_sha256,sha);
+
+  const legacy=parseAuthorityObservation(observation({}));
+  assert.equal(legacy.authority.coding.epoch_seq,null);
+  assert.equal(legacy.authority.coding.epoch_sha256,null);
+
+  assert.throws(()=>parseAuthorityObservation(observation({epoch_seq:7})),/epoch/i);
+  assert.throws(()=>parseAuthorityObservation(observation({epoch_seq:0,epoch_sha256:sha})),/epoch/i);
+});

package/test/r65-authority-policy-envelope.test.mjs

@@ -0,0 +1,46 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {deriveSecurityEnvelope,compareSecurityEnvelopes} from '../src/authority-continuity-r65.mjs';
+
+const sha='a'.repeat(64);
+const base=()=>({schema:'deadbyte.process-policy.v1',enabled:true,
+  grant_file:'C:\\state\\runtime\\process-grant.json',state_dir:'C:\\state\\evidence\\process',
+  native_host:{path:'C:\\slot\\bin\\deadbyte-process-host.exe',sha256:sha},
+  roots:{core:{path:'D:\\Projects\\core',deny_paths:['node_modules','secrets']}},
+  profiles:{ping:{executable:'C:\\Windows\\System32\\cmd.exe',executable_sha256:sha,
+    root_ids:['core'],prefix_args:['/d'],transport:'pipe',max_args:0,max_arg_bytes:256,
+    max_sessions:1,max_input_bytes:4096,max_retained_output_bytes:65536,
+    env_allow:['PATH'],input_actions:{ping:'echo PING\r\n'}}}});
+const compare=(before,after)=>compareSecurityEnvelopes('process',deriveSecurityEnvelope('process',before),deriveSecurityEnvelope('process',after));
+
+test('identical security envelope ignores only operational grant/evidence paths',()=>{
+  const before=base(),after=base();after.grant_file='C:\\other\\runtime\\process-grant.json';after.state_dir='C:\\other\\evidence';
+  assert.equal(compare(before,after).relation,'EQUAL');
+});
+test('removing an unused profile is narrower',()=>{
+  const before=base(),after=base();before.profiles.extra={...before.profiles.ping};
+  assert.equal(compare(before,after).relation,'NARROWER');
+});
+test('added root or action widens the policy ceiling',()=>{
+  const before=base(),rootAdded=base(),actionAdded=base();
+  rootAdded.roots.extra={path:'D:\\Extra',deny_paths:[]};
+  actionAdded.profiles.ping.input_actions.extra='echo EXTRA\r\n';
+  assert.equal(compare(before,rootAdded).relation,'WIDER');
+  assert.equal(compare(before,actionAdded).relation,'WIDER');
+});
+test('relaxed deny paths or increased byte ceiling widens authority',()=>{
+  const before=base(),denyRelaxed=base(),larger=base();
+  denyRelaxed.roots.core.deny_paths=['node_modules'];larger.profiles.ping.max_input_bytes=8192;
+  assert.equal(compare(before,denyRelaxed).relation,'WIDER');
+  assert.equal(compare(before,larger).relation,'WIDER');
+});
+test('unproved executable or native host pin change is unverified',()=>{
+  const before=base(),executable=base(),host=base();
+  executable.profiles.ping.executable_sha256='b'.repeat(64);host.native_host.sha256='b'.repeat(64);
+  assert.equal(compare(before,executable).relation,'UNVERIFIED');
+  assert.equal(compare(before,host).relation,'UNVERIFIED');
+});
+test('unrecognized security fields fail closed instead of being discarded',()=>{
+  const unknown=base();unknown.profiles.ping.allow_arbitrary_shell=true;
+  assert.throws(()=>deriveSecurityEnvelope('process',unknown),/unknown|unrecognized/i);
+});

