deadbyte-mcp 0.15.39 → 0.15.42

package/test/r65-authority-runtime-epoch.test.mjs

@@ -0,0 +1,115 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,rm,writeFile,readFile} from 'node:fs/promises';
+import {createHash} from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import {loadCodingPolicy,codingSessionStatus} from '../src/coding-plane.mjs';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+import {prepareAuthorityTestTrust} from './r65-authority-test-trust.mjs';
+
+test('R65 standing Coding grant is disarmed until the durable epoch binds the exact bytes',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-runtime-epoch-'));
+  try{
+    const runtime=await prepareAuthorityTestTrust(root);
+    const project=path.join(root,'project');
+    await mkdir(project);
+    const policyPath=path.join(root,'coding.json');
+    const grantFile=path.join(runtime,'coding-grant.json');
+    await writeFile(policyPath,JSON.stringify({
+      schema:'deadbyte.coding-policy.v1',enabled:true,
+      lease_file:grantFile,evidence_dir:path.join(root,'evidence'),
+      roots:{project:{path:project,read:true,write:true,exec:false,deny_paths:[]}},
+      commands:{}
+    }));
+    const policy=await loadCodingPolicy(policyPath);
+    const grant={schema:'deadbyte.coding-grant.v2',policy_sha256:policy.policy_sha256,
+      instance_nonce:'a'.repeat(64),root_ids:['project'],granted_at_utc:'2026-10-06T00:00:00Z'};
+    await writeFile(grantFile,JSON.stringify(grant));
+    const legacy=await codingSessionStatus(policy);
+    assert.equal(legacy.armed,false);
+    assert.equal(legacy.reason,'legacy-no-epoch');
+
+    const grantBytes=await readFile(grantFile);
+    const store=createAuthorityEpochStore({runtimeDir:path.dirname(grantFile),policyBytes:await readFile(policyPath)});
+    await store.append({plane:'coding',action:'grant',grantBytes,grantInstanceNonce:grant.instance_nonce,updateId:null});
+    const trusted=await codingSessionStatus(policy);
+    assert.equal(trusted.armed,true);
+    assert.equal(trusted.reason,'standing-grant');
+    assert.equal(trusted.instance_nonce,grant.instance_nonce);
+  }finally{
+    await rm(root,{recursive:true,force:true});
+  }
+});
+
+
+test('all standing authority planes reject legacy grant bytes until an R65 epoch binds them',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-all-epochs-'));
+  try{
+    const runtime=await prepareAuthorityTestTrust(root);
+    const {processSessionStatus}=await import('../src/process-policy.mjs');
+    const {autonomousSessionStatus}=await import('../src/autonomous-policy.mjs');
+    const {desktopSessionStatus}=await import('../src/desktop-policy-r40.mjs');
+    const {assertHostArmed}=await import('../src/host-plane.mjs');
+    const project=path.join(root,'project');
+    await mkdir(project);
+    const cases=[
+      {
+        plane:'process',file:path.join(runtime,'process-grant.json'),
+        grant:{schema:'deadbyte.process-grant.v1',instance_nonce:'a'.repeat(64),profile_ids:['ping'],root_ids:['core'],granted_at_utc:'2026-10-06T00:00:00Z'},
+        status:async policy=>processSessionStatus(policy),
+        policy:{schema:'deadbyte.process-policy.v1',enabled:true,grant_file:path.join(runtime,'process-grant.json'),state_dir:runtime,
+          roots:{core:{path:project,deny_paths:[]}},profiles:{ping:{executable:process.execPath,root_ids:['core'],prefix_args:[]}}}
+      },
+      {
+        plane:'autonomous',file:path.join(runtime,'autonomous-grant.json'),
+        grant:{schema:'deadbyte.autonomous-grant.v2',coding_policy_sha256:'3'.repeat(64),instance_nonce:'b'.repeat(64),root_ids:['core'],granted_at_utc:'2026-10-06T00:00:00Z'},
+        status:async policy=>autonomousSessionStatus(policy),
+        policy:{schema:'deadbyte.autonomous-policy.v1',enabled:true,lease_file:path.join(runtime,'autonomous-grant.json'),evidence_dir:path.join(root,'evidence'),
+          coding_policy_sha256:'3'.repeat(64),root_ids:['core'],planner:{backend:'client_sampling'},limits:{max_iterations:4,max_mutations:4},profiles:{}}
+      },
+      {
+        plane:'desktop',file:path.join(runtime,'desktop-grant.json'),
+        grant:{schema:'deadbyte.desktop-grant.v1',instance_nonce:'c'.repeat(64),action_kinds:['click_primary'],granted_at_utc:'2026-10-06T00:00:00Z'},
+        status:async policy=>desktopSessionStatus(policy),
+        policy:{schema:'deadbyte.desktop-policy.v1',enabled:true,grant_file:path.join(runtime,'desktop-grant.json'),allowed_actions:['click_primary']}
+      }
+    ];
+    for(const item of cases){
+      const policyPath=path.join(root,`${item.plane}.json`);
+      const policyBytes=Buffer.from(JSON.stringify(item.policy));
+      await writeFile(policyPath,policyBytes);
+      item.policy.policy_path=policyPath;
+      item.policy.policy_sha256=createHash('sha256').update(policyBytes).digest('hex');
+      item.grant.policy_sha256=item.policy.policy_sha256;
+      const bytes=Buffer.from(JSON.stringify(item.grant));
+      await writeFile(item.file,bytes);
+      const legacy=await item.status(item.policy);
+      assert.equal(legacy.armed,false,item.plane);
+      assert.equal(legacy.reason,'legacy-no-epoch',item.plane);
+      await createAuthorityEpochStore({runtimeDir:runtime,policyBytes}).append({
+        plane:item.plane,action:'grant',grantBytes:bytes,grantInstanceNonce:item.grant.instance_nonce,updateId:null
+      });
+      const trusted=await item.status(item.policy);
+      assert.equal(trusted.armed,true,item.plane);
+    }
+
+    const hostFile=path.join(runtime,'host-grant.json');
+    const hostPolicyPath=path.join(root,'host.json');
+    const hostPolicyRaw={schema:'deadbyte.host-policy.v1',enabled:true,arm_file:hostFile,roots:{core:{path:project,read:true,write:false,exec:false}},commands:{}};
+    const hostPolicyBytes=Buffer.from(JSON.stringify(hostPolicyRaw));
+    await writeFile(hostPolicyPath,hostPolicyBytes);
+    const hostPolicySha=createHash('sha256').update(hostPolicyBytes).digest('hex');
+    const hostGrant={schema:'deadbyte.host-grant.v2',policy_sha256:hostPolicySha,instance_nonce:'d'.repeat(64),granted_at_utc:'2026-10-06T00:00:00Z'};
+    const hostBytes=Buffer.from(JSON.stringify(hostGrant));
+    await writeFile(hostFile,hostBytes);
+    const hostPolicy={policy_sha256:hostPolicySha,policy_path:hostPolicyPath,arm_file:hostFile};
+    await assert.rejects(()=>assertHostArmed(hostPolicy),/legacy-no-epoch/);
+    await createAuthorityEpochStore({runtimeDir:runtime,policyBytes:hostPolicyBytes}).append({
+      plane:'host',action:'grant',grantBytes:hostBytes,grantInstanceNonce:hostGrant.instance_nonce,updateId:null
+    });
+    assert.equal((await assertHostArmed(hostPolicy)).standing,true);
+  }finally{
+    await rm(root,{recursive:true,force:true});
+  }
+});

