deadbyte-mcp 0.15.39 → 0.15.42

package/src/activation-continuity-engine-r65.mjs

@@ -0,0 +1,225 @@
+import {createHash,randomBytes} from 'node:crypto';
+import {open,readFile,rm} from 'node:fs/promises';
+import path from 'node:path';
+import {canonicalJson} from './canonical-json.mjs';
+import {
+  captureStandingGrant,compareSecurityEnvelopes,createAuthorityEpochStore,deriveSecurityEnvelope
+} from './authority-continuity-r65.mjs';
+
+const PLANES=Object.freeze(['process','coding','autonomous','desktop','host']);
+const REVOKE_ORDER=Object.freeze(['host','desktop','autonomous','coding','process']);
+const RESTORE_ORDER=Object.freeze(['process','coding','autonomous','desktop','host']);
+const HEX64=/^[0-9a-f]{64}$/;
+const GRANT_PATH_FIELD=Object.freeze({
+  process:'grant_file',coding:'lease_file',autonomous:'lease_file',desktop:'grant_file',host:'arm_file'
+});
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const plain=value=>value&&typeof value==='object'&&!Array.isArray(value);
+
+function parseJson(bytes,label){
+  try{return JSON.parse(bytes.toString('utf8'));}
+  catch{throw new Error(`${label} JSON invalid`);}
+}
+function inside(root,target){
+  const rel=path.relative(path.resolve(root),path.resolve(target));
+  return rel===''||(!rel.startsWith('..'+path.sep)&&rel!=='..'&&!path.isAbsolute(rel));
+}
+function grantPath(policy,plane,stateRoot){
+  const field=GRANT_PATH_FIELD[plane],raw=policy?.[field];
+  if(typeof raw!=='string'||!path.isAbsolute(raw))throw new Error(`${plane} grant path missing`);
+  const resolved=path.resolve(raw),runtimeRoot=path.join(path.resolve(stateRoot),'runtime');
+  if(!inside(runtimeRoot,resolved))throw new Error(`${plane} grant path escapes runtime state`);
+  return resolved;
+}
+async function readOptional(file){
+  try{return await readFile(file);}catch(error){if(error?.code==='ENOENT')return null;throw error;}
+}
+async function writeExclusive(file,bytes){
+  const handle=await open(file,'wx',0o600);
+  try{await handle.writeFile(bytes);await handle.sync();}
+  finally{await handle.close();}
+}
+async function removeIfExact(file,expectedSha256){
+  const current=await readOptional(file);
+  if(current===null)return {removed:false,reason:'absent'};
+  if(sha(current)!==expectedSha256)return {removed:false,reason:'replacement'};
+  await rm(file,{force:true});
+  return {removed:true,reason:'matched'};
+}
+function validateCapture(capture){
+  if(!plain(capture)||typeof capture.update_id!=='string'||!Array.isArray(capture.planes)||!plain(capture.records))throw new Error('authority continuity capture invalid');
+  for(const plane of capture.planes)if(!PLANES.includes(plane)||!capture.records[plane])throw new Error('authority continuity capture plane invalid');
+}
+function scopePermitted(plane,scope,policy){
+  if(plane==='process')return Array.isArray(scope.root_ids)&&Array.isArray(scope.profile_ids)&&
+    scope.root_ids.every(id=>Object.hasOwn(policy.roots??{},id))&&
+    scope.profile_ids.every(id=>Object.hasOwn(policy.profiles??{},id)&&
+      Array.isArray(policy.profiles[id]?.root_ids)&&policy.profiles[id].root_ids.every(rootId=>scope.root_ids.includes(rootId)));
+  if(plane==='coding')return Array.isArray(scope.root_ids)&&scope.root_ids.every(id=>Object.hasOwn(policy.roots??{},id));
+  if(plane==='autonomous')return Array.isArray(scope.root_ids)&&scope.root_ids.every(id=>(policy.root_ids??[]).includes(id));
+  if(plane==='desktop')return Array.isArray(scope.action_kinds)&&scope.action_kinds.every(id=>(policy.allowed_actions??[]).includes(id));
+  return plane==='host';
+}
+function buildSuccessorGrant({plane,record,successorPolicyBytes,successorPolicy}){
+  const policySha256=sha(successorPolicyBytes),instanceNonce=randomBytes(32).toString('hex'),grantedAt=new Date().toISOString();
+  let grant;
+  if(plane==='process')grant={schema:record.grant_schema,policy_sha256:policySha256,instance_nonce:instanceNonce,
+    profile_ids:[...record.granted_scope.profile_ids],root_ids:[...record.granted_scope.root_ids],granted_at_utc:grantedAt};
+  else if(plane==='coding')grant={schema:record.grant_schema,policy_sha256:policySha256,instance_nonce:instanceNonce,
+    root_ids:[...record.granted_scope.root_ids],granted_at_utc:grantedAt};
+  else if(plane==='autonomous')grant={schema:record.grant_schema,policy_sha256:policySha256,
+    coding_policy_sha256:successorPolicy.coding_policy_sha256,instance_nonce:instanceNonce,
+    root_ids:[...record.granted_scope.root_ids],granted_at_utc:grantedAt};
+  else if(plane==='desktop')grant={schema:record.grant_schema,policy_sha256:policySha256,instance_nonce:instanceNonce,