package/test/r65-authority-restored-safe.test.mjs

@@ -0,0 +1,75 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash,generateKeyPairSync} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,rm,writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {orchestrateActivation} from '../src/activation-preflight-r65.mjs';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+import {createEpochNativeContinuityEngine} from '../src/activation-continuity-engine-r65.mjs';
+
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const parent={release_id:'v0.15.41-parent',version:'0.15.41',manifest_sha256:'a'.repeat(64),generation_manifest_sha256:'b'.repeat(64)};
+const candidate={version:'0.15.42',manifest_sha256:'c'.repeat(64)};
+const ids={bridge:{alive:true,reason:'verified',pid:10},core:{alive:true,reason:'verified',pid:11},cloud:{alive:true,reason:'verified',pid:12}};
+const policies={process:'1'.repeat(64),coding:'2'.repeat(64),autonomous:'3'.repeat(64),desktop:'4'.repeat(64),host:'5'.repeat(64)};
+const epochEntry=(armed,seq=7,hash='f'.repeat(64))=>({configured:true,armed,reason:armed?'standing-grant':'disarmed',epoch_seq:armed?seq:null,epoch_sha256:armed?hash:null});
+
+test('orchestrator reports RESTORED_SAFE when all restored authority is safe but not exact',async()=>{
+  let current={state:'ONLINE',local_ready:true,...ids,supervisor:{running:true},policy_sha256:policies,
+    active_release_id:parent.release_id,active_manifest_sha256:parent.manifest_sha256,active_generation_manifest_sha256:parent.generation_manifest_sha256,
+    authority:{process:epochEntry(true),coding:epochEntry(false),autonomous:epochEntry(false),desktop:epochEntry(false),host:epochEntry(false)}};
+  const continuityEngine={
+    capture:async({subject_sha256})=>({update_id:'r65-safe',subject_sha256,planes:['process'],records:{process:{}}}),
+    revoke:async()=>{current={...current,authority:{...current.authority,process:epochEntry(false)}};return {process:'TRANSACTION_REVOKED'};},
+    restore:async()=>{current={...current,authority:{...current.authority,process:epochEntry(true,9,'9'.repeat(64))}};
+      return {authority_outcomes:{process:'RESTORED_SAFE',coding:'NOT_APPLICABLE',autonomous:'NOT_APPLICABLE',desktop:'NOT_APPLICABLE',host:'NOT_APPLICABLE'},restored_nonces:{process:'8'.repeat(64)},reauth_planes:[]};}
+  };
+  const result=await orchestrateActivation({pointer:parent,expectedParent:parent,candidate,expectedCandidate:candidate,
+    observe:async()=>current,command:async()=>{throw new Error('generic command forbidden');},
+    activate:async()=>({verified:true,release_id:'v0.15.42-candidate'}),continuityEngine});
+  assert.equal(result.state,'ACTIVATED');
+  assert.equal(result.authority_continuity,'RESTORED_SAFE');
+  assert.equal(result.authority_outcomes.process,'RESTORED_SAFE');
+});
+
+test('engine marks a non-widening narrowed successor policy as RESTORED_SAFE',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-restored-safe-'));
+  try{
+    const state=path.join(root,'state'),runtime=path.join(state,'runtime'),trust=path.join(state,'trust'),policiesDir=path.join(root,'policies');
+    await mkdir(runtime,{recursive:true});await mkdir(trust,{recursive:true});await mkdir(policiesDir,{recursive:true});
+    const {privateKey,publicKey}=generateKeyPairSync('ed25519');
+    await writeFile(path.join(trust,'ed25519-private.pem'),privateKey.export({format:'pem',type:'pkcs8'}));
+    await writeFile(path.join(trust,'ed25519-public.pem'),publicKey.export({format:'pem',type:'spki'}));
+    const grantFile=path.join(runtime,'process-grant.json');
+    const basePolicy={schema:'deadbyte.process-policy.v1',enabled:true,grant_file:grantFile,state_dir:path.join(state,'evidence','process'),
+      native_host:{path:'C:\\Windows\\System32\\cmd.exe',sha256:'6'.repeat(64)},
+      roots:{core:{path:'D:\\Projects',deny_paths:[]},unused:{path:'D:\\Unused',deny_paths:[]}},
+      profiles:{safe:{executable:'C:\\Windows\\System32\\cmd.exe',executable_sha256:'7'.repeat(64),root_ids:['core'],prefix_args:['/d'],max_input_bytes:4096}}};
+    const nextPolicy={...basePolicy,roots:{core:basePolicy.roots.core}};
+    const beforeBytes=Buffer.from(JSON.stringify(basePolicy)),afterBytes=Buffer.from(JSON.stringify(nextPolicy));
+    const beforePath=path.join(policiesDir,'before.json'),afterPath=path.join(policiesDir,'after.json');
+    await writeFile(beforePath,beforeBytes);await writeFile(afterPath,afterBytes);
+    const grant={schema:'deadbyte.process-grant.v1',policy_sha256:sha(beforeBytes),instance_nonce:'8'.repeat(64),profile_ids:['safe'],root_ids:['core'],granted_at_utc:'2026-10-07T00:00:00Z'};
+    const grantBytes=Buffer.from(JSON.stringify(grant));await writeFile(grantFile,grantBytes);
+    const store=createAuthorityEpochStore({runtimeDir:runtime,policyBytes:beforeBytes});
+    const head=await store.append({plane:'process',action:'grant',grantBytes,grantInstanceNonce:grant.instance_nonce});
+    const engine=createEpochNativeContinuityEngine({stateRoot:state,
+      predecessorPolicyPaths:{process:beforePath,coding:null,autonomous:null,desktop:null,host:null},
+      successorPolicyPaths:async()=>({process:afterPath,coding:null,autonomous:null,desktop:null,host:null}),updateId:'r65-safe-engine'});
+    const observation={authority:{process:{configured:true,armed:true,reason:'standing-grant',epoch_seq:head.seq,epoch_sha256:head.event_sha256},
+      coding:{configured:false,armed:false,reason:'no-policy',epoch_seq:null,epoch_sha256:null},
+      autonomous:{configured:false,armed:false,reason:'no-policy',epoch_seq:null,epoch_sha256:null},
+      desktop:{configured:false,armed:false,reason:'no-policy',epoch_seq:null,epoch_sha256:null},
+      host:{configured:false,armed:false,reason:'no-policy',epoch_seq:null,epoch_sha256:null}}};
+    const subject='d'.repeat(64);
+    const capture=await engine.capture({observation,subject_sha256:subject,pointer:parent,expectedParent:parent,candidate,expectedCandidate:candidate});
+    await engine.revoke(capture);
+    const restored=await engine.restore({capture,successor_observation:{},activation:{verified:true,release_id:'v0.15.42-candidate'},
+      pointer:parent,expectedParent:parent,candidate,expectedCandidate:candidate,subject_sha256:subject});
+    assert.equal(restored.authority_outcomes.process,'RESTORED_SAFE');
+    const nextGrant=JSON.parse(await readFile(grantFile));
+    assert.notEqual(nextGrant.instance_nonce,grant.instance_nonce);
+    assert.deepEqual(nextGrant.root_ids,['core']);
+  }finally{await rm(root,{recursive:true,force:true});}
+});