deadbyte-mcp 0.15.39 → 0.15.42

package/test/r65-epoch-native-continuity-engine.test.mjs

@@ -0,0 +1,112 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash,generateKeyPairSync} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,rm,writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+import {createEpochNativeContinuityEngine} from '../src/activation-continuity-engine-r65.mjs';
+
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const candidate={version:'0.15.42',manifest_sha256:'a'.repeat(64)};
+const predecessor={release_id:'v0.15.41-parent',generation_manifest_sha256:'b'.repeat(64)};
+
+async function fixture(){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-continuity-engine-'));
+  const state=path.join(root,'state'),runtime=path.join(state,'runtime'),trust=path.join(state,'trust'),policies=path.join(root,'policies');
+  await mkdir(runtime,{recursive:true});await mkdir(trust,{recursive:true});await mkdir(policies,{recursive:true});
+  const {privateKey,publicKey}=generateKeyPairSync('ed25519');
+  await writeFile(path.join(trust,'ed25519-private.pem'),privateKey.export({format:'pem',type:'pkcs8'}));
+  await writeFile(path.join(trust,'ed25519-public.pem'),publicKey.export({format:'pem',type:'spki'}));
+  const grantFile=path.join(runtime,'process-grant.json');
+  const policy={
+    schema:'deadbyte.process-policy.v1',enabled:true,grant_file:grantFile,state_dir:path.join(state,'evidence','process'),
+    native_host:{path:'C:\\Windows\\System32\\cmd.exe',sha256:'c'.repeat(64)},
+    roots:{core:{path:'D:\\Projects',deny_paths:[]}},
+    profiles:{safe:{executable:'C:\\Windows\\System32\\cmd.exe',executable_sha256:'d'.repeat(64),root_ids:['core'],prefix_args:['/d'],max_input_bytes:4096}}
+  };
+  const predecessorPolicyPath=path.join(policies,'process-before.json'),successorPolicyPath=path.join(policies,'process-after.json');
+  const policyBytes=Buffer.from(JSON.stringify(policy));
+  await writeFile(predecessorPolicyPath,policyBytes);await writeFile(successorPolicyPath,policyBytes);
+  const grant={schema:'deadbyte.process-grant.v1',policy_sha256:sha(policyBytes),instance_nonce:'e'.repeat(64),
+    profile_ids:['safe'],root_ids:['core'],granted_at_utc:'2026-10-07T00:00:00Z'};
+  const grantBytes=Buffer.from(JSON.stringify(grant));
+  await writeFile(grantFile,grantBytes);
+  const store=createAuthorityEpochStore({runtimeDir:runtime,policyBytes});
+  const head=await store.append({plane:'process',action:'grant',grantBytes,grantInstanceNonce:grant.instance_nonce});
+  const policyPaths={process:predecessorPolicyPath,coding:null,autonomous:null,desktop:null,host:null};
+  const observation={authority:{
+    process:{configured:true,armed:true,reason:'standing-grant',epoch_seq:head.seq,epoch_sha256:head.event_sha256},
+    coding:{configured:false,armed:false,reason:'no-policy',epoch_seq:null,epoch_sha256:null},
+    autonomous:{configured:false,armed:false,reason:'no-policy',epoch_seq:null,epoch_sha256:null},
+    desktop:{configured:false,armed:false,reason:'no-policy',epoch_seq:null,epoch_sha256:null},
+    host:{configured:false,armed:false,reason:'no-policy',epoch_seq:null,epoch_sha256:null}
+  }};
+  const engine=createEpochNativeContinuityEngine({stateRoot:state,predecessorPolicyPaths:policyPaths,
+    successorPolicyPaths:async()=>({...policyPaths,process:successorPolicyPath}),updateId:'r65-engine-e2e'});
+  return {root,state,runtime,grantFile,policyBytes,grantBytes,grant,head,observation,engine,store};
+}
+
+test('epoch-native engine revokes then restores exact Process scope with a fresh nonce',async()=>{
+  const f=await fixture();
+  try{
+    const capture=await f.engine.capture({observation:f.observation,subject_sha256:'f'.repeat(64),pointer:predecessor,
+      expectedParent:predecessor,candidate,expectedCandidate:candidate});
+    assert.deepEqual(capture.planes,['process']);
+    await f.engine.revoke(capture);
+    const staleAfterRevoke=await readFile(f.grantFile);
+    assert.equal(sha(staleAfterRevoke),sha(f.grantBytes),'transaction revoke preserves the old bytes as a no-clobber sentinel');
+    const revoked=await f.store.readHead({plane:'process'});
+    assert.equal(revoked.action,'transaction_revoke');
+    assert.equal((await f.store.verifyGrant({plane:'process',grantBytes:staleAfterRevoke,grantInstanceNonce:f.grant.instance_nonce,policyBytes:f.policyBytes})).trusted,false);
+    const restored=await f.engine.restore({capture,successor_observation:{},activation:{verified:true,release_id:'v0.15.42-candidate'},
+      pointer:predecessor,expectedParent:predecessor,candidate,expectedCandidate:candidate,subject_sha256:'f'.repeat(64)});
+    assert.equal(restored.authority_outcomes.process,'RESTORED_EXACT');
+    assert.deepEqual(restored.reauth_planes,[]);
+    const nextBytes=await readFile(f.grantFile),next=JSON.parse(nextBytes);
+    assert.notEqual(next.instance_nonce,f.grant.instance_nonce);
+    assert.deepEqual(next.profile_ids,f.grant.profile_ids);
+    assert.deepEqual(next.root_ids,f.grant.root_ids);
+    assert.equal(next.policy_sha256,sha(f.policyBytes));
+    const finalHead=await f.store.readHead({plane:'process'});
+    assert.equal(finalHead.action,'transaction_restore');
+    const verified=await f.store.verifyGrant({plane:'process',grantBytes:nextBytes,grantInstanceNonce:next.instance_nonce,policyBytes:f.policyBytes});
+    assert.equal(verified.trusted,true);
+  }finally{await rm(f.root,{recursive:true,force:true});}
+});
+
+test('user revoke committed after transaction revoke prevents restoration',async()=>{
+  const f=await fixture();
+  try{
+    const capture=await f.engine.capture({observation:f.observation,subject_sha256:'f'.repeat(64),pointer:predecessor,
+      expectedParent:predecessor,candidate,expectedCandidate:candidate});
+    await f.engine.revoke(capture);
+    const revoked=await f.store.readHead({plane:'process'});
+    await f.store.append({plane:'process',action:'user_revoke',grantBytes:f.grantBytes,grantInstanceNonce:f.grant.instance_nonce});
+    const restored=await f.engine.restore({capture,successor_observation:{},activation:{verified:true,release_id:'v0.15.42-candidate'},
+      pointer:predecessor,expectedParent:predecessor,candidate,expectedCandidate:candidate,subject_sha256:'f'.repeat(64)});
+    assert.equal(restored.authority_outcomes.process,'REVOKED_DURING_UPDATE');
+    assert.deepEqual(restored.reauth_planes,['process']);
+    const current=await f.store.readHead({plane:'process'});
+    assert.equal(current.action,'user_revoke');
+    assert.notEqual(current.event_sha256,revoked.event_sha256);
+    await assert.rejects(readFile(f.grantFile),error=>error?.code==='ENOENT');
+  }finally{await rm(f.root,{recursive:true,force:true});}
+});
+
+
+test('grant disappearance after transaction revoke is treated as external/user revocation and is never auto-restored',async()=>{
+  const f=await fixture();
+  try{
+    const capture=await f.engine.capture({observation:f.observation,subject_sha256:'f'.repeat(64),pointer:predecessor,
+      expectedParent:predecessor,candidate,expectedCandidate:candidate});
+    await f.engine.revoke(capture);
+    await rm(f.grantFile,{force:true});
+    const restored=await f.engine.restore({capture,successor_observation:{},activation:{verified:true,release_id:'v0.15.42-candidate'},
+      pointer:predecessor,expectedParent:predecessor,candidate,expectedCandidate:candidate,subject_sha256:'f'.repeat(64)});
+    assert.equal(restored.authority_outcomes.process,'REVOKED_DURING_UPDATE');
+    assert.deepEqual(restored.reauth_planes,['process']);
+    await assert.rejects(readFile(f.grantFile),error=>error?.code==='ENOENT');
+    assert.equal((await f.store.readHead({plane:'process'})).action,'transaction_revoke');
+  }finally{await rm(f.root,{recursive:true,force:true});}
+});