package/test/r65-authority-runtime-policy-binding.test.mjs

@@ -0,0 +1,29 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,rm,writeFile,readFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {loadCodingPolicy,codingSessionStatus} from '../src/coding-plane.mjs';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+import {prepareAuthorityTestTrust} from './r65-authority-test-trust.mjs';
+
+test('runtime refuses a signed grant epoch lacking exact policy security binding',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-policy-unbound-'));
+  try{
+    const runtime=await prepareAuthorityTestTrust(root),project=path.join(root,'project');
+    await mkdir(project);
+    const grantFile=path.join(runtime,'coding-grant.json'),policyFile=path.join(root,'coding-policy.json');
+    await writeFile(policyFile,JSON.stringify({schema:'deadbyte.coding-policy.v1',enabled:true,
+      lease_file:grantFile,evidence_dir:path.join(root,'evidence'),max_read_bytes:4096,max_write_bytes:4096,
+      roots:{core:{path:project,read:true,write:true,exec:false,deny_paths:[]}},commands:{}}));
+    const policy=await loadCodingPolicy(policyFile);
+    const nonce='a'.repeat(64);
+    await writeFile(grantFile,JSON.stringify({schema:'deadbyte.coding-grant.v2',policy_sha256:policy.policy_sha256,
+      instance_nonce:nonce,root_ids:['core'],granted_at_utc:'2026-10-06T00:00:00Z'}));
+    const grantBytes=await readFile(grantFile);
+    await createAuthorityEpochStore({runtimeDir:runtime}).append({plane:'coding',action:'grant',grantBytes,grantInstanceNonce:nonce,updateId:null});
+    const status=await codingSessionStatus(policy);
+    assert.equal(status.armed,false,'a signature alone must not authorize a policy-unbound epoch');
+    assert.match(status.reason,/epoch-policy/i);
+  }finally{await rm(root,{recursive:true,force:true});}
+});