+    action_kinds:[...record.granted_scope.action_kinds],granted_at_utc:grantedAt};
+  else if(plane==='host')grant={schema:record.grant_schema,policy_sha256:policySha256,instance_nonce:instanceNonce,granted_at_utc:grantedAt};
+  else throw new Error('authority continuity plane invalid');
+  return {grant,bytes:Buffer.from(canonicalJson(grant),'utf8'),instanceNonce};
+}
+function classifyConflict(head,record,updateId){
+  if(!head)return 'REAUTH_REQUIRED';
+  if(head.action==='user_revoke')return 'REVOKED_DURING_UPDATE';
+  if((head.action==='grant'||head.action==='transaction_restore')&&
+      (head.grant_sha256!==record.grant_sha256||head.grant_instance_nonce!==record.grant_instance_nonce))return 'REPLACED';
+  if(head.action==='transaction_revoke'&&head.update_id===updateId&&
+      head.grant_sha256===record.grant_sha256&&head.grant_instance_nonce===record.grant_instance_nonce)return null;
+  return 'REAUTH_REQUIRED';
+}
+
+export function createEpochNativeContinuityEngine({stateRoot,predecessorPolicyPaths,successorPolicyPaths,updateId}={}){
+  const state=path.resolve(String(stateRoot??''));
+  if(!stateRoot||!plain(predecessorPolicyPaths)||typeof successorPolicyPaths!=='function'||
+      typeof updateId!=='string'||!/^[A-Za-z0-9._-]{1,96}$/.test(updateId))
+    throw new Error('authority continuity engine configuration invalid');
+
+  return Object.freeze({
+    async capture({observation,subject_sha256,pointer,expectedParent,candidate,expectedCandidate}){
+      if(!HEX64.test(String(subject_sha256))||!plain(observation?.authority))throw new Error('authority continuity capture subject invalid');
+      if(expectedParent?.release_id!==pointer?.release_id||expectedParent?.generation_manifest_sha256!==pointer?.generation_manifest_sha256||
+          expectedCandidate?.version!==candidate?.version||expectedCandidate?.manifest_sha256!==candidate?.manifest_sha256)
+        throw new Error('authority continuity lineage mismatch');
+      const records={},planes=[];
+      for(const plane of PLANES){
+        const authority=observation.authority[plane];
+        if(!authority?.armed)continue;
+        if(!Number.isSafeInteger(authority.epoch_seq)||authority.epoch_seq<1||!HEX64.test(String(authority.epoch_sha256)))
+          throw new Error(`${plane} standing authority is legacy or epoch identity is incomplete`);
+        const policyPath=predecessorPolicyPaths[plane];
+        if(typeof policyPath!=='string'||!path.isAbsolute(policyPath))throw new Error(`${plane} predecessor policy path unavailable`);
+        const policyBytes=await readFile(policyPath),policy=parseJson(policyBytes,`${plane} predecessor policy`);
+        const file=grantPath(policy,plane,state),grantBytes=await readFile(file),grant=parseJson(grantBytes,`${plane} predecessor grant`);
+        const store=createAuthorityEpochStore({runtimeDir:path.dirname(file),policyBytes});
+        const verified=await store.verifyGrant({plane,grantBytes,grantInstanceNonce:grant.instance_nonce,policyBytes});
+        const head=await store.readHead({plane});
+        if(!verified.trusted||!head||head.action!=='grant'&&head.action!=='transaction_restore'||
+            head.seq!==authority.epoch_seq||head.event_sha256!==authority.epoch_sha256)
+          throw new Error(`${plane} observed standing authority does not match durable epoch`);
+        const record=captureStandingGrant({plane,policyBytes,grantBytes,predecessor:expectedParent,candidate:expectedCandidate,updateId});
+        records[plane]=Object.freeze({record,policy_path:policyPath,grant_file:file,prior_policy_bytes:policyBytes,
+          prior_grant_bytes:grantBytes,captured_head:Object.freeze({...head})});
+        planes.push(plane);
+      }
+      if(planes.length===0)throw new Error('epoch-native continuity capture has no armed planes');
+      return Object.freeze({schema:'deadbyte.activation-authority-capture.r65.v1',update_id:updateId,subject_sha256,
+        planes:Object.freeze(planes),records:Object.freeze(records)});
+    },
+
+    async revoke(capture){
+      validateCapture(capture);
+      const outcomes={};
+      for(const plane of REVOKE_ORDER){
+        const item=capture.records[plane];
+        if(!item)continue;
+        const {record,prior_policy_bytes:policyBytes,prior_grant_bytes:grantBytes,grant_file:file,captured_head:capturedHead}=item;
+        const store=createAuthorityEpochStore({runtimeDir:path.dirname(file),policyBytes});
+        const current=await store.readHead({plane});