package/test/r65-epoch-native-cross-plane.test.mjs

@@ -0,0 +1,95 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash,generateKeyPairSync} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,rm,writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {createAuthorityEpochStore} from '../src/authority-continuity-r65.mjs';
+import {createEpochNativeContinuityEngine} from '../src/activation-continuity-engine-r65.mjs';
+
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const predecessor={release_id:'v0.15.41-parent',generation_manifest_sha256:'a'.repeat(64)};
+const candidate={version:'0.15.42',manifest_sha256:'b'.repeat(64)};
+const subject='c'.repeat(64);
+
+async function setup({widenCoding=false}={}){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-cross-plane-'));
+  const state=path.join(root,'state'),runtime=path.join(state,'runtime'),trust=path.join(state,'trust'),policies=path.join(root,'policies');
+  await mkdir(runtime,{recursive:true});await mkdir(trust,{recursive:true});await mkdir(policies,{recursive:true});
+  const {privateKey,publicKey}=generateKeyPairSync('ed25519');
+  await writeFile(path.join(trust,'ed25519-private.pem'),privateKey.export({format:'pem',type:'pkcs8'}));
+  await writeFile(path.join(trust,'ed25519-public.pem'),publicKey.export({format:'pem',type:'spki'}));
+
+  const codingGrantFile=path.join(runtime,'coding-grant.json'),autonomousGrantFile=path.join(runtime,'autonomous-grant.json');
+  const codingBefore={schema:'deadbyte.coding-policy.v1',enabled:true,lease_file:codingGrantFile,evidence_dir:path.join(state,'evidence','coding'),
+    max_read_bytes:4096,max_write_bytes:4096,roots:{core:{path:'D:\\Projects',read:true,write:true,exec:false,deny_paths:[]}},commands:{}};
+  const codingAfter=widenCoding?{...codingBefore,roots:{...codingBefore.roots,extra:{path:'D:\\Extra',read:true,write:true,exec:false,deny_paths:[]}}}:codingBefore;
+  const codingBeforeBytes=Buffer.from(JSON.stringify(codingBefore)),codingAfterBytes=Buffer.from(JSON.stringify(codingAfter));
+  const autonomousBefore={schema:'deadbyte.autonomous-policy.v1',enabled:true,lease_file:autonomousGrantFile,evidence_dir:path.join(state,'evidence','autonomous'),
+    coding_policy_sha256:sha(codingBeforeBytes),root_ids:['core'],planner:{backend:'client_sampling',max_tokens:1000},
+    limits:{max_iterations:4,max_mutations:4,max_wall_ms:10000,max_context_bytes:10000,max_diff_bytes:10000,max_files_per_diff:10},profiles:{}};
+  const autonomousAfter={...autonomousBefore,coding_policy_sha256:sha(codingAfterBytes)};
+  const autonomousBeforeBytes=Buffer.from(JSON.stringify(autonomousBefore)),autonomousAfterBytes=Buffer.from(JSON.stringify(autonomousAfter));
+
+  const cb=path.join(policies,'coding-before.json'),ca=path.join(policies,'coding-after.json'),ab=path.join(policies,'autonomous-before.json'),aa=path.join(policies,'autonomous-after.json');
+  await writeFile(cb,codingBeforeBytes);await writeFile(ca,codingAfterBytes);await writeFile(ab,autonomousBeforeBytes);await writeFile(aa,autonomousAfterBytes);
+
+  const codingGrant={schema:'deadbyte.coding-grant.v2',policy_sha256:sha(codingBeforeBytes),instance_nonce:'d'.repeat(64),root_ids:['core'],granted_at_utc:'2026-10-07T00:00:00Z'};
+  const autonomousGrant={schema:'deadbyte.autonomous-grant.v2',policy_sha256:sha(autonomousBeforeBytes),coding_policy_sha256:sha(codingBeforeBytes),
+    instance_nonce:'e'.repeat(64),root_ids:['core'],granted_at_utc:'2026-10-07T00:00:00Z'};
+  const codingGrantBytes=Buffer.from(JSON.stringify(codingGrant)),autonomousGrantBytes=Buffer.from(JSON.stringify(autonomousGrant));
+  await writeFile(codingGrantFile,codingGrantBytes);await writeFile(autonomousGrantFile,autonomousGrantBytes);
+  const codingStore=createAuthorityEpochStore({runtimeDir:runtime,policyBytes:codingBeforeBytes});
+  const autonomousStore=createAuthorityEpochStore({runtimeDir:runtime,policyBytes:autonomousBeforeBytes});
+  const codingHead=await codingStore.append({plane:'coding',action:'grant',grantBytes:codingGrantBytes,grantInstanceNonce:codingGrant.instance_nonce});
+  const autonomousHead=await autonomousStore.append({plane:'autonomous',action:'grant',grantBytes:autonomousGrantBytes,grantInstanceNonce:autonomousGrant.instance_nonce});
+
+  const predecessorPolicyPaths={process:null,coding:cb,autonomous:ab,desktop:null,host:null};
+  const successorPolicyPaths={process:null,coding:ca,autonomous:aa,desktop:null,host:null};
+  const observation={authority:{
+    process:{configured:false,armed:false,reason:'no-policy',epoch_seq:null,epoch_sha256:null},
+    coding:{configured:true,armed:true,reason:'standing-grant',epoch_seq:codingHead.seq,epoch_sha256:codingHead.event_sha256},
+    autonomous:{configured:true,armed:true,reason:'standing-grant',epoch_seq:autonomousHead.seq,epoch_sha256:autonomousHead.event_sha256},
+    desktop:{configured:false,armed:false,reason:'no-policy',epoch_seq:null,epoch_sha256:null},
+    host:{configured:false,armed:false,reason:'no-policy',epoch_seq:null,epoch_sha256:null}
+  }};
+  const engine=createEpochNativeContinuityEngine({stateRoot:state,predecessorPolicyPaths,successorPolicyPaths:async()=>successorPolicyPaths,updateId:'r65-cross-plane'});
+  return {root,state,runtime,codingGrantFile,autonomousGrantFile,codingStore,autonomousStore,codingGrant,autonomousGrant,codingBeforeBytes,autonomousBeforeBytes,observation,engine};
+}
+
+test('Coding restores before Autonomous and both receive fresh nonces under equal authority ceilings',async()=>{
+  const f=await setup();
+  try{
+    const capture=await f.engine.capture({observation:f.observation,subject_sha256:subject,pointer:predecessor,expectedParent:predecessor,candidate,expectedCandidate:candidate});
+    await f.engine.revoke(capture);
+    const restored=await f.engine.restore({capture,successor_observation:{},activation:{verified:true,release_id:'v0.15.42-candidate'},
+      pointer:predecessor,expectedParent:predecessor,candidate,expectedCandidate:candidate,subject_sha256:subject});
+    assert.equal(restored.authority_outcomes.coding,'RESTORED_EXACT');
+    assert.equal(restored.authority_outcomes.autonomous,'RESTORED_EXACT');
+    const coding=JSON.parse(await readFile(f.codingGrantFile)),autonomous=JSON.parse(await readFile(f.autonomousGrantFile));
+    assert.notEqual(coding.instance_nonce,f.codingGrant.instance_nonce);
+    assert.notEqual(autonomous.instance_nonce,f.autonomousGrant.instance_nonce);
+    assert.equal((await f.codingStore.readHead({plane:'coding'})).action,'transaction_restore');
+    assert.equal((await f.autonomousStore.readHead({plane:'autonomous'})).action,'transaction_restore');
+  }finally{await rm(f.root,{recursive:true,force:true});}
+});
+
+test('Coding policy widening blocks Coding and therefore Autonomous remains DISARMED/REAUTH_REQUIRED',async()=>{
+  const f=await setup({widenCoding:true});
+  try{
+    const capture=await f.engine.capture({observation:f.observation,subject_sha256:subject,pointer:predecessor,expectedParent:predecessor,candidate,expectedCandidate:candidate});
+    await f.engine.revoke(capture);
+    const restored=await f.engine.restore({capture,successor_observation:{},activation:{verified:true,release_id:'v0.15.42-candidate'},
+      pointer:predecessor,expectedParent:predecessor,candidate,expectedCandidate:candidate,subject_sha256:subject});
+    assert.equal(restored.authority_outcomes.coding,'POLICY_WIDENED');
+    assert.equal(restored.authority_outcomes.autonomous,'REAUTH_REQUIRED');
+    assert.ok(restored.reauth_planes.includes('coding'));
+    assert.ok(restored.reauth_planes.includes('autonomous'));
+    const codingBytes=await readFile(f.codingGrantFile),coding=JSON.parse(codingBytes);
+    const autonomousBytes=await readFile(f.autonomousGrantFile),autonomous=JSON.parse(autonomousBytes);
+    assert.equal((await f.codingStore.readHead({plane:'coding'})).action,'transaction_revoke');
+    assert.equal((await f.autonomousStore.readHead({plane:'autonomous'})).action,'transaction_revoke');
+    assert.equal((await f.codingStore.verifyGrant({plane:'coding',grantBytes:codingBytes,grantInstanceNonce:coding.instance_nonce,policyBytes:f.codingBeforeBytes})).trusted,false);
+    assert.equal((await f.autonomousStore.verifyGrant({plane:'autonomous',grantBytes:autonomousBytes,grantInstanceNonce:autonomous.instance_nonce,policyBytes:f.autonomousBeforeBytes})).trusted,false);
+  }finally{await rm(f.root,{recursive:true,force:true});}
+});

package/test/r65-legacy-authority-migration.test.mjs

@@ -0,0 +1,63 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {classifyAuthorityContinuity,orchestrateActivation} from '../src/activation-preflight-r65.mjs';
+
+const parent={release_id:'v0.15.41-parent',version:'0.15.41',manifest_sha256:'1'.repeat(64),generation_manifest_sha256:'2'.repeat(64)};
+const candidate={version:'0.15.42',manifest_sha256:'3'.repeat(64)};
+const policy_sha256={process:'4'.repeat(64),coding:'5'.repeat(64),autonomous:'6'.repeat(64),desktop:'7'.repeat(64),host:'8'.repeat(64)};
+const liveIds={bridge:{alive:true,reason:'verified',pid:10},core:{alive:true,reason:'verified',pid:11},cloud:{alive:true,reason:'verified',pid:12}};
+
+function legacyEntry(armed){return {configured:true,armed,reason:armed?'standing-grant':'disarmed',epoch_seq:null,epoch_sha256:null};}
+function fixture(vector){
+  const calls=[];
+  let observation={state:'ONLINE',local_ready:true,...liveIds,supervisor:{running:true},policy_sha256,
+    active_release_id:parent.release_id,active_manifest_sha256:parent.manifest_sha256,active_generation_manifest_sha256:parent.generation_manifest_sha256,
+    authority:Object.fromEntries(Object.entries(vector).map(([plane,armed])=>[plane,legacyEntry(armed)]))};
+  return {
+    calls,
+    observe:async()=>observation,
+    command:async command=>{
+      calls.push(command);
+      if(command.startsWith('disarm')){
+        const plane=command.slice(6);
+        observation={...observation,authority:{...observation.authority,[plane]:legacyEntry(false)}};
+        if(plane==='coding')observation={...observation,authority:{...observation.authority,autonomous:legacyEntry(false)}};
+      }else throw new Error('unexpected command '+command);
+    },
+    activate:async()=>{
+      calls.push('activate');
+      observation={...observation,state:'ONLINE',local_ready:true,...liveIds,supervisor:{running:true}};
+      return {verified:true,release_id:'v0.15.42-new'};
+    }
+  };
+}
+
+test('legacy R64 standing grants are classified REAUTH_REQUIRED, never continuity-trusted',()=>{
+  const observation=fixture({process:true,coding:true,autonomous:true,desktop:true,host:true}).observe();
+  return observation.then(value=>{
+    const result=classifyAuthorityContinuity(value);
+    assert.equal(result.state,'LEGACY_REAUTH_REQUIRED');
+    assert.deepEqual(result.reauth_planes,['process','coding','autonomous','desktop','host']);
+    assert.deepEqual(result.epoch_planes,[]);
+  });
+});
+
+test('R64 to R65 activation revokes legacy authority before mutation and leaves successor disarmed',async()=>{
+  const f=fixture({process:true,coding:true,autonomous:true,desktop:true,host:true});
+  const result=await orchestrateActivation({pointer:parent,expectedParent:parent,candidate,expectedCandidate:candidate,...f});
+  assert.equal(result.state,'ACTIVATED');
+  assert.equal(result.runtime_activation,'ACTIVATED');
+  assert.equal(result.authority_continuity,'REAUTH_REQUIRED');
+  assert.deepEqual(result.reauth_planes,['process','coding','autonomous','desktop','host']);
+  assert.deepEqual(f.calls,['disarmhost','disarmdesktop','disarmautonomous','disarmcoding','disarmprocess','activate']);
+  assert.deepEqual(result.final_authority,{process:false,coding:false,autonomous:false,desktop:false,host:false});
+});
+
+test('activation with no standing authority has no reauth requirement',async()=>{
+  const f=fixture({process:false,coding:false,autonomous:false,desktop:false,host:false});
+  const result=await orchestrateActivation({pointer:parent,expectedParent:parent,candidate,expectedCandidate:candidate,...f});
+  assert.equal(result.state,'ACTIVATED');
+  assert.equal(result.authority_continuity,'NOT_APPLICABLE');
+  assert.deepEqual(result.reauth_planes,[]);
+  assert.deepEqual(f.calls,['activate']);
+});

package/test/r65-legacy-auto-restore-rejection.test.mjs

@@ -0,0 +1,17 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp,readdir,rm} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {performSlotUpdate} from '../src/runtime-update.mjs';
+
+test('R65 updater rejects legacy standing-grant auto-restore before transaction creation',async()=>{
+  const stateRoot=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-no-auto-restore-'));
+  try{
+    await assert.rejects(()=>performSlotUpdate({stage:path.join(stateRoot,'stage'),
+      developmentRoot:path.join(stateRoot,'development'),expectedVersion:'0.15.42',
+      expectedManifest:'a'.repeat(64),stateRoot,restoreStandingGrants:true}),
+    /standing.*restore.*(disabled|unsupported|forbidden)/i);
+    assert.deepEqual(await readdir(stateRoot),[],'rejected request must not create update residue');
+  }finally{await rm(stateRoot,{recursive:true,force:true});}
+});

package/test/r65-npm-publication.test.mjs

@@ -0,0 +1,114 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {mkdtemp, readFile, rm, mkdir, writeFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {createHash} from 'node:crypto';
+import {reconcileNpmPublication} from '../scripts/npm-publication-r65.mjs';
+
+const bytes=Buffer.from('r65 immutable npm artifact');
+const hash=(name)=>createHash(name).update(bytes).digest(name==='sha512'?'base64':'hex');
+const version='0.15.42';
+const manifestSha256='b'.repeat(64);
+const published={version,dist:{integrity:`sha512-${hash('sha512')}`,shasum:hash('sha1'),tarball:`https://registry.npmjs.org/deadbyte-mcp/-/deadbyte-mcp-${version}.tgz`}};
+
+async function fixture(run){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-npm-'));
+  try{return await run(path.join(root,'publication'));}finally{await rm(root,{recursive:true,force:true});}
+}
+
+test('accepted publication survives two transient 404s and verifies exact registry bytes',()=>fixture(async recordPath=>{
+  let publishes=0,views=0;
+  const result=await reconcileNpmPublication({recordPath,version,manifestSha256,localBytes:bytes,timeoutMs:1000,pollMs:1,
+    publish:async()=>{publishes++;return {accepted:true};},
+    lookup:async()=>{views++;return views<4?null:published;},
+    tags:async()=>({latest:version}),fetchTarball:async()=>bytes,sleep:async()=>{}});
+  assert.equal(result.state,'REGISTRY_IDENTITY_VERIFIED');
+  assert.equal(publishes,1);assert.equal(views,4);
+  assert.match(await readFile(path.join(recordPath,'claim.json'),'utf8'),/0\.15\.42/);
+}));
+
+test('accepted publication timing out remains processing and is never resubmitted',()=>fixture(async recordPath=>{
+  let publishes=0;
+  const options={recordPath,version,manifestSha256,localBytes:bytes,timeoutMs:0,pollMs:1,
+    publish:async()=>{publishes++;return {accepted:true};},lookup:async()=>null,
+    tags:async()=>({latest:version}),fetchTarball:async()=>bytes,sleep:async()=>{}};
+  const first=await reconcileNpmPublication(options);
+  const second=await reconcileNpmPublication(options);
+  assert.equal(first.state,'REGISTRY_PROCESSING');assert.equal(second.state,'REGISTRY_PROCESSING');assert.equal(publishes,1);
+}));
+
+test('transport loss after dispatch remains unknown; later exact registry bytes reconcile without republish',()=>fixture(async recordPath=>{
+  let publishes=0,visible=false;
+  const options={recordPath,version,manifestSha256,localBytes:bytes,timeoutMs:0,pollMs:1,
+    publish:async()=>{publishes++;throw Object.assign(new Error('connection lost'),{code:'ECONNRESET'});},
+    lookup:async()=>visible?published:null,tags:async()=>({latest:version}),fetchTarball:async()=>bytes,sleep:async()=>{}};
+  assert.equal((await reconcileNpmPublication(options)).state,'OUTCOME_UNKNOWN');
+  visible=true;
+  assert.equal((await reconcileNpmPublication(options)).state,'REGISTRY_IDENTITY_VERIFIED');
+  assert.equal(publishes,1);
+}));
+
+test('same immutable version with different bytes hard fails, not republished',()=>fixture(async recordPath=>{
+  let publishes=0;
+  const result=await reconcileNpmPublication({recordPath,version,manifestSha256,localBytes:Buffer.from('different'),timeoutMs:0,pollMs:1,
+    publish:async()=>{publishes++;return {accepted:true};},lookup:async()=>published,
+    tags:async()=>({latest:version}),fetchTarball:async()=>bytes,sleep:async()=>{}});
+  assert.equal(result.state,'REGISTRY_REJECTED');assert.equal(publishes,0);
+}));
+
+test('pre-submission authentication rejection is terminal and does not retry on resume',()=>fixture(async recordPath=>{
+  let publishes=0;
+  const options={recordPath,version,manifestSha256,localBytes:bytes,timeoutMs:0,pollMs:1,
+    publish:async()=>{publishes++;throw Object.assign(new Error('authentication required'),{code:'E401'});},
+    lookup:async()=>null,tags:async()=>({latest:version}),fetchTarball:async()=>bytes,sleep:async()=>{}};
+  assert.equal((await reconcileNpmPublication(options)).state,'AUTH_REQUIRED');
+  assert.equal((await reconcileNpmPublication(options)).state,'AUTH_REQUIRED');
+  assert.equal(publishes,1);
+}));
+
+test('registry tag mismatch rejects exact bytes without another publish',()=>fixture(async recordPath=>{
+  let publishes=0;
+  const result=await reconcileNpmPublication({recordPath,version,manifestSha256,localBytes:bytes,timeoutMs:0,pollMs:1,
+    publish:async()=>{publishes++;return {accepted:true};},lookup:async()=>published,
+    tags:async()=>({latest:'0.15.41'}),fetchTarball:async()=>bytes,sleep:async()=>{}});
+  assert.equal(result.state,'REGISTRY_REJECTED');assert.equal(publishes,0);
+}));
+
+test('concurrent same-version attempts have one publication dispatch',()=>fixture(async recordPath=>{
+  let publishes=0;
+  const options={recordPath,version,manifestSha256,localBytes:bytes,timeoutMs:0,pollMs:1,
+    publish:async()=>{publishes++;await new Promise(resolve=>setTimeout(resolve,5));return {accepted:true};},
+    lookup:async()=>null,tags:async()=>({latest:version}),fetchTarball:async()=>bytes,sleep:async()=>{}};
+  const outcomes=await Promise.all([reconcileNpmPublication(options),reconcileNpmPublication(options)]);
+  assert.equal(publishes,1);
+  assert.ok(outcomes.every(item=>['REGISTRY_PROCESSING','OUTCOME_UNKNOWN'].includes(item.state)));
+}));
+
+test('published metadata with temporarily unavailable tarball is processing, never a reason to submit again',()=>fixture(async recordPath=>{
+  let publishes=0;
+  const result=await reconcileNpmPublication({recordPath,version,manifestSha256,localBytes:bytes,timeoutMs:0,pollMs:1,
+    publish:async()=>{publishes++;return {accepted:true};},lookup:async()=>published,
+    tags:async()=>({latest:version}),fetchTarball:async()=>{throw Object.assign(new Error('not found'),{status:404});},sleep:async()=>{}});
+  assert.equal(result.state,'REGISTRY_PROCESSING');assert.equal(publishes,0);
+}));
+
+test('candidate manifest drift after a submission claim cannot reuse the published tarball',()=>fixture(async recordPath=>{
+  let publishes=0;
+  const options={recordPath,version,manifestSha256,localBytes:bytes,timeoutMs:0,pollMs:1,
+    publish:async()=>{publishes++;return {accepted:true};},lookup:async()=>null,
+    tags:async()=>({latest:version}),fetchTarball:async()=>bytes,sleep:async()=>{}};
+  assert.equal((await reconcileNpmPublication(options)).state,'REGISTRY_PROCESSING');
+  assert.equal((await reconcileNpmPublication({...options,manifestSha256:'c'.repeat(64),lookup:async()=>published})).state,'REGISTRY_REJECTED');
+  assert.equal(publishes,1);
+}));
+
+test('incomplete concurrent claim fails closed without dispatching publication',()=>fixture(async recordPath=>{
+  await mkdir(recordPath,{recursive:true});
+  await writeFile(path.join(recordPath,'claim.json'),'{"schema":');
+  let publishes=0;
+  const result=await reconcileNpmPublication({recordPath,version,manifestSha256,localBytes:bytes,timeoutMs:0,pollMs:1,
+    publish:async()=>{publishes++;},lookup:async()=>null,tags:async()=>({latest:version}),fetchTarball:async()=>bytes,sleep:async()=>{}});
+  assert.equal(result.state,'OUTCOME_UNKNOWN');
+  assert.equal(publishes,0);
+}));

package/test/r65-parent-source-verifier.test.mjs

@@ -0,0 +1,63 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,writeFile,rm,readFile} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {spawnSync} from 'node:child_process';
+import {fileURLToPath} from 'node:url';
+
+const here=path.dirname(fileURLToPath(import.meta.url));
+const repo=path.resolve(here,'..');
+const verifier=path.join(repo,'scripts','verify-r65-parent-source.mjs');
+const sha=b=>createHash('sha256').update(b).digest('hex');
+
+async function fixture(){
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-parent-'));
+  await mkdir(path.join(root,'sub'),{recursive:true});
+  await writeFile(path.join(root,'a.txt'),'alpha\n');
+  await writeFile(path.join(root,'sub','b.txt'),'beta\n');
+  const manifest=[
+    `${sha(Buffer.from('alpha\n'))}  a.txt`,
+    `${sha(Buffer.from('beta\n'))}  sub/b.txt`,
+    ''
+  ].join('\n');
+  await writeFile(path.join(root,'MANIFEST.SHA256'),manifest);
+  await writeFile(path.join(root,'deadbyte-mcp-0.15.41.tgz'),'unlisted package artifact');
+  return {root,manifestSha:sha(Buffer.from(manifest))};
+}
+function run(root,manifestSha){
+  return spawnSync(process.execPath,[verifier,'--root',root,'--expected-manifest-sha256',manifestSha],{
+    cwd:repo,encoding:'utf8',windowsHide:true
+  });
+}
+
+test('R65 parent verifier accepts exact declared manifest entries while ignoring unlisted package artifacts',async()=>{
+  const f=await fixture();
+  try{
+    const result=run(f.root,f.manifestSha);
+    assert.equal(result.status,0,result.stderr||result.stdout);
+    assert.match(result.stdout,/R65_PARENT_SOURCE_VERIFY_OK files=2/);
+  }finally{await rm(f.root,{recursive:true,force:true});}
+});
+
+test('R65 parent verifier fails on missing or changed declared bytes and manifest identity drift',async()=>{
+  const f=await fixture();
+  try{
+    await rm(path.join(f.root,'sub','b.txt'));
+    let result=run(f.root,f.manifestSha);
+    assert.notEqual(result.status,0);
+    assert.match(result.stderr,/listed file missing|ENOENT/i);
+
+    await mkdir(path.join(f.root,'sub'),{recursive:true});
+    await writeFile(path.join(f.root,'sub','b.txt'),'changed\n');
+    result=run(f.root,f.manifestSha);
+    assert.notEqual(result.status,0);
+    assert.match(result.stderr,/hash mismatch/i);
+
+    await writeFile(path.join(f.root,'sub','b.txt'),'beta\n');
+    result=run(f.root,'0'.repeat(64));
+    assert.notEqual(result.status,0);
+    assert.match(result.stderr,/manifest SHA-256 mismatch/i);
+  }finally{await rm(f.root,{recursive:true,force:true});}
+});

package/test/r65-release-contract.test.mjs

@@ -0,0 +1,74 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+
+const read=rel=>readFile(new URL('../'+rel,import.meta.url),'utf8');
+const json=async rel=>JSON.parse((await read(rel)).replace(/^\uFEFF/,''));
+const PARENT={
+  version:'0.15.41',
+  release_id:'v0.15.41-63a78ad159ad3003',
+  manifest_sha256:'63a78ad159ad3003db3fefafcd468bef22599c829a867f4f10a46c7a20748b3e',
+  generation_manifest_sha256:'19ae2efcdcde9f80c474f0e55851d4ada51c22813d3e05af03b11acb28c3fca5'
+};
+
+test('R65 release identity binds exact production R64 parent and durable authority-continuity train',async()=>{
+  const [pkg,lock,bridge,release,provenance,matrix,sbom,version,gate,gaps,design]=await Promise.all([
+    json('package.json'),json('package-lock.json'),json('bridge/package.json'),json('RELEASE.json'),
+    json('PROVENANCE.json'),json('TEST-MATRIX.json'),json('SBOM.cdx.json'),read('src/version.mjs'),
+    read('scripts/gate-windows-r65-prepublish.ps1'),json('docs/R65-REFERENCE-GAP-MATRIX.json'),
+    json('docs/R65-AUTHORITY-CONTINUITY-DESIGN.json')
+  ]);
+  assert.equal(pkg.version,'0.15.42');
+  assert.equal(lock.version,pkg.version);
+  assert.equal(lock.packages[''].version,pkg.version);
+  assert.equal(bridge.version,pkg.version);
+  assert.match(version,/DEADBYTE_VERSION = '0\.15\.42'/);
+  assert.equal(pkg.scripts['gate:windows'],'powershell -NoProfile -ExecutionPolicy Bypass -File scripts/gate-windows-r65-prepublish.ps1');
+  assert.equal(pkg.scripts['r65:focused:test'],'node scripts/r65-focused.mjs');
+
+  assert.equal(release.version,pkg.version);
+  assert.equal(release.train,'R65');
+  assert.equal(release.parent.version,PARENT.version);
+  assert.equal(release.parent.release_id,PARENT.release_id);
+  assert.equal(release.parent.manifest_sha256,PARENT.manifest_sha256);
+  assert.equal(release.parent.generation_manifest_sha256,PARENT.generation_manifest_sha256);
+  assert.deepEqual(release.runtime_predecessor,{
+    release_id:PARENT.release_id,
+    manifest_sha256:PARENT.manifest_sha256,
+    generation_manifest_sha256:PARENT.generation_manifest_sha256
+  });
+  assert.equal(release.source_predecessor.version,PARENT.version);
+  assert.equal(release.source_predecessor.manifest_file_sha256,PARENT.manifest_sha256);
+  assert.equal(release.source_predecessor.release_status,'PRODUCTION_RELEASED');
+  assert.equal(release.r65_release_control_hardening.new_public_tools,0);
+  assert.equal(release.r65_release_control_hardening.new_authority_scopes,0);
+  assert.equal(release.r65_release_control_hardening.legacy_r64_auto_restore,false);
+  assert.equal(release.r65_release_control_hardening.epoch_native_restore_requires_continuity_proof,true);
+  assert.equal(release.r65_release_control_hardening.explicit_revoke_wins,true);
+  assert.equal(release.r65_release_control_hardening.revoked_nonce_resurrection,false);
+  assert.equal(release.r65_release_control_hardening.stable_final_claim,false);
+
+  assert.equal(provenance.version,pkg.version);
+  assert.equal(provenance.parent_release_id,PARENT.release_id);
+  assert.equal(provenance.parent_manifest_sha256,PARENT.manifest_sha256);
+  assert.equal(provenance.parent_generation_manifest_sha256,PARENT.generation_manifest_sha256);
+  assert.equal(provenance.source_predecessor_version,PARENT.version);
+  assert.equal(provenance.source_predecessor_manifest_file_sha256,PARENT.manifest_sha256);
+  assert.equal(provenance.r65.production_mutations,0);
+  assert.equal(provenance.r65.npm_publications,0);
+
+  assert.equal(matrix.version,pkg.version);
+  assert.equal(matrix.train,'R65');
+  assert.ok(matrix.required.some(row=>row.id==='r65-focused'));
+  assert.ok(matrix.required.some(row=>row.id==='r65-full-regression'));
+  assert.equal(sbom.metadata.component.version,pkg.version);
+  assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r65:0.15.42');
+  assert.equal(gaps.decisions.length,7);
+  assert.equal(design.selected_method.r64_predecessor_continuity.includes('REAUTH_REQUIRED'),true);
+
+  assert.match(gate,/v0\.15\.41-63a78ad159ad3003/);
+  assert.match(gate,/63a78ad159ad3003db3fefafcd468bef22599c829a867f4f10a46c7a20748b3e/);
+  assert.match(gate,/19ae2efcdcde9f80c474f0e55851d4ada51c22813d3e05af03b11acb28c3fca5/);
+  assert.match(gate,/r65:focused:test/);
+  assert.doesNotMatch(gate,/npm\.cmd publish|--publish-only/);
+});

package/test/r65-transaction-precondition.test.mjs

@@ -0,0 +1,36 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,rm,writeFile,unlink} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import {performSlotUpdate,verifySlotUpdateEnvelope} from '../src/runtime-update.mjs';
+import {inspectDoctorTransactions} from '../src/doctor-transactions-r58.mjs';
+
+test('deterministic candidate precondition rejection is a signed terminal phase, not unresolved residue',async()=>{
+  const root=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-precondition-'));
+  try{
+    const state=path.join(root,'state'),trust=path.join(state,'trust');
+    await mkdir(trust,{recursive:true});
+    const {privateKey,publicKey}=generateKeyPairSync('ed25519');
+    await writeFile(path.join(trust,'ed25519-private.pem'),privateKey.export({type:'pkcs8',format:'pem'}));
+    await writeFile(path.join(trust,'ed25519-public.pem'),publicKey.export({type:'spki',format:'pem'}));
+    const stage=path.join(root,'missing-candidate');
+    let failure;
+    try{await performSlotUpdate({stage,developmentRoot:path.join(root,'dev'),expectedVersion:'0.15.42',expectedManifest:'a'.repeat(64),stateRoot:state});}
+    catch(error){failure=error;}
+    assert.ok(failure?.statePath,'expected isolated precondition failure evidence');
+    const journal=JSON.parse(await readFile(failure.statePath,'utf8'));
+    assert.equal(journal.phase,'precondition_rejected');
+    const receipt=JSON.parse(await readFile(failure.failureReceiptPath,'utf8'));
+    assert.equal(receipt.body.result,'PRECONDITION_REJECTED');
+    assert.equal(verifySlotUpdateEnvelope(receipt,publicKey),true);
+    const doctor=await inspectDoctorTransactions(state);
+    assert.equal(doctor.status,'PASS');
+    assert.equal(doctor.findings.at(-1).evidence.unresolved_transactions,0);
+    await unlink(failure.failureReceiptPath);
+    const missing=await inspectDoctorTransactions(state);
+    assert.equal(missing.status,'FAIL');
+    assert.ok(missing.findings.some(item=>item.evidence?.check==='missing_failure_receipt'));
+  }finally{await rm(root,{recursive:true,force:true});}
+});