package/test/r65-authority-test-trust.mjs

@@ -0,0 +1,20 @@
+import {generateKeyPairSync,createPrivateKey,createPublicKey} from 'node:crypto';
+import {mkdir,readFile,writeFile} from 'node:fs/promises';
+import path from 'node:path';
+
+export async function prepareAuthorityTestTrust(root){
+  const runtime=path.join(root,'runtime'),trust=path.join(root,'trust');
+  await mkdir(runtime,{recursive:true});
+  await mkdir(trust,{recursive:true});
+  const privatePath=path.join(trust,'ed25519-private.pem'),publicPath=path.join(trust,'ed25519-public.pem');
+  try{
+    const privateKey=createPrivateKey(await readFile(privatePath));
+    const publicKey=createPublicKey(await readFile(publicPath));
+    if(createPublicKey(privateKey).export({format:'der',type:'spki'}).equals(publicKey.export({format:'der',type:'spki'})))return runtime;
+    throw new Error('test authority trust key mismatch');
+  }catch(error){if(error?.code!=='ENOENT')throw error;}
+  const {privateKey,publicKey}=generateKeyPairSync('ed25519');
+  await writeFile(privatePath,privateKey.export({format:'pem',type:'pkcs8'}),{flag:'wx'});
+  await writeFile(publicPath,publicKey.export({format:'pem',type:'spki'}),{flag:'wx'});
+  return runtime;
+}

package/test/r65-cli-invocation.test.mjs

@@ -0,0 +1,38 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import {mkdtemp,rm,readFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+
+test('local source CLI remains deterministic by absolute Node entrypoint',()=>{
+  const run=spawnSync(process.execPath,[path.join(root,'src','deadbyte-cli.mjs'),'--version'],{cwd:root,encoding:'utf8',windowsHide:true});
+  assert.equal(run.status,0,run.stderr);
+  assert.match(run.stdout,/^\d+\.\d+\.\d+\s*$/);
+});
+
+test('repository compatibility CMD refuses to masquerade as an exact npm package bin', {skip:process.platform!=='win32'},()=>{
+  const run=spawnSync('cmd.exe',['/d','/c','DEADBYTE-MCP.cmd','--version'],{
+    cwd:root,env:{...process.env,npm_execpath:'C:\\fixture\\npm-cli.js'},encoding:'utf8',windowsHide:true,timeout:10000});
+  assert.equal(run.status,2);
+  assert.match(run.stderr,/shadows npm package bin/);
+  assert.doesNotMatch(run.stderr,/deadbyte-controller\.ps1/);
+});
+
+test('isolated exact local tarball invocation reaches its package bin outside the source tree', {skip:process.platform!=='win32',timeout:120000},async()=>{
+  const fixture=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-cli-package-'));
+  try{
+    const npmCli=process.env.npm_execpath||path.join(path.dirname(process.execPath),'node_modules','npm','bin','npm-cli.js');
+    const pkg=JSON.parse(await readFile(path.join(root,'package.json'),'utf8'));
+    const pack=spawnSync(process.execPath,[npmCli,'pack','--json','--pack-destination',fixture],{cwd:root,encoding:'utf8',timeout:45000,windowsHide:true});
+    assert.equal(pack.status,0,(pack.stderr||'').slice(-1000));
+    const packed=JSON.parse(pack.stdout);const tarball=path.join(fixture,packed[0]?.filename??packed['deadbyte-mcp']?.filename);
+    const run=spawnSync(process.execPath,[npmCli,'exec','--offline','--yes',`--package=file:${tarball}`,'--','deadbyte-mcp','--version'],{
+      cwd:fixture,encoding:'utf8',timeout:60000,windowsHide:true});
+    assert.equal(run.status,0,(run.stderr||'').slice(-1000));
+    assert.equal(run.stdout.trim(),pkg.version);
+  }finally{await rm(fixture,{recursive:true,force:true});}
+});

package/test/r65-controller-authority-epoch-live.test.mjs

@@ -0,0 +1,100 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,readFile,readdir,rm,stat,writeFile} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import {createHash} from 'node:crypto';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {windowsPowerShellEnvironment} from '../src/runtime-update.mjs';
+import {decodeUtf8Strict} from '../src/text-policy.mjs';
+import {prepareAuthorityTestTrust} from './r65-authority-test-trust.mjs';
+
+const core=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const controller=path.join(core,'controller','deadbyte-controller.ps1');
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const quote=s=>"'"+String(s).replaceAll("'","''")+"'";
+
+test('R65 real isolated controller arms and revokes Coding through durable epoch state', {skip:process.platform!=='win32'}, async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-controller-epoch-live-'));
+  try{
+    const runtime=path.join(root,'runtime'),workspace=path.join(root,'workspace');
+    await prepareAuthorityTestTrust(root);
+    await mkdir(workspace,{recursive:true});
+
+    const bridgeScript=path.join(root,'bridge.mjs');
+    const bridgeHelper=path.join(root,'public-tool-definitions.mjs');
+    await writeFile(bridgeScript,'// unlaunched bridge fixture\n');
+    await writeFile(bridgeHelper,'// pinned helper fixture\n');
+    const nodeHash=sha(await readFile(process.execPath));
+    const bridgeSpec=`@{FilePath=${quote(process.execPath)};FileSha256='${nodeHash}';Arguments='UNLAUNCHED';WorkingDirectory=${quote(root)};ScriptPath=${quote(bridgeScript)};ScriptSha256='${sha(await readFile(bridgeScript))}';Dependencies=@(@{Name='bridge-validator';Path=${quote(bridgeHelper)};Sha256='${sha(await readFile(bridgeHelper))}'})}`;
+    const cloudSpec=`@{FilePath=${quote(process.execPath)};FileSha256='${nodeHash}';Arguments='UNLAUNCHED';WorkingDirectory=${quote(root)};Dependencies=@()}`;
+
+    const codingPolicy=path.join(root,'coding-policy.json');
+    const codingGrant=path.join(runtime,'coding-grant.json');
+    await writeFile(codingPolicy,JSON.stringify({
+      schema:'deadbyte.coding-policy.v1',enabled:true,
+      lease_file:codingGrant,evidence_dir:path.join(root,'evidence','coding'),
+      max_read_bytes:65536,max_write_bytes:65536,
+      roots:{fixture:{path:workspace,read:true,write:true,exec:false,deny_paths:[]}},
+      commands:{}
+    }));
+
+    const config=path.join(root,'config.psd1');
+    await writeFile(config,`@{Schema='deadbyte.controller.v1';CoreRoot=${quote(core)};WorkspaceRoot=${quote(workspace)};Bridge=${bridgeSpec};Cloud=${cloudSpec};MachineRuntimeEnabled=$false;AgentRuntimeEnabled=$false;ProcessRuntimeEnabled=$false;ProcessPolicyFile='';CodingRuntimeEnabled=$true;CodingPolicyFile=${quote(codingPolicy)};MachineFsRuntimeEnabled=$false;ObservationRuntimeEnabled=$false;DesktopRuntimeEnabled=$false;DesktopPolicyFile='';AutonomousRuntimeEnabled=$false;AutonomousSupervisorEnabled=$false;AutonomousPolicyFile='';HostPolicyFile='';LocalReadyUri='http://127.0.0.1:1/health';UrlRegex='';McpUrlFile='';McpPathFile='';StartTimeoutSeconds=1;ProbeTimeoutSeconds=1}\n`);
+
+    const ps=path.join(process.env.SystemRoot,'System32/WindowsPowerShell/v1.0/powershell.exe');
+    const env=windowsPowerShellEnvironment({...process.env,DEADBYTE_STATE_ROOT:root,DEADBYTE_CONTROLLER_CONFIG:config,DEADBYTE_CONTROLLER_RUNTIME_ROOT:runtime});
+    const run=(command,json=false)=>spawnSync(ps,['-NoLogo','-NoProfile','-NonInteractive','-File',controller,command,...(json?['-Json']:[])],{env,encoding:'utf8',timeout:20000,windowsHide:true});
+
+    const armed=run('armcoding');
+    assert.equal(armed.status,0,armed.stderr);
+    assert.match(armed.stdout,/CODING PLANE ENABLED UNTIL EXPLICIT REVOKE/);
+    assert.match(armed.stdout,/Coding plane\s+: ARMED \[standing-grant\]/);
+
+    const grant=JSON.parse(decodeUtf8Strict(await readFile(codingGrant)));
+    const epochDir=path.join(runtime,'authority-epochs','coding');
+    const head=JSON.parse(await readFile(path.join(epochDir,'head.json'),'utf8'));
+    assert.equal(head.action,'grant');
+    assert.equal(head.grant_instance_nonce,grant.instance_nonce);
+    assert.equal(head.grant_sha256,sha(await readFile(codingGrant)));
+    assert.equal((await stat(path.join(epochDir,'events',head.event_file))).isFile(),true);
+
+    const observed=run('status',true);
+    assert.equal(observed.status,0,observed.stderr);
+    const status=JSON.parse(observed.stdout);
+    assert.equal(status.authority.coding.armed,true);
+    assert.equal(status.authority.coding.epoch_seq,1);
+    assert.match(status.authority.coding.epoch_sha256,/^[0-9a-f]{64}$/);
+
+    const revoked=run('disarmcoding');
+    assert.equal(revoked.status,0,revoked.stderr);
+    assert.match(revoked.stdout,/CODING PLANE DISARMED/);
+    await assert.rejects(()=>stat(codingGrant),error=>error?.code==='ENOENT');
+    const revokedHead=JSON.parse(await readFile(path.join(epochDir,'head.json'),'utf8'));
+    assert.equal(revokedHead.action,'user_revoke');
+    assert.equal(revokedHead.seq,head.seq+1);
+
+    const after=run('status',true);
+    assert.equal(after.status,0,after.stderr);
+    assert.equal(JSON.parse(after.stdout).authority.coding.armed,false);
+    assert.ok((await readdir(path.join(epochDir,'events'))).length>=2);
+
+    // An attacker who can rewrite unsigned hashes but not the local signing key
+    // must not turn a revoked standing grant back into controller authority.
+    const grantBytes=Buffer.from(JSON.stringify(grant));
+    await writeFile(codingGrant,grantBytes);
+    const revokedEventPath=path.join(epochDir,'events',revokedHead.event_file);
+    const forgedEvent=JSON.parse(await readFile(revokedEventPath,'utf8'));
+    forgedEvent.action='grant';
+    delete forgedEvent.attestation;
+    const forgedBytes=Buffer.from(JSON.stringify(forgedEvent));
+    const forgedHash=sha(forgedBytes);
+    const forgedName=`${String(revokedHead.seq).padStart(16,'0')}-${forgedHash}.json`;
+    await writeFile(path.join(epochDir,'events',forgedName),forgedBytes);
+    await writeFile(path.join(epochDir,'head.json'),JSON.stringify({...revokedHead,action:'grant',grant_sha256:sha(grantBytes),event_sha256:forgedHash,event_file:forgedName}));
+    const forged=run('status',true);
+    assert.equal(forged.status,0,forged.stderr);
+    assert.equal(JSON.parse(forged.stdout).authority.coding.armed,false);
+  }finally{await rm(root,{recursive:true,force:true});}
+});

package/test/r65-controller-authority-epoch.test.mjs

@@ -0,0 +1,37 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import {fileURLToPath} from 'node:url';
+
+const controller=fileURLToPath(new URL('../controller/deadbyte-controller.ps1',import.meta.url));
+
+function block(source,name,next){
+  const start=source.indexOf(`function ${name}`);
+  const end=source.indexOf(`function ${next}`,start);
+  assert.ok(start>=0&&end>start,`${name} block missing`);
+  return source.slice(start,end);
+}
+
+test('R65 controller binds standing grants to durable epochs with crash-safe ordering',async()=>{
+  const source=await readFile(controller,'utf8');
+  assert.match(source,/function Get-AuthorityEpochStatus/);
+  assert.match(source,/authority-epoch-cli-r65\.mjs/);
+  assert.match(source,/Invoke-AuthorityEpochCommand \$Cfg \$Plane 'status' \$GrantFile/,
+    'controller status must use the signed Node verifier, not a local hash-only interpretation');
+
+  const arm=block(source,'Arm-Coding','Disarm-Coding');
+  assert.ok(arm.indexOf('Move-Item')>=0);
+  assert.ok(arm.indexOf("Invoke-AuthorityEpochCommand $Cfg 'coding' 'grant'")>arm.indexOf('Move-Item'),
+    'grant epoch must commit only after grant bytes exist');
+
+  const disarm=block(source,'Disarm-Coding','Show-CodingStatus');
+  assert.ok(disarm.indexOf("Invoke-AuthorityEpochCommand $Cfg 'coding' 'user-revoke'")>=0);
+  assert.ok(disarm.indexOf('Remove-Item')>disarm.indexOf("Invoke-AuthorityEpochCommand $Cfg 'coding' 'user-revoke'"),
+    'user revoke epoch must commit before grant deletion');
+
+  for(const plane of ['Host','Process','Autonomous','Desktop']){
+    const status=block(source,`Get-${plane}${plane==='Host'?'ArmStatus':plane==='Process'?'GrantStatus':plane==='Autonomous'?'LeaseStatus':'GrantStatus'}`,
+      plane==='Host'?'Arm-Host':plane==='Process'?'Arm-Process':plane==='Autonomous'?'Arm-Autonomous':'Arm-Desktop');
+    assert.match(status,/Get-AuthorityEpochStatus/,`${plane} status must verify epoch`);
+  }
+});

package/test/r65-deploy-preflight.test.mjs

@@ -0,0 +1,55 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,mkdir,readFile,readdir,rm,writeFile} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import os from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+
+test('deploy dry preflight observes isolated authority without opening an update transaction', {skip:process.platform!=='win32'},async()=>{
+  const isolated=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-deploy-preflight-'));
+  try{
+    const state=path.join(isolated,'state'),bin=path.join(state,'bin');
+    await mkdir(bin,{recursive:true});
+    const release=JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8'));
+    const parent=release.parent;
+    const generationRoot=path.join(state,'generations',`${parent.release_id}-fixture`);
+    const policyRoot=path.join(state,'policies');
+    await mkdir(generationRoot,{recursive:true});await mkdir(policyRoot,{recursive:true});
+    const fields={process:'ProcessPolicyFile',coding:'CodingPolicyFile',autonomous:'AutonomousPolicyFile',desktop:'DesktopPolicyFile',host:'HostPolicyFile'};
+    const policyLines=[];
+    for(const [plane,key] of Object.entries(fields)){
+      const file=path.join(policyRoot,`${plane}.json`);
+      await writeFile(file,JSON.stringify({schema:`fixture.${plane}`,enabled:true}));
+      policyLines.push(`${key} = '${file.replaceAll("'","''")}'`);
+    }
+    await writeFile(path.join(generationRoot,'controller-config.psd1'),`@{ ${policyLines.join('; ')} }\n`);
+    await writeFile(path.join(state,'active-release.json'),JSON.stringify({schema:'deadbyte.active-release.v1',...parent,
+      release_root:path.join(state,'releases',parent.release_id),generation_root:generationRoot,
+      launcher_sha256:'a'.repeat(64),config_path:path.join(generationRoot,'controller-config.psd1')}));
+    const ps1=`param([string]$Command,[switch]$Json)\nif($Command -ne 'status' -or -not $Json){throw 'unexpected mutating command'}\n@{schema='deadbyte.controller-observation.v1';state='ONLINE';local_ready=$true;bridge=@{alive=$true;reason='verified';pid=10};core=@{alive=$true;reason='verified';pid=11};cloud=@{alive=$true;reason='verified';pid=12};supervisor=@{running=$true};authority=@{process=@{armed=$true;configured=$true;reason='fixture'};coding=@{armed=$true;configured=$true;reason='fixture'};autonomous=@{armed=$true;configured=$true;reason='fixture'};desktop=@{armed=$false;configured=$true;reason='fixture'};host=@{armed=$false;configured=$true;reason='fixture'}}} | ConvertTo-Json -Depth 6 -Compress\n`;
+    await writeFile(path.join(bin,'DEADBYTE-MCP.ps1'),ps1);
+    const run=spawnSync(process.execPath,[path.join(root,'scripts','deploy-r48.mjs'),'--preflight'],{
+      env:{...process.env,DEADBYTE_STATE_ROOT:state},cwd:root,encoding:'utf8',timeout:20000,windowsHide:true});
+    assert.equal(run.status,0,run.stderr);
+    const result=JSON.parse(run.stdout.trim());
+    assert.equal(result.state,'ONLINE_READY');
+    assert.equal(result.authority_continuity,'REAUTH_REQUIRED');
+    assert.deepEqual(result.reauth_planes,['process','coding','autonomous']);
+    const hostOnly=ps1.replace('process=@{armed=$true','process=@{armed=$false')
+      .replace('coding=@{armed=$true','coding=@{armed=$false')
+      .replace('autonomous=@{armed=$true','autonomous=@{armed=$false')
+      .replace('host=@{armed=$false','host=@{armed=$true');
+    await writeFile(path.join(bin,'DEADBYTE-MCP.ps1'),hostOnly);
+    const hostRun=spawnSync(process.execPath,[path.join(root,'scripts','deploy-r48.mjs'),'--preflight'],{
+      env:{...process.env,DEADBYTE_STATE_ROOT:state},cwd:root,encoding:'utf8',timeout:20000,windowsHide:true});
+    assert.equal(hostRun.status,0,hostRun.stderr);
+    const hostResult=JSON.parse(hostRun.stdout.trim());
+    assert.equal(hostResult.state,'ONLINE_HOST_ARMED');
+    assert.equal(hostResult.authority_continuity,'REAUTH_REQUIRED');
+    assert.deepEqual(hostResult.reauth_planes,['host']);
+    assert.deepEqual((await readdir(state)).sort(),['active-release.json','bin','generations','policies']);
+  }finally{await rm(isolated,{recursive:true,force:true});}
+});

package/test/r65-epoch-native-activation-integration.test.mjs

@@ -0,0 +1,141 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash,generateKeyPairSync} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,rm,writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {orchestrateActivation} from '../src/activation-preflight-r65.mjs';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+import {createEpochNativeContinuityEngine} from '../src/activation-continuity-engine-r65.mjs';
+
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const parent={release_id:'v0.15.41-parent',version:'0.15.41',manifest_sha256:'a'.repeat(64),generation_manifest_sha256:'b'.repeat(64)};
+const candidate={version:'0.15.42',manifest_sha256:'c'.repeat(64)};
+const ids={bridge:{alive:true,reason:'verified',pid:10},core:{alive:true,reason:'verified',pid:11},cloud:{alive:true,reason:'verified',pid:12}};
+const dummy={coding:'2'.repeat(64),autonomous:'3'.repeat(64),desktop:'4'.repeat(64),host:'5'.repeat(64)};
+
+async function optional(file){try{return await readFile(file);}catch(error){if(error?.code==='ENOENT')return null;throw error;}}
+
+test('epoch-native orchestrator uses transaction continuity engine instead of generic authority commands',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-epoch-activation-'));
+  try{
+    const state=path.join(root,'state'),runtime=path.join(state,'runtime'),trust=path.join(state,'trust'),policies=path.join(root,'policies');
+    await mkdir(runtime,{recursive:true});await mkdir(trust,{recursive:true});await mkdir(policies,{recursive:true});
+    const {privateKey,publicKey}=generateKeyPairSync('ed25519');
+    await writeFile(path.join(trust,'ed25519-private.pem'),privateKey.export({format:'pem',type:'pkcs8'}));
+    await writeFile(path.join(trust,'ed25519-public.pem'),publicKey.export({format:'pem',type:'spki'}));
+    const grantFile=path.join(runtime,'process-grant.json');
+    const policy={schema:'deadbyte.process-policy.v1',enabled:true,grant_file:grantFile,state_dir:path.join(state,'evidence','process'),
+      native_host:{path:'C:\\Windows\\System32\\cmd.exe',sha256:'6'.repeat(64)},
+      roots:{core:{path:'D:\\Projects',deny_paths:[]}},
+      profiles:{safe:{executable:'C:\\Windows\\System32\\cmd.exe',executable_sha256:'7'.repeat(64),root_ids:['core'],prefix_args:['/d'],max_input_bytes:4096}}};
+    const beforePath=path.join(policies,'before.json'),afterPath=path.join(policies,'after.json'),policyBytes=Buffer.from(JSON.stringify(policy));
+    await writeFile(beforePath,policyBytes);await writeFile(afterPath,policyBytes);
+    const oldGrant={schema:'deadbyte.process-grant.v1',policy_sha256:sha(policyBytes),instance_nonce:'8'.repeat(64),
+      profile_ids:['safe'],root_ids:['core'],granted_at_utc:'2026-10-07T00:00:00Z'};
+    const oldBytes=Buffer.from(JSON.stringify(oldGrant));await writeFile(grantFile,oldBytes);
+    const store=createAuthorityEpochStore({runtimeDir:runtime,policyBytes});
+    await store.append({plane:'process',action:'grant',grantBytes:oldBytes,grantInstanceNonce:oldGrant.instance_nonce});
+    let switched=false;
+    const observe=async()=>{
+      const bytes=await optional(grantFile),head=await store.readHead({plane:'process'});
+      let armed=false;
+      if(bytes){
+        const grant=JSON.parse(bytes);
+        armed=(await store.verifyGrant({plane:'process',grantBytes:bytes,grantInstanceNonce:grant.instance_nonce,policyBytes})).trusted;
+      }
+      return {state:'ONLINE',local_ready:true,...ids,supervisor:{running:true},authority:{
+        process:{configured:true,armed,reason:armed?'standing-grant':'disarmed',epoch_seq:armed?head.seq:null,epoch_sha256:armed?head.event_sha256:null},
+        coding:{configured:true,armed:false,reason:'disarmed',epoch_seq:null,epoch_sha256:null},
+        autonomous:{configured:true,armed:false,reason:'disarmed',epoch_seq:null,epoch_sha256:null},
+        desktop:{configured:true,armed:false,reason:'disarmed',epoch_seq:null,epoch_sha256:null},
+        host:{configured:true,armed:false,reason:'disarmed',epoch_seq:null,epoch_sha256:null}
+      },policy_sha256:{process:sha(policyBytes),...dummy},
+      active_release_id:switched?'v0.15.42-candidate':parent.release_id,
+      active_manifest_sha256:switched?candidate.manifest_sha256:parent.manifest_sha256,
+      active_generation_manifest_sha256:switched?'9'.repeat(64):parent.generation_manifest_sha256};
+    };
+    const engine=createEpochNativeContinuityEngine({stateRoot:state,
+      predecessorPolicyPaths:{process:beforePath,coding:null,autonomous:null,desktop:null,host:null},
+      successorPolicyPaths:async()=>({process:afterPath,coding:null,autonomous:null,desktop:null,host:null}),
+      updateId:'r65-integrated-activation'});
+    const genericCommands=[];
+    const result=await orchestrateActivation({pointer:parent,expectedParent:parent,candidate,expectedCandidate:candidate,
+      observe,command:async name=>{genericCommands.push(name);throw new Error('generic authority command forbidden for epoch-native path');},
+      activate:async()=>{const before=await observe();assert.equal(before.authority.process.armed,false);switched=true;return {verified:true,release_id:'v0.15.42-candidate'};},
+      continuityEngine:engine});
+    assert.equal(result.state,'ACTIVATED');
+    assert.equal(result.authority_continuity,'RESTORED_EXACT');
+    assert.equal(result.authority_outcomes.process,'RESTORED_EXACT');
+    assert.deepEqual(genericCommands,[]);
+    assert.equal(result.final_authority.process,true);
+    const restoredBytes=await readFile(grantFile),restored=JSON.parse(restoredBytes);
+    assert.notEqual(restored.instance_nonce,oldGrant.instance_nonce);
+    const head=await store.readHead({plane:'process'});
+    assert.equal(head.action,'transaction_restore');
+    assert.equal(head.restore_binding.candidate_manifest_sha256,candidate.manifest_sha256);
+    assert.equal(head.restore_binding.continuity_subject_sha256,result.subject_sha256);
+  }finally{await rm(root,{recursive:true,force:true});}
+});
+
+
+test('epoch-native explicit user revoke after transaction revoke wins over orchestrated restore',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-epoch-revoke-race-'));
+  try{
+    const state=path.join(root,'state'),runtime=path.join(state,'runtime'),trust=path.join(state,'trust'),policies=path.join(root,'policies');
+    await mkdir(runtime,{recursive:true});await mkdir(trust,{recursive:true});await mkdir(policies,{recursive:true});
+    const {privateKey,publicKey}=generateKeyPairSync('ed25519');
+    await writeFile(path.join(trust,'ed25519-private.pem'),privateKey.export({format:'pem',type:'pkcs8'}));
+    await writeFile(path.join(trust,'ed25519-public.pem'),publicKey.export({format:'pem',type:'spki'}));
+    const grantFile=path.join(runtime,'process-grant.json');
+    const policy={schema:'deadbyte.process-policy.v1',enabled:true,grant_file:grantFile,state_dir:path.join(state,'evidence','process'),
+      native_host:{path:'C:\\Windows\\System32\\cmd.exe',sha256:'6'.repeat(64)},
+      roots:{core:{path:'D:\\Projects',deny_paths:[]}},
+      profiles:{safe:{executable:'C:\\Windows\\System32\\cmd.exe',executable_sha256:'7'.repeat(64),root_ids:['core'],prefix_args:['/d'],max_input_bytes:4096}}};
+    const beforePath=path.join(policies,'before.json'),afterPath=path.join(policies,'after.json'),policyBytes=Buffer.from(JSON.stringify(policy));
+    await writeFile(beforePath,policyBytes);await writeFile(afterPath,policyBytes);
+    const oldGrant={schema:'deadbyte.process-grant.v1',policy_sha256:sha(policyBytes),instance_nonce:'a'.repeat(64),
+      profile_ids:['safe'],root_ids:['core'],granted_at_utc:'2026-10-07T00:00:00Z'};
+    const oldBytes=Buffer.from(JSON.stringify(oldGrant));await writeFile(grantFile,oldBytes);
+    const store=createAuthorityEpochStore({runtimeDir:runtime,policyBytes});
+    await store.append({plane:'process',action:'grant',grantBytes:oldBytes,grantInstanceNonce:oldGrant.instance_nonce});
+    let switched=false;
+    const observe=async()=>{
+      const bytes=await optional(grantFile),head=await store.readHead({plane:'process'});
+      let armed=false;
+      if(bytes){
+        const grant=JSON.parse(bytes);
+        armed=(await store.verifyGrant({plane:'process',grantBytes:bytes,grantInstanceNonce:grant.instance_nonce,policyBytes})).trusted;
+      }
+      return {state:'ONLINE',local_ready:true,...ids,supervisor:{running:true},authority:{
+        process:{configured:true,armed,reason:armed?'standing-grant':'disarmed',epoch_seq:armed?head.seq:null,epoch_sha256:armed?head.event_sha256:null},
+        coding:{configured:true,armed:false,reason:'disarmed',epoch_seq:null,epoch_sha256:null},
+        autonomous:{configured:true,armed:false,reason:'disarmed',epoch_seq:null,epoch_sha256:null},
+        desktop:{configured:true,armed:false,reason:'disarmed',epoch_seq:null,epoch_sha256:null},
+        host:{configured:true,armed:false,reason:'disarmed',epoch_seq:null,epoch_sha256:null}
+      },policy_sha256:{process:sha(policyBytes),...dummy},
+      active_release_id:switched?'v0.15.42-candidate':parent.release_id,
+      active_manifest_sha256:switched?candidate.manifest_sha256:parent.manifest_sha256,
+      active_generation_manifest_sha256:switched?'9'.repeat(64):parent.generation_manifest_sha256};
+    };
+    const engine=createEpochNativeContinuityEngine({stateRoot:state,
+      predecessorPolicyPaths:{process:beforePath,coding:null,autonomous:null,desktop:null,host:null},
+      successorPolicyPaths:async()=>({process:afterPath,coding:null,autonomous:null,desktop:null,host:null}),
+      updateId:'r65-integrated-user-revoke'});
+    const result=await orchestrateActivation({pointer:parent,expectedParent:parent,candidate,expectedCandidate:candidate,
+      observe,command:async()=>{throw new Error('generic authority command forbidden for epoch-native path');},
+      activate:async()=>{
+        const head=await store.readHead({plane:'process'});
+        assert.equal(head.action,'transaction_revoke');
+        await store.append({plane:'process',action:'user_revoke',grantBytes:oldBytes,grantInstanceNonce:oldGrant.instance_nonce,updateId:null});
+        switched=true;
+        return {verified:true,release_id:'v0.15.42-candidate'};
+      },continuityEngine:engine});
+    assert.equal(result.state,'ACTIVATED');
+    assert.equal(result.authority_continuity,'REAUTH_REQUIRED');
+    assert.equal(result.authority_outcomes.process,'REVOKED_DURING_UPDATE');
+    assert.equal(result.final_authority.process,false);
+    assert.equal((await store.readHead({plane:'process'})).action,'user_revoke');
+    assert.equal(await optional(grantFile),null);
+  }finally{await rm(root,{recursive:true,force:true});}
+});