+        if(!current||current.event_sha256!==capturedHead.event_sha256||current.seq!==capturedHead.seq)
+          throw new Error(`${plane} authority changed before transaction revoke`);
+        const revoked=await store.append({plane,action:'transaction_revoke',grantBytes,
+          grantInstanceNonce:record.grant_instance_nonce,updateId:capture.update_id,expectedHeadSha256:capturedHead.event_sha256});
+        let observed=await store.readHead({plane});
+        if(!observed||observed.event_sha256!==revoked.event_sha256)
+          throw new Error(`${plane} authority changed during transaction revoke`);
+        const sentinel=await readOptional(file);
+        if(sentinel===null)throw new Error(`${plane} grant disappeared during transaction revoke`);
+        if(sha(sentinel)!==record.grant_sha256)throw new Error(`${plane} replacement grant appeared during transaction revoke`);
+        observed=await store.readHead({plane});
+        if(!observed||observed.event_sha256!==revoked.event_sha256){
+          const conflict=classifyConflict(observed,record,capture.update_id);
+          throw new Error(`${plane} authority changed after transaction revoke: ${conflict??'unknown'}`);
+        }
+        const verification=await store.verifyGrant({plane,grantBytes,grantInstanceNonce:record.grant_instance_nonce,policyBytes});
+        if(verification.trusted)throw new Error(`${plane} remained trusted after transaction revoke`);
+        outcomes[plane]='TRANSACTION_REVOKED';
+      }
+      return Object.freeze(outcomes);
+    },
+
+    async restore({capture,successor_observation,activation,candidate,expectedCandidate,subject_sha256}){
+      validateCapture(capture);
+      if(capture.subject_sha256!==subject_sha256||expectedCandidate?.version!==candidate?.version||
+          expectedCandidate?.manifest_sha256!==candidate?.manifest_sha256||activation?.verified!==true)
+        throw new Error('authority continuity restore subject invalid');
+      const paths=await successorPolicyPaths();
+      if(!plain(paths))throw new Error('successor authority policy paths unavailable');
+      const outcomes=Object.fromEntries(PLANES.map(plane=>[plane,capture.records[plane]?'REAUTH_REQUIRED':'NOT_APPLICABLE']));
+      const reauth=[],restoredNonces={};
+      let codingRestored=!capture.records.coding;
+      for(const plane of RESTORE_ORDER){
+        const item=capture.records[plane];
+        if(!item)continue;
+        const {record,prior_policy_bytes:priorPolicyBytes,prior_grant_bytes:priorGrantBytes,grant_file:file}=item;
+        if(plane==='autonomous'&&!codingRestored){outcomes[plane]='REAUTH_REQUIRED';reauth.push(plane);continue;}
+        const policyPath=paths[plane];
+        if(typeof policyPath!=='string'||!path.isAbsolute(policyPath)){outcomes[plane]='REAUTH_REQUIRED';reauth.push(plane);continue;}
+        let successorPolicyBytes,successorPolicy,priorPolicy;
+        try{
+          successorPolicyBytes=await readFile(policyPath);
+          successorPolicy=parseJson(successorPolicyBytes,`${plane} successor policy`);
+          priorPolicy=parseJson(priorPolicyBytes,`${plane} predecessor policy`);
+        }catch{outcomes[plane]='REAUTH_REQUIRED';reauth.push(plane);continue;}
+        const priorEnvelope=deriveSecurityEnvelope(plane,priorPolicy),successorEnvelope=deriveSecurityEnvelope(plane,successorPolicy);
+        const relation=compareSecurityEnvelopes(plane,priorEnvelope,successorEnvelope).relation;
+        if(relation==='WIDER'){outcomes[plane]='POLICY_WIDENED';reauth.push(plane);continue;}
+        if(relation==='UNVERIFIED'||!scopePermitted(plane,record.granted_scope,successorPolicy)){
+          outcomes[plane]='REAUTH_REQUIRED';reauth.push(plane);continue;
+        }
+        const successorGrantPath=grantPath(successorPolicy,plane,state);
+        if(successorGrantPath!==file){outcomes[plane]='REAUTH_REQUIRED';reauth.push(plane);continue;}
+        const store=createAuthorityEpochStore({runtimeDir:path.dirname(file),policyBytes:successorPolicyBytes});
+        const head=await store.readHead({plane}),conflict=classifyConflict(head,record,capture.update_id);
+        if(conflict){
+          if(conflict==='REVOKED_DURING_UPDATE')await removeIfExact(file,record.grant_sha256).catch(()=>{});
+          outcomes[plane]=conflict;reauth.push(plane);continue;
+        }
+        const existing=await readOptional(file);
+        if(existing===null){outcomes[plane]='REVOKED_DURING_UPDATE';reauth.push(plane);continue;}
+        if(sha(existing)!==record.grant_sha256){outcomes[plane]='REPLACED';reauth.push(plane);continue;}
+        await rm(file,{force:true});
+        const prepared=buildSuccessorGrant({plane,record,successorPolicyBytes,successorPolicy});
+        try{await writeExclusive(file,prepared.bytes);}
+        catch(error){if(error?.code==='EEXIST'){outcomes[plane]='REPLACED';reauth.push(plane);continue;}throw error;}
+        try{
+          const restoreBinding={prior_grant_sha256:record.grant_sha256,prior_grant_instance_nonce:record.grant_instance_nonce,
+            predecessor_policy_envelope_sha256:record.prior_policy_envelope_sha256,successor_policy_envelope_sha256:successorEnvelope.sha256,
+            candidate_manifest_sha256:expectedCandidate.manifest_sha256,continuity_subject_sha256:capture.subject_sha256};
+          const restored=await store.append({plane,action:'transaction_restore',grantBytes:prepared.bytes,
+            grantInstanceNonce:prepared.instanceNonce,updateId:capture.update_id,expectedHeadSha256:head.event_sha256,restoreBinding});
+          const verified=await store.verifyGrant({plane,grantBytes:prepared.bytes,grantInstanceNonce:prepared.instanceNonce,policyBytes:successorPolicyBytes});
+          if(!verified.trusted||verified.event_sha256!==restored.event_sha256)throw new Error(`${plane} restored grant did not verify`);
+          outcomes[plane]=relation==='NARROWER'?'RESTORED_SAFE':'RESTORED_EXACT';restoredNonces[plane]=prepared.instanceNonce;
+          if(plane==='coding')codingRestored=true;
+        }catch(error){
+          const current=await store.readHead({plane}).catch(()=>null);
+          const currentConflict=classifyConflict(current,record,capture.update_id);
+          const cleanup=await removeIfExact(file,sha(prepared.bytes)).catch(()=>({reason:'cleanup-failed'}));
+          if(currentConflict){outcomes[plane]=currentConflict;reauth.push(plane);continue;}
+          if(cleanup.reason==='replacement'){outcomes[plane]='REPLACED';reauth.push(plane);continue;}
+          throw error;
+        }
+      }
+      return Object.freeze({authority_outcomes:Object.freeze(outcomes),restored_nonces:Object.freeze(restoredNonces),
+        reauth_planes:Object.freeze([...new Set(reauth)])});
+    }
+  });
+}

package/src/activation-lock-r65.mjs

@@ -0,0 +1,155 @@
+import {createPublicKey,randomBytes} from 'node:crypto';
+import {mkdir,open,readFile,readdir,unlink} from 'node:fs/promises';
+import path from 'node:path';
+import {verifySlotUpdateEnvelope} from './runtime-update.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const OP=/^[0-9a-f]{32}$/;
+const LOCK_SCHEMA='deadbyte.r65-activation-claim.v1';
+const OUTCOME_SCHEMA='deadbyte.r65-activation-outcome.v1';
+const UPDATE_SCHEMA='deadbyte.r27-slot-update-receipt.v1';
+const MAX_OUTCOME_SCAN=2048;
+
+async function writeExclusive(file,value){
+  const handle=await open(file,'wx',0o600);
+  try{await handle.writeFile(JSON.stringify(value)+'\n');await handle.sync();}
+  finally{await handle.close();}
+}
+
+function validateLock(value){
+  if(!value||typeof value!=='object'||Array.isArray(value)||value.schema!==LOCK_SCHEMA||
+      !OP.test(String(value.operation_id??''))||!HEX64.test(String(value.subject_sha256??''))||
+      typeof value.created_at_utc!=='string'||!Number.isFinite(Date.parse(value.created_at_utc)))
+    throw new Error('activation claim lock invalid or corrupt');
+  return value;
+}
+
+async function readLock(lockPath){
+  let text;
+  try{text=await readFile(lockPath,'utf8');}
+  catch(error){if(error?.code==='ENOENT')return null;throw error;}
+  let value;
+  try{value=JSON.parse(text);}catch{throw new Error('activation claim lock corrupt');}
+  return validateLock(value);
+}
+
+function outcomeMatchesLock(outcome,lock){
+  return !!outcome&&typeof outcome==='object'&&!Array.isArray(outcome)&&outcome.schema===OUTCOME_SCHEMA&&
+    outcome.claim_operation_id===lock.operation_id&&outcome.preflight_subject_sha256===lock.subject_sha256;
+}
+
+function isSafePreMutationReject(outcome,lock){
+  return outcomeMatchesLock(outcome,lock)&&outcome?.outcome?.state==='ACTIVATION_REJECTED'&&
+    outcome.update_id===null&&outcome.state_path===null;
+}
+
+function pointerIdentity(value){
+  if(!value||typeof value!=='object'||Array.isArray(value))return null;
+  const result={
+    release_id:value.release_id,version:value.version,manifest_sha256:value.manifest_sha256,
+    generation_manifest_sha256:value.generation_manifest_sha256
+  };
+  if(typeof result.release_id!=='string'||typeof result.version!=='string'||
+      !HEX64.test(String(result.manifest_sha256??''))||!HEX64.test(String(result.generation_manifest_sha256??'')))return null;
+  return result;
+}
+
+function samePointerIdentity(a,b){
+  const left=pointerIdentity(a),right=pointerIdentity(b);
+  return !!left&&!!right&&left.release_id===right.release_id&&left.version===right.version&&
+    left.manifest_sha256===right.manifest_sha256&&left.generation_manifest_sha256===right.generation_manifest_sha256;
+}
+
+async function isSafeTerminalActivation(outcome,lock,stateRoot){
+  if(!outcomeMatchesLock(outcome,lock)||outcome?.outcome?.state!=='ACTIVATED')return false;
+  if(typeof outcome.update_id!=='string'||outcome.update_id.length<1||
+      typeof outcome.state_path!=='string'||!path.isAbsolute(outcome.state_path)||
+      typeof outcome.candidate_version!=='string'||!HEX64.test(String(outcome.candidate_manifest_sha256??''))||
+      typeof outcome.predecessor_release_id!=='string')return false;
+  const statePath=path.resolve(outcome.state_path),updatesRoot=path.join(path.resolve(stateRoot),'evidence','updates');
+  const rel=path.relative(updatesRoot,statePath);
+  if(rel.startsWith('..'+path.sep)||rel==='..'||path.isAbsolute(rel))return false;
+  const receiptPath=path.join(path.dirname(statePath),'receipt.json');
+  let receipt,publicKey,active;
+  try{
+    receipt=JSON.parse(await readFile(receiptPath,'utf8'));
+    publicKey=createPublicKey(await readFile(path.join(path.resolve(stateRoot),'trust','ed25519-public.pem')));
+    active=JSON.parse(await readFile(path.join(path.resolve(stateRoot),'active-release.json'),'utf8'));
+  }catch{return false;}
+  if(publicKey.asymmetricKeyType!=='ed25519'||!verifySlotUpdateEnvelope(receipt,publicKey))return false;
+  const body=receipt.body;
+  if(body?.schema!==UPDATE_SCHEMA||body.rollback_performed!==false||body.update_id!==outcome.update_id||
+      body.release_version!==outcome.candidate_version||body.candidate_manifest_sha256!==outcome.candidate_manifest_sha256||
+      body.prior_pointer?.release_id!==outcome.predecessor_release_id)return false;
+  if(!samePointerIdentity(body.active_pointer,active))return false;
+  return true;
+}
+
+async function findTerminalOutcome(updatesDir,lock,stateRoot){
+  const names=(await readdir(updatesDir)).filter(name=>/^r65-activation-outcome-.*\.json$/.test(name)).sort();
+  if(names.length>MAX_OUTCOME_SCAN)throw new Error('activation outcome inventory exceeds safe scan budget');
+  let matched=false,foreign=false,unknown=false;
+  for(const name of names){
+    let value;
+    try{value=JSON.parse(await readFile(path.join(updatesDir,name),'utf8'));}
+    catch{continue;}
+    if(value?.claim_operation_id!==lock.operation_id)continue;
+    if(value?.preflight_subject_sha256!==lock.subject_sha256){foreign=true;continue;}
+    if(isSafePreMutationReject(value,lock)||await isSafeTerminalActivation(value,lock,stateRoot))matched=true;
+    else unknown=true;
+  }
+  return {matched,foreign,unknown};
+}
+
+export function createActivationClaimManager({stateRoot}={}){
+  if(typeof stateRoot!=='string'||stateRoot.length<1)throw new Error('activation claim state root invalid');
+  const state=path.resolve(stateRoot),updatesDir=path.join(state,'evidence','updates');
+  const lockPath=path.join(updatesDir,'r65-activation.lock');
+
+  async function create(subjectSha256){
+    if(!HEX64.test(String(subjectSha256??'')))throw new Error('activation claim subject invalid');
+    const claim={schema:LOCK_SCHEMA,operation_id:randomBytes(16).toString('hex'),subject_sha256:subjectSha256,created_at_utc:new Date().toISOString()};
+    await writeExclusive(lockPath,claim);
+    return claim;
+  }
+
+  async function releaseOwned(claim){
+    const current=await readLock(lockPath);
+    if(!current)throw new Error('activation claim ownership missing at release');
+    if(current.operation_id!==claim.operation_id||current.subject_sha256!==claim.subject_sha256)
+      throw new Error('activation claim changed before release');
+    await unlink(lockPath);
+  }
+
+  return Object.freeze({
+    async claim(subjectSha256){
+      if(!HEX64.test(String(subjectSha256??'')))throw new Error('activation claim subject invalid');
+      await mkdir(updatesDir,{recursive:true});
+      try{
+        const claim=await create(subjectSha256);
+        return Object.freeze({...claim,release:async()=>releaseOwned(claim)});
+      }catch(error){
+        if(error?.code!=='EEXIST')throw error;
+      }
+
+      const existing=await readLock(lockPath);
+      if(!existing)throw new Error('activation claim disappeared during reconciliation');
+      const evidence=await findTerminalOutcome(updatesDir,existing,state);
+      if(!evidence.matched||evidence.foreign||evidence.unknown)
+        throw new Error(evidence.foreign?'activation claim subject mismatch or unresolved owner':'activation claim unresolved or in progress');
+
+      const current=await readLock(lockPath);
+      if(!current||current.operation_id!==existing.operation_id||current.subject_sha256!==existing.subject_sha256)
+        throw new Error('activation claim changed during terminal reconciliation');
+      await unlink(lockPath);
+
+      try{
+        const claim=await create(subjectSha256);
+        return Object.freeze({...claim,release:async()=>releaseOwned(claim)});
+      }catch(error){
+        if(error?.code==='EEXIST')throw new Error('activation claim acquired concurrently during reconciliation');
+        throw error;
+      }
+    }
+  });
+}

package/src/activation-preflight-r65.mjs

@@ -0,0 +1,197 @@
+import {createHash} from 'node:crypto';
+
+const PLANES=['process','coding','autonomous','desktop','host'];
+const HEX64=/^[0-9a-f]{64}$/;
+const canonical=value=>Array.isArray(value)?value.map(canonical):value&&typeof value==='object'
+  ?Object.fromEntries(Object.keys(value).sort().map(key=>[key,canonical(value[key])])):value;
+const digest=value=>createHash('sha256').update(JSON.stringify(canonical(value))).digest('hex');
+const vector=observation=>Object.fromEntries(PLANES.map(plane=>{
+  const entry=observation?.authority?.[plane];return [plane,typeof entry==='boolean'?entry:entry?.armed];
+}));
+
+export function classifyAuthorityContinuity(observation){
+  const armed=[],legacy=[],epoch=[];
+  for(const plane of PLANES){
+    const entry=observation?.authority?.[plane];
+    const isArmed=typeof entry==='boolean'?entry:entry?.armed;
+    if(typeof isArmed!=='boolean')return Object.freeze({state:'UNVERIFIED',armed_planes:[],reauth_planes:[],epoch_planes:[],reason:`${plane} authority observation incomplete`});
+    if(!isArmed)continue;
+    armed.push(plane);
+    if(typeof entry==='boolean'){legacy.push(plane);continue;}
+    const hasSeq=entry.epoch_seq!==undefined&&entry.epoch_seq!==null;
+    const hasSha=entry.epoch_sha256!==undefined&&entry.epoch_sha256!==null;
+    if(hasSeq!==hasSha)return Object.freeze({state:'UNVERIFIED',armed_planes:armed,reauth_planes:armed,epoch_planes:epoch,reason:`${plane} epoch observation incomplete`});
+    if(!hasSeq){legacy.push(plane);continue;}
+    if(!Number.isSafeInteger(entry.epoch_seq)||entry.epoch_seq<1||typeof entry.epoch_sha256!=='string'||!HEX64.test(entry.epoch_sha256))
+      return Object.freeze({state:'UNVERIFIED',armed_planes:armed,reauth_planes:armed,epoch_planes:epoch,reason:`${plane} epoch observation invalid`});
+    epoch.push(plane);
+  }
+  if(armed.length===0)return Object.freeze({state:'NOT_APPLICABLE',armed_planes:[],reauth_planes:[],epoch_planes:[]});
+  if(legacy.length===armed.length)return Object.freeze({state:'LEGACY_REAUTH_REQUIRED',armed_planes:armed,reauth_planes:armed,epoch_planes:[]});
+  if(epoch.length===armed.length)return Object.freeze({state:'EPOCH_NATIVE',armed_planes:armed,reauth_planes:[],epoch_planes:epoch});
+  return Object.freeze({state:'MIXED_REAUTH_REQUIRED',armed_planes:armed,reauth_planes:armed,epoch_planes:epoch,legacy_planes:legacy});
+}
+
+export function authorityTransitionPlan(authority){
+  if(!authority||PLANES.some(plane=>typeof authority[plane]!=='boolean'))throw new Error('activation authority vector incomplete');
+  if(authority.autonomous&&!authority.coding)throw new Error('activation authority vector inconsistent');
+  return Object.freeze({
+    before:Object.freeze(['desktop','host'].filter(plane=>authority[plane]).map(plane=>`disarm${plane}`)),
+    after:Object.freeze(['desktop','host'].filter(plane=>authority[plane]).map(plane=>`arm${plane}`))
+  });
+}
+
+export function classifyActivationPreflight({pointer,expectedParent,candidate,expectedCandidate,observation}){
+  if(!expectedParent||!expectedCandidate||!candidate||!pointer)throw new Error('activation preflight subject missing');
+  const authority=vector(observation);
+  if(PLANES.some(plane=>typeof authority[plane]!=='boolean'))return Object.freeze({state:'UNKNOWN',safe_to_activate:false,reason:'authority observation incomplete'});
+  const subject={pointer,expectedParent,candidate,expectedCandidate,observation};
+  const bound={subject_sha256:digest(subject),authority:Object.freeze(authority)};
+  if(PLANES.some(plane=>!HEX64.test(String(observation?.policy_sha256?.[plane]))))
+    return Object.freeze({state:'UNKNOWN',safe_to_activate:false,reason:'policy hash observation incomplete',...bound});
+  if(pointer.release_id!==expectedParent.release_id||pointer.version!==expectedParent.version||
+      pointer.manifest_sha256!==expectedParent.manifest_sha256||pointer.generation_manifest_sha256!==expectedParent.generation_manifest_sha256)
+    return Object.freeze({state:'POINTER_DRIFT',safe_to_activate:false,...bound});
+  if(observation.active_release_id!==pointer.release_id||observation.active_manifest_sha256!==pointer.manifest_sha256||
+      observation.active_generation_manifest_sha256!==pointer.generation_manifest_sha256)
+    return Object.freeze({state:'POINTER_DRIFT',safe_to_activate:false,...bound});
+  if(candidate.version!==expectedCandidate.version||candidate.manifest_sha256!==expectedCandidate.manifest_sha256)
+    return Object.freeze({state:'CANDIDATE_DRIFT',safe_to_activate:false,...bound});
+  if(authority.autonomous&&!authority.coding)return Object.freeze({state:'RUNTIME_DRIFT',safe_to_activate:false,...bound});
+  if(observation?.state==='PARKED')return Object.freeze({state:'PARKED_DIRTY',safe_to_activate:false,...bound});
+  if(observation?.state==='OFFLINE'){
+    const clean=!observation.bridge?.alive&&!observation.core?.alive&&!observation.cloud?.alive&&!observation.supervisor?.running&&
+      PLANES.every(plane=>!authority[plane]);
+    return Object.freeze({state:clean?'OFFLINE_CLEAN':'OFFLINE_DIRTY',safe_to_activate:clean,...bound});
+  }
+  if(observation?.state!=='ONLINE')return Object.freeze({state:'UNKNOWN',safe_to_activate:false,...bound});
+  if(observation.local_ready!==true||['bridge','core','cloud'].some(name=>observation[name]?.alive!==true||observation[name]?.reason!=='verified'||
+      !Number.isSafeInteger(observation[name]?.pid)||observation[name].pid<1)||observation.supervisor?.running!==true)
+    return Object.freeze({state:'RUNTIME_DRIFT',safe_to_activate:false,...bound});
+  if(authority.host)return Object.freeze({state:'ONLINE_HOST_ARMED',safe_to_activate:false,...bound});
+  return Object.freeze({state:'ONLINE_READY',safe_to_activate:true,...bound});
+}
+
+export async function orchestrateActivation({pointer,expectedParent,candidate,expectedCandidate,observe,command,activate,claim=null,continuityEngine=null,recordOutcome=null}){
+  if([observe,command,activate].some(fn=>typeof fn!=='function'))throw new Error('activation orchestrator callbacks invalid');
+  const input={pointer,expectedParent,candidate,expectedCandidate};
+  const firstObservation=await observe();
+  const initial=classifyActivationPreflight({...input,observation:firstObservation});
+  if(!['ONLINE_READY','ONLINE_HOST_ARMED','PARKED_DIRTY','OFFLINE_CLEAN'].includes(initial.state))
+    return Object.freeze({state:'ACTIVATION_REJECTED',preflight:initial.state,subject_sha256:initial.subject_sha256??null});
+  const continuity=classifyAuthorityContinuity(firstObservation);
+  if(continuity.state==='UNVERIFIED')
+    return Object.freeze({state:'ACTIVATION_REJECTED',preflight:'AUTHORITY_CONTINUITY_UNVERIFIED',reason:continuity.reason??null,
+      subject_sha256:initial.subject_sha256??null});
+  if(continuity.state==='EPOCH_NATIVE'&&(!continuityEngine||
+      ['capture','revoke','restore'].some(name=>typeof continuityEngine[name]!=='function')))
+    return Object.freeze({state:'ACTIVATION_REJECTED',preflight:'AUTHORITY_CONTINUITY_ENGINE_REQUIRED',
+      reason:'epoch-native standing authority requires transaction continuity proof before activation',
+      subject_sha256:initial.subject_sha256??null,authority_continuity:'UNVERIFIED',epoch_planes:continuity.epoch_planes});
+  const captured=initial.authority;
+  let releaseClaim=null;
+  if(claim){
+    try{releaseClaim=await claim(initial.subject_sha256);}
+    catch(error){return Object.freeze({state:'ACTIVATION_REJECTED',preflight:'CONCURRENT_ACTIVATION',reason:String(error?.message??error).slice(0,256)});}
+  }
+  let dispatched=false;
+  let transitionAttempted=false;
+  let continuityCapture=null;
+  const outcome=await (async()=>{
+    try{
+      const requiresReauth=continuity.state==='LEGACY_REAUTH_REQUIRED'||continuity.state==='MIXED_REAUTH_REQUIRED';
+      const epochNative=continuity.state==='EPOCH_NATIVE';
+      if(epochNative){
+        continuityCapture=await continuityEngine.capture({observation:firstObservation,subject_sha256:initial.subject_sha256,
+          pointer,expectedParent,candidate,expectedCandidate});
+        if(!continuityCapture||typeof continuityCapture!=='object')
+          throw new Error('authority continuity capture invalid');
+        transitionAttempted=true;
+        await continuityEngine.revoke(continuityCapture);
+      }
+      if(requiresReauth){
+        for(const plane of ['host','desktop','autonomous','coding','process']){
+          if(!captured[plane])continue;
+          transitionAttempted=true;
+          await command(`disarm${plane}`);
+        }
+      }
+      if(initial.state==='PARKED_DIRTY'){
+        transitionAttempted=true;
+        await command('supervisorstop');
+        await command('stop');
+      }
+      const ready=classifyActivationPreflight({...input,observation:await observe()});
+      if(!ready.safe_to_activate)
+        return Object.freeze({state:transitionAttempted?'ACTIVATION_OUTCOME_UNKNOWN':'ACTIVATION_REJECTED',
+          preflight:ready.state,subject_sha256:initial.subject_sha256});
+      if(PLANES.some(plane=>ready.authority[plane]!==false))
+        return Object.freeze({state:transitionAttempted?'ACTIVATION_OUTCOME_UNKNOWN':'ACTIVATION_REJECTED',
+          preflight:'AUTHORITY_NOT_REVOKED',subject_sha256:initial.subject_sha256});
+      transitionAttempted=true;
+      dispatched=true;
+      const activation=await activate();
+      if(activation?.verified!==true)throw new Error('activation returned without runtime and pointer verification');
+      const current=await observe();
+      if(current?.state!=='ONLINE'||current?.local_ready!==true||
+          ['bridge','core','cloud'].some(name=>current[name]?.alive!==true||current[name]?.reason!=='verified'))
+        throw new Error('successor runtime identity is not verified');
+      const beforeRestore=vector(current);
+      if(PLANES.some(plane=>typeof beforeRestore[plane]!=='boolean'))throw new Error('successor authority observation incomplete');
+      if(PLANES.some(plane=>beforeRestore[plane]!==false))
+        throw new Error('successor authority must remain disarmed until continuity restoration or explicit reauthorization');
+      if(continuity.state==='EPOCH_NATIVE'){
+        const restored=await continuityEngine.restore({capture:continuityCapture,successor_observation:current,activation,
+          pointer,expectedParent,candidate,expectedCandidate,subject_sha256:initial.subject_sha256});
+        if(!restored||typeof restored!=='object'||!restored.authority_outcomes||typeof restored.authority_outcomes!=='object')
+          throw new Error('authority continuity restore result invalid');
+        const afterRestore=await observe(),final=vector(afterRestore);
+        if(PLANES.some(plane=>typeof final[plane]!=='boolean'))throw new Error('restored successor authority observation incomplete');
+        const restoredStates=new Set(['RESTORED_EXACT','RESTORED_SAFE']);
+        const priorArmed=continuity.armed_planes??[];
+        for(const plane of priorArmed){
+          const planeOutcome=restored.authority_outcomes[plane];
+          if(typeof planeOutcome!=='string')throw new Error(`authority continuity outcome missing for ${plane}`);
+          if(restoredStates.has(planeOutcome)!==final[plane])
+            throw new Error(`authority continuity observation mismatch for ${plane}`);
+        }
+        for(const plane of PLANES){
+          if(!priorArmed.includes(plane)&&final[plane]!==false)
+            throw new Error(`authority continuity widened previously disarmed ${plane} plane`);
+        }
+        const authorityOutcome=!priorArmed.every(plane=>restoredStates.has(restored.authority_outcomes[plane]))?'REAUTH_REQUIRED':
+          priorArmed.some(plane=>restored.authority_outcomes[plane]==='RESTORED_SAFE')?'RESTORED_SAFE':'RESTORED_EXACT';
+        return Object.freeze({state:'ACTIVATED',runtime_activation:'ACTIVATED',authority_continuity:authorityOutcome,
+          authority_outcomes:Object.freeze({...restored.authority_outcomes}),subject_sha256:initial.subject_sha256,release_id:activation.release_id,
+          prior_authority:Object.freeze({...captured}),final_authority:Object.freeze({...final}),
+          reauth_planes:Object.freeze([...(restored.reauth_planes??[])])});
+      }
+      const final=beforeRestore;
+      const authorityOutcome=continuity.state==='NOT_APPLICABLE'?'NOT_APPLICABLE':'REAUTH_REQUIRED';
+      return Object.freeze({
+        state:'ACTIVATED',runtime_activation:'ACTIVATED',authority_continuity:authorityOutcome,
+        subject_sha256:initial.subject_sha256,release_id:activation.release_id,
+        prior_authority:Object.freeze({...captured}),final_authority:Object.freeze({...final}),
+        reauth_planes:Object.freeze([...(authorityOutcome==='REAUTH_REQUIRED'?continuity.reauth_planes:[])])
+      });
+    }catch(error){
+      return Object.freeