deadbyte-mcp 0.15.39 → 0.15.42

package/scripts/deploy-r48.mjs

@@ -1,17 +1,91 @@
-import { createHash } from 'node:crypto';
-import { readFile, access } from 'node:fs/promises';
+import { createHash,randomBytes } from 'node:crypto';
+import { readFile, access,open,mkdir,unlink,lstat } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { runSlotUpdateCli } from '../src/runtime-update.mjs';
+import { runSlotUpdateCli,windowsPowerShellEnvironment,loadPowerShellDataFile } from '../src/runtime-update.mjs';
 import { parseActivePointer } from '../src/release-slot.mjs';
+import {parseAuthorityObservation} from '../src/remote-authority.mjs';
+import {classifyActivationPreflight,classifyAuthorityContinuity,orchestrateActivation} from '../src/activation-preflight-r65.mjs';
+import {createEpochNativeContinuityEngine} from '../src/activation-continuity-engine-r65.mjs';
+import {createActivationClaimManager} from '../src/activation-lock-r65.mjs';
 
 const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..');
 const state=path.resolve(process.env.DEADBYTE_STATE_ROOT||path.join(os.homedir(),'.deadbyte-mcp'));
 const sha=async f=>createHash('sha256').update(await readFile(f)).digest('hex');
 const sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms));
 
+async function writeExclusive(file,value){
+  const handle=await open(file,'wx',0o600);
+  try{await handle.writeFile(JSON.stringify(value)+'\n');await handle.sync();}
+  finally{await handle.close();}
+}
+
+const activationClaimManager=createActivationClaimManager({stateRoot:state});
+let activationClaimOperationId=null;
+
+async function claimActivation(subjectSha256){
+  const claim=await activationClaimManager.claim(subjectSha256);
+  activationClaimOperationId=claim.operation_id;
+  return claim.release;
+}
+
+async function activePolicyPaths(){
+  const active=parseActivePointer(await readFile(path.join(state,'active-release.json'),'utf8'));
+  const config=await loadPowerShellDataFile(active.config_path);
+  const fields={process:'ProcessPolicyFile',coding:'CodingPolicyFile',autonomous:'AutonomousPolicyFile',desktop:'DesktopPolicyFile',host:'HostPolicyFile'};
+  return Object.fromEntries(Object.entries(fields).map(([plane,key])=>{
+    const file=config[key];
+    return [plane,typeof file==='string'&&path.isAbsolute(file)?path.resolve(file):null];
+  }));
+}
+
+async function observeController(){
+  const launcher=path.join(state,'bin','DEADBYTE-MCP.ps1');
+  const powershell=path.join(process.env.SystemRoot||'C:\\Windows','System32','WindowsPowerShell','v1.0','powershell.exe');
+  const run=spawnSync(powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',launcher,'status','-Json'],{
+    cwd:root,env:windowsPowerShellEnvironment(),encoding:'utf8',timeout:20000,stdio:['ignore','pipe','pipe'],windowsHide:true});
+  if(run.error||run.status!==0)throw new Error(`activation preflight controller observation failed exit=${run.status} code=${run.error?.code??'none'}`);
+  const observed=parseAuthorityObservation(run.stdout);
+  const active=parseActivePointer(await readFile(path.join(state,'active-release.json'),'utf8'));
+  const policyPaths=await activePolicyPaths(),policySha256={};
+  for(const [plane,file] of Object.entries(policyPaths)){
+    if(!observed.authority[plane].configured){policySha256[plane]=null;continue;}
+    if(typeof file!=='string'||!path.isAbsolute(file))throw new Error(`activation ${plane} policy path missing`);
+    const info=await lstat(file);
+    if(!info.isFile()||info.isSymbolicLink())throw new Error(`activation ${plane} policy must be a regular file`);
+    policySha256[plane]=await sha(file);
+  }
+  return {...observed,policy_sha256:policySha256,policy_paths:policyPaths,active_release_id:active.release_id,active_manifest_sha256:active.manifest_sha256,
+    active_generation_manifest_sha256:active.generation_manifest_sha256};
+}
+
+function controllerCommand(command){
+  if(!/^(?:arm|disarm)(?:process|coding|autonomous|desktop|host)$|^supervisorstop$|^stop$/.test(command))throw new Error('activation controller command not declared');
+  const launcher=path.join(state,'bin','DEADBYTE-MCP.ps1');
+  const powershell=path.join(process.env.SystemRoot||'C:\\Windows','System32','WindowsPowerShell','v1.0','powershell.exe');
+  const run=spawnSync(powershell,['-NoLogo','-NoProfile','-ExecutionPolicy','Bypass','-File',launcher,command],{
+    cwd:root,env:windowsPowerShellEnvironment(),encoding:'utf8',timeout:30000,stdio:['ignore','pipe','pipe'],windowsHide:true});
+  if(run.error||run.status!==0)throw new Error(`activation controller ${command} failed exit=${run.status} code=${run.error?.code??'none'}`);
+}
+
+async function activationPreflight(manifest,pkg,pointer){
+  const release=JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8'));
+  const observed=await observeController();
+  const result=classifyActivationPreflight({pointer,expectedParent:release.parent,
+    candidate:{version:pkg.version,manifest_sha256:manifest},
+    expectedCandidate:{version:release.version,manifest_sha256:manifest},observation:observed});
+  const continuity=classifyAuthorityContinuity(observed);
+  if(continuity.state==='UNVERIFIED')return {...result,state:'AUTHORITY_CONTINUITY_UNVERIFIED',safe_to_activate:false,
+    reason:continuity.reason??'authority continuity observation unverified',authority_continuity:'UNVERIFIED',reauth_planes:continuity.reauth_planes??[]};
+  if(continuity.state==='EPOCH_NATIVE')return {...result,authority_continuity:'EPOCH_NATIVE',
+    epoch_planes:continuity.epoch_planes??[],reauth_planes:[]};
+  if(continuity.state==='LEGACY_REAUTH_REQUIRED'||continuity.state==='MIXED_REAUTH_REQUIRED')
+    return {...result,authority_continuity:'REAUTH_REQUIRED',reauth_planes:continuity.reauth_planes??continuity.armed_planes??[]};
+  return {...result,authority_continuity:'NOT_APPLICABLE',reauth_planes:[]};
+}
+
 async function waitForActivation({handoffPath,expectedVersion,expectedManifest,timeoutMs=900000,pollMs=1000}){
   const evidenceDir=path.dirname(path.resolve(handoffPath));
   const statePath=path.join(evidenceDir,'state.json');
@@ -62,6 +136,15 @@ const bridgeRoot=path.join(root,'bridge');
 const bridgeScript=path.join(bridgeRoot,'src','bridge.mjs');
 const pkg=JSON.parse(await readFile(path.join(root,'package.json'),'utf8'));
 const expectedVersion=pkg.version;
+const release=JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8'));
+const preflight=await activationPreflight(manifest,pkg,pointer);
+if(process.argv.includes('--preflight')){
+  console.log(JSON.stringify(preflight));
+  process.exit(0);
+}
+if(process.argv.length>2)throw new Error('deploy accepts only --preflight');
+if(!['ONLINE_READY','ONLINE_HOST_ARMED','PARKED_DIRTY','OFFLINE_CLEAN'].includes(preflight.state))
+  throw new Error(`activation preflight rejected: ${preflight.state} subject=${preflight.subject_sha256??'<incomplete>'}`);
 const args=[
   '--stage',root,'--development-root',root,'--expected-version',expectedVersion,'--expected-manifest',manifest,
   '--process-policy',path.join(root,'controller','deadbyte-process-policy.json'),'--process-policy-sha256',await sha(path.join(root,'controller','deadbyte-process-policy.json')),
@@ -70,9 +153,40 @@ const args=[
   '--bridge-root',bridgeRoot,'--bridge-script-sha256',await sha(bridgeScript),
   '--enable-machine-fs','--enable-observation','--enable-desktop','--enable-autonomous-supervisor','--recover-offline-predecessor'
 ];
-const result=await runSlotUpdateCli(args,{stateRoot:state});
-if(!result.handed_off) throw new Error('release activation unexpectedly completed inline; refusing to skip post-activation verification');
-const verification=await waitForActivation({handoffPath:result.handoff_path,expectedVersion,expectedManifest:manifest});
+let result=null,verification=null,activationOutcomePath=null;
+let continuityEngine=null,continuityUpdateId=null;
+
+async function recordActivationOutcome(outcome){
+  if(typeof activationClaimOperationId!=='string')throw new Error('activation claim operation id unavailable');
+  const outcomeFile=path.join(state,'evidence','updates',`r65-activation-outcome-${Date.now()}-${randomBytes(8).toString('hex')}.json`);
+  await writeExclusive(outcomeFile,{schema:'deadbyte.r65-activation-outcome.v1',claim_operation_id:activationClaimOperationId,
+    candidate_version:expectedVersion,candidate_manifest_sha256:manifest,
+    predecessor_release_id:pointer.release_id,preflight_subject_sha256:preflight.subject_sha256,outcome,
+    update_id:result?.update_id??null,continuity_update_id:continuityUpdateId,
+    state_path:result?.state_path??null,observed_at_utc:new Date().toISOString()});
+  activationOutcomePath=outcomeFile;
+}
+
+if(preflight.authority_continuity==='EPOCH_NATIVE'){
+  const predecessorObservation=await observeController();
+  continuityUpdateId=`r65-${randomBytes(16).toString('hex')}`;
+  continuityEngine=createEpochNativeContinuityEngine({stateRoot:state,predecessorPolicyPaths:predecessorObservation.policy_paths,
+    successorPolicyPaths:async()=>activePolicyPaths(),updateId:continuityUpdateId});
+}
+const outcome=await orchestrateActivation({pointer,expectedParent:release.parent,
+  candidate:{version:expectedVersion,manifest_sha256:manifest},expectedCandidate:{version:release.version,manifest_sha256:manifest},
+  observe:async()=>observeController(),command:async command=>controllerCommand(command),claim:claimActivation,continuityEngine,
+  recordOutcome:recordActivationOutcome,
+  activate:async()=>{
+    result=await runSlotUpdateCli(args,{stateRoot:state});
+    if(!result.handed_off)throw new Error('release activation unexpectedly completed inline');
+    verification=await waitForActivation({handoffPath:result.handoff_path,expectedVersion,expectedManifest:manifest});
+    return {verified:true,release_id:verification.release_id};
+  }});
+if(outcome.state!=='ACTIVATED'){
+  console.log(JSON.stringify({...outcome,update_id:result?.update_id??null,state_path:result?.state_path??null,outcome_path:activationOutcomePath}));
+  process.exitCode=2;
+}else{
 console.log(JSON.stringify({
   status:'activated',
   manifest_sha256:manifest,
@@ -81,5 +195,7 @@ console.log(JSON.stringify({
   supervisor_pid:result.supervisor_pid,
   release_id:verification.release_id,
   receipt_path:verification.receiptPath,
-  state_path:verification.statePath
+  state_path:verification.statePath,
+  outcome_path:activationOutcomePath
 },null,2));
+}

package/scripts/gate-windows-r63-prepublish.ps1

@@ -0,0 +1,45 @@
+param(
+  [ValidateSet('all','preflight','focused','full','manifest','doctor')]
+  [string]$Stage='all'
+)
+
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version 3.0
+$root=Split-Path $PSScriptRoot -Parent
+Set-Location -LiteralPath $root
+
+function Invoke-Npm([string]$Name,[string[]]$NpmArgs){
+  Write-Host "==== $Name ===="
+  & npm.cmd @NpmArgs
+  if($LASTEXITCODE -ne 0){ throw "R63 prepublish gate failed at $Name exit=$LASTEXITCODE" }
+}
+
+$stateRoot=if(-not [string]::IsNullOrWhiteSpace($env:DEADBYTE_STATE_ROOT)){
+  [IO.Path]::GetFullPath($env:DEADBYTE_STATE_ROOT)
+}else{ Join-Path $env:USERPROFILE '.deadbyte-mcp' }
+$pointer=Join-Path $stateRoot 'active-release.json'
+if(-not (Test-Path -LiteralPath $pointer -PathType Leaf)){ throw "R63 predecessor pointer missing: $pointer" }
+$active=Get-Content -LiteralPath $pointer -Raw | ConvertFrom-Json
+if($active.release_id -ne 'v0.15.39-3cda3b1c65b7b7c5'){ throw "R63 predecessor release mismatch: $($active.release_id)" }
+if($active.manifest_sha256 -ne '3cda3b1c65b7b7c561c5a8617156ab87d69cf162f447f3e99a4cb4a76471b3de'){ throw 'R63 predecessor manifest mismatch' }
+if($active.generation_manifest_sha256 -ne 'f47cb96083679e764725df1bde6eda53169a39f55772c173ab22f89a1dfaa7ab'){ throw 'R63 predecessor generation mismatch' }
+if($Stage -eq 'preflight'){Write-Host '==== R63 WINDOWS GATE: PASS preflight ====';return}
+
+if($Stage -eq 'all' -or $Stage -eq 'focused'){
+  Invoke-Npm 'r63-focused' @('run','r63:focused:test')
+  if($Stage -eq 'focused'){Write-Host '==== R63 WINDOWS GATE: PASS focused ====';return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'full'){
+  Invoke-Npm 'full-regression' @('test')
+  if($Stage -eq 'full'){Write-Host '==== R63 WINDOWS GATE: PASS full ====';return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'manifest'){
+  Invoke-Npm 'manifest-write' @('run','manifest:write')
+  Invoke-Npm 'manifest-verify' @('run','manifest:verify')
+  if($Stage -eq 'manifest'){Write-Host '==== R63 WINDOWS GATE: PASS manifest ====';return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'doctor'){
+  Invoke-Npm 'doctor' @('run','doctor')
+  if($Stage -eq 'doctor'){Write-Host '==== R63 WINDOWS GATE: PASS doctor ====';return}
+}
+Write-Host '==== R63 PREPUBLISH WINDOWS GATE: PASS ===='

package/scripts/gate-windows-r64-prepublish.ps1

@@ -0,0 +1,68 @@
+param(
+  [ValidateSet('all','preflight','focused','full','manifest','doctor')]
+  [string]$Stage='all'
+)
+
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version 3.0
+$root=Split-Path $PSScriptRoot -Parent
+Set-Location -LiteralPath $root
+
+function Invoke-Npm([string]$Name,[string[]]$NpmArgs){
+  Write-Host "==== $Name ===="
+  & npm.cmd @NpmArgs
+  if($LASTEXITCODE -ne 0){ throw "R64 prepublish gate failed at $Name exit=$LASTEXITCODE" }
+}
+
+function Get-FileSha256([string]$File){
+  $hasher=[Security.Cryptography.SHA256]::Create()
+  try{
+    $bytes=[IO.File]::ReadAllBytes($File)
+    return (($hasher.ComputeHash($bytes) | ForEach-Object { $_.ToString('x2') }) -join '')
+  }finally{ $hasher.Dispose() }
+}
+
+$sourceRoot='D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.40-r63'
+$sourceManifest='d6f75feada9ad0ae2c248b3a833ac9cf0e04150d2430ddaa70b3dfb64a0b0a86'
+if(-not (Test-Path -LiteralPath $sourceRoot -PathType Container)){ throw 'R64 source predecessor missing' }
+$observedSourceManifest=Get-FileSha256 (Join-Path $sourceRoot 'MANIFEST.SHA256')
+if($observedSourceManifest -ne $sourceManifest){ throw 'R64 source predecessor manifest identity mismatch' }
+Push-Location -LiteralPath $sourceRoot
+try{
+  & npm.cmd run manifest:verify
+  if($LASTEXITCODE -ne 0){ throw 'R64 source predecessor manifest verification failed' }
+}finally{ Pop-Location }
+
+$stateRoot=Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$pointer=Join-Path $stateRoot 'active-release.json'
+if(-not (Test-Path -LiteralPath $pointer -PathType Leaf)){ throw "R64 runtime predecessor pointer missing: $pointer" }
+$active=Get-Content -LiteralPath $pointer -Raw | ConvertFrom-Json
+if($active.release_id -ne 'v0.15.39-3cda3b1c65b7b7c5'){ throw "R64 runtime predecessor release mismatch: $($active.release_id)" }
+if($active.manifest_sha256 -ne '3cda3b1c65b7b7c561c5a8617156ab87d69cf162f447f3e99a4cb4a76471b3de'){ throw 'R64 runtime predecessor manifest mismatch' }
+if($active.generation_manifest_sha256 -ne 'f47cb96083679e764725df1bde6eda53169a39f55772c173ab22f89a1dfaa7ab'){ throw 'R64 runtime predecessor generation mismatch' }
+if($Stage -eq 'preflight'){Write-Host '==== R64 WINDOWS GATE: PASS preflight ====';return}
+
+if($Stage -eq 'all' -or $Stage -eq 'focused'){
+  Invoke-Npm 'r64-focused' @('run','r64:focused:test')
+  if($Stage -eq 'focused'){Write-Host '==== R64 WINDOWS GATE: PASS focused ====';return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'full'){
+  Invoke-Npm 'full-regression' @('test')
+  if($Stage -eq 'full'){Write-Host '==== R64 WINDOWS GATE: PASS full ====';return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'manifest'){
+  Invoke-Npm 'manifest-write' @('run','manifest:write')
+  Invoke-Npm 'manifest-verify' @('run','manifest:verify')
+  if($Stage -eq 'manifest'){Write-Host '==== R64 WINDOWS GATE: PASS manifest ====';return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'doctor'){
+  $doctorRoot='D:\Projects\deadbyte-mcp\testing\0.15.41-r64\doctor-isolated-empty'
+  if(Test-Path -LiteralPath (Join-Path $doctorRoot 'active-release.json')){ throw 'R64 isolated doctor root unexpectedly contains a release pointer' }
+  $priorStateRoot=$env:DEADBYTE_STATE_ROOT
+  try{
+    $env:DEADBYTE_STATE_ROOT=$doctorRoot
+    Invoke-Npm 'doctor-isolated-empty-state' @('run','doctor')
+  }finally{ $env:DEADBYTE_STATE_ROOT=$priorStateRoot }
+  if($Stage -eq 'doctor'){Write-Host '==== R64 WINDOWS GATE: PASS doctor ====';return}
+}
+Write-Host '==== R64 PREPUBLISH WINDOWS GATE: PASS ===='

package/scripts/gate-windows-r65-prepublish.ps1

@@ -0,0 +1,65 @@
+param(
+  [ValidateSet('all','preflight','focused','full','manifest','doctor')]
+  [string]$Stage='all'
+)
+
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version 3.0
+$root=Split-Path $PSScriptRoot -Parent
+Set-Location -LiteralPath $root
+
+function Invoke-Npm([string]$Name,[string[]]$NpmArgs){
+  Write-Host "==== $Name ===="
+  & npm.cmd @NpmArgs
+  if($LASTEXITCODE -ne 0){ throw "R65 prepublish gate failed at $Name exit=$LASTEXITCODE" }
+}
+
+function Get-FileSha256([string]$File){
+  $hasher=[Security.Cryptography.SHA256]::Create()
+  try{
+    $bytes=[IO.File]::ReadAllBytes($File)
+    return (($hasher.ComputeHash($bytes) | ForEach-Object { $_.ToString('x2') }) -join '')
+  }finally{ $hasher.Dispose() }
+}
+
+$sourceRoot='D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.41-r64'
+$sourceManifest='63a78ad159ad3003db3fefafcd468bef22599c829a867f4f10a46c7a20748b3e'
+if(-not (Test-Path -LiteralPath $sourceRoot -PathType Container)){ throw 'R65 source predecessor missing' }
+$observedSourceManifest=Get-FileSha256 (Join-Path $sourceRoot 'MANIFEST.SHA256')
+if($observedSourceManifest -ne $sourceManifest){ throw 'R65 source predecessor manifest identity mismatch' }
+& node (Join-Path $root 'scripts\\verify-r65-parent-source.mjs') --root $sourceRoot --expected-manifest-sha256 $sourceManifest
+if($LASTEXITCODE -ne 0){ throw 'R65 source predecessor declared-manifest verification failed' }
+
+$stateRoot=Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$pointer=Join-Path $stateRoot 'active-release.json'
+if(-not (Test-Path -LiteralPath $pointer -PathType Leaf)){ throw "R65 runtime predecessor pointer missing: $pointer" }
+$active=Get-Content -LiteralPath $pointer -Raw | ConvertFrom-Json
+if($active.release_id -ne 'v0.15.41-63a78ad159ad3003'){ throw "R65 runtime predecessor release mismatch: $($active.release_id)" }
+if($active.manifest_sha256 -ne '63a78ad159ad3003db3fefafcd468bef22599c829a867f4f10a46c7a20748b3e'){ throw 'R65 runtime predecessor manifest mismatch' }
+if($active.generation_manifest_sha256 -ne '19ae2efcdcde9f80c474f0e55851d4ada51c22813d3e05af03b11acb28c3fca5'){ throw 'R65 runtime predecessor generation mismatch' }
+if($Stage -eq 'preflight'){Write-Host '==== R65 WINDOWS GATE: PASS preflight ====';return}
+
+if($Stage -eq 'all' -or $Stage -eq 'focused'){
+  Invoke-Npm 'r65-focused' @('run','r65:focused:test')
+  if($Stage -eq 'focused'){Write-Host '==== R65 WINDOWS GATE: PASS focused ====';return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'full'){
+  Invoke-Npm 'full-regression' @('test')
+  if($Stage -eq 'full'){Write-Host '==== R65 WINDOWS GATE: PASS full ====';return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'manifest'){
+  Invoke-Npm 'manifest-write' @('run','manifest:write')
+  Invoke-Npm 'manifest-verify' @('run','manifest:verify')
+  if($Stage -eq 'manifest'){Write-Host '==== R65 WINDOWS GATE: PASS manifest ====';return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'doctor'){
+  $doctorRoot='D:\Projects\deadbyte-mcp\testing\0.15.42-r65\doctor-isolated-empty'
+  if(Test-Path -LiteralPath (Join-Path $doctorRoot 'active-release.json')){ throw 'R65 isolated doctor root unexpectedly contains a release pointer' }
+  $priorStateRoot=$env:DEADBYTE_STATE_ROOT
+  try{
+    $env:DEADBYTE_STATE_ROOT=$doctorRoot
+    Invoke-Npm 'doctor-isolated-empty-state' @('run','doctor')
+  }finally{ $env:DEADBYTE_STATE_ROOT=$priorStateRoot }
+  if($Stage -eq 'doctor'){Write-Host '==== R65 WINDOWS GATE: PASS doctor ====';return}
+}
+Write-Host '==== R65 PREPUBLISH WINDOWS GATE: PASS ===='

package/scripts/npm-publication-r65.mjs

@@ -0,0 +1,139 @@
+import {createHash, randomBytes} from 'node:crypto';
+import {mkdir, open, readFile, readdir, link, unlink} from 'node:fs/promises';
+import path from 'node:path';
+import {performance} from 'node:perf_hooks';
+import {verifyPublishedTarballIdentity} from './npm-artifact-identity-r61.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const digest=bytes=>createHash('sha256').update(bytes).digest('hex');
+const pause=ms=>new Promise(resolve=>setTimeout(resolve,ms));
+
+async function writeExclusive(file,value){
+  const handle=await open(file,'wx',0o600);
+  try{await handle.writeFile(JSON.stringify(value)+'\n');await handle.sync();}
+  finally{await handle.close();}
+}
+
+async function publishClaim(file,value){
+  const temporary=`${file}.private-${process.pid}-${randomBytes(8).toString('hex')}`;
+  try{
+    await writeExclusive(temporary,value);
+    await link(temporary,file); // Atomic, no-clobber visibility of complete bytes.
+  }finally{
+    await unlink(temporary).catch(error=>{if(error?.code!=='ENOENT')throw error;});
+  }
+}
+
+async function readClaim(file){
+  try{return JSON.parse(await readFile(file,'utf8'));}
+  catch(error){
+    if(error?.code==='ENOENT')return null;
+    if(error instanceof SyntaxError)return {incomplete:true};
+    throw error;
+  }
+}
+
+async function event(recordPath,state,detail={}){
+  const file=path.join(recordPath,`event-${Date.now()}-${randomBytes(8).toString('hex')}.json`);
+  await writeExclusive(file,{schema:'deadbyte.npm-publication-event.r65.v1',state,at_utc:new Date().toISOString(),...detail});
+}
+
+async function priorState(recordPath){
+  const names=(await readdir(recordPath)).filter(name=>/^event-\d+-[0-9a-f]{16}\.json$/.test(name));
+  if(names.length>1024)throw new Error('npm publication evidence event budget exceeded');
+  const states=[];
+  for(const name of names){
+    const value=JSON.parse(await readFile(path.join(recordPath,name),'utf8'));
+    if(value.schema!=='deadbyte.npm-publication-event.r65.v1')throw new Error('npm publication event schema invalid');
+    states.push(value);
+  }
+  return states;
+}
+
+function result(state,extra={}){return Object.freeze({state,...extra});}
+
+// The no-clobber claim is the dispatch fence: once it exists, no invocation may
+// submit the same immutable npm version again, even if the first process dies.
+export async function reconcileNpmPublication({recordPath,version,manifestSha256,localBytes,publish,lookup,tags,fetchTarball,
+  timeoutMs=180000,pollMs=1500,sleep=pause,now=()=>performance.now()}){
+  if(!path.isAbsolute(recordPath)||!/^\d+\.\d+\.\d+$/.test(version)||!HEX64.test(String(manifestSha256))||!Buffer.isBuffer(localBytes)||
+    !Number.isSafeInteger(timeoutMs)||timeoutMs<0||timeoutMs>900000||!Number.isSafeInteger(pollMs)||pollMs<1||pollMs>30000||
+    [publish,lookup,tags,fetchTarball,sleep,now].some(fn=>typeof fn!=='function'))throw new Error('npm publication reconciliation inputs invalid');
+  const tarballSha256=digest(localBytes);
+  if(!HEX64.test(tarballSha256))throw new Error('npm tarball digest invalid');
+  await mkdir(recordPath,{recursive:true});
+  const claimFile=path.join(recordPath,'claim.json');
+  let claim=await readClaim(claimFile);
+  if(claim?.incomplete)return result('OUTCOME_UNKNOWN',{reason:'publication claim incomplete; manual reconciliation required'});
+  if(claim&&(claim.schema!=='deadbyte.npm-publication-claim.r65.v1'||claim.version!==version||claim.manifest_sha256!==manifestSha256||claim.tarball_sha256!==tarballSha256))
+    return result('REGISTRY_REJECTED',{reason:'local artifact differs from existing immutable publication claim'});
+
+  const observe=async()=>{
+    let published;
+    try{published=await lookup();}
+    catch(error){if(error?.code==='E404'||error?.status===404)return null;throw error;}
+    if(!published)return null;
+    let registryBytes;
+    try{registryBytes=await fetchTarball(published);}
+    catch(error){if(error?.status===404||error?.code==='E404')throw Object.assign(new Error('registry tarball is still processing'),{code:'REGISTRY_PROCESSING'});throw error;}
+    const distTags=await tags();
+    const identity=verifyPublishedTarballIdentity({version,localBytes,registryBytes,published,tags:distTags});
+    return {identity,registry:{version:published.version,integrity:published.dist?.integrity,shasum:published.dist?.shasum,
+      tarball:published.dist?.tarball,latest:distTags.latest}};
+  };
+  const check=async()=>{
+    try{const evidence=await observe();return evidence?result('REGISTRY_IDENTITY_VERIFIED',evidence):null;}
+    catch(error){
+      if(error?.code==='REGISTRY_PROCESSING')return result('REGISTRY_PROCESSING');
+      if(/metadata does not match|bytes differ|latest tag mismatch/.test(String(error?.message)))return result('REGISTRY_REJECTED',{reason:String(error.message)});
+      return result('OUTCOME_UNKNOWN',{reason:String(error?.code??error?.message??error)});
+    }
+  };
+
+  let observed=await check();
+  if(observed?.state==='REGISTRY_IDENTITY_VERIFIED'||observed?.state==='REGISTRY_REJECTED'){
+    if(claim)await event(recordPath,observed.state,{tarball_sha256:tarballSha256,registry:observed.registry??null});
+    return observed;
+  }
+  if(!claim){
+    if(observed)return observed; // Registry outage: do not submit while identity is unknown.
+    let created=false;
+    try{
+      await publishClaim(claimFile,{schema:'deadbyte.npm-publication-claim.r65.v1',version,manifest_sha256:manifestSha256,tarball_sha256:tarballSha256,created_at_utc:new Date().toISOString()});
+      claim={version,manifest_sha256:manifestSha256,tarball_sha256:tarballSha256};created=true;
+    }catch(error){
+      if(error?.code!=='EEXIST')throw error;
+      claim=await readClaim(claimFile);
+      if(claim?.incomplete||!claim)return result('OUTCOME_UNKNOWN',{reason:'concurrent publication claim unavailable or incomplete'});
+      if(claim.version!==version||claim.manifest_sha256!==manifestSha256||claim.tarball_sha256!==tarballSha256)return result('REGISTRY_REJECTED',{reason:'concurrent publication claim differs'});
+    }
+    // Only the creator of the claim may dispatch publish.
+    if(created){
+      await event(recordPath,'SUBMISSION_STARTED',{tarball_sha256:tarballSha256});
+      try{
+        await publish();
+        await event(recordPath,'SUBMISSION_ACCEPTED',{tarball_sha256:tarballSha256});
+      }catch(error){
+        const auth=/E401|E403|EOTP|authentication|one-time password|2FA/i.test(String(error?.code??'')+' '+String(error?.message??''));
+        await event(recordPath,auth?'AUTH_REQUIRED':'OUTCOME_UNKNOWN',{error_code:String(error?.code??'UNKNOWN').slice(0,64)});
+        return result(auth?'AUTH_REQUIRED':'OUTCOME_UNKNOWN',{reason:String(error?.code??error?.message??error)});
+      }
+    }
+  }
+  const states=await priorState(recordPath);
+  if(states.some(item=>item.state==='AUTH_REQUIRED'))return result('AUTH_REQUIRED');
+  const accepted=states.some(item=>item.state==='SUBMISSION_ACCEPTED');
+  const started=now();
+  do{
+    observed=await check();
+    if(observed?.state==='REGISTRY_IDENTITY_VERIFIED'||observed?.state==='REGISTRY_REJECTED'){
+      await event(recordPath,observed.state,{tarball_sha256:tarballSha256,registry:observed.registry??null});return observed;
+    }
+    if(observed?.state==='OUTCOME_UNKNOWN')return observed;
+    const remaining=timeoutMs-(now()-started);
+    if(remaining<=0)break;
+    await sleep(Math.min(pollMs,remaining));
+  }while(true);
+  await event(recordPath,accepted?'REGISTRY_PROCESSING':'OUTCOME_UNKNOWN',{tarball_sha256:tarballSha256});
+  return result(accepted?'REGISTRY_PROCESSING':'OUTCOME_UNKNOWN');
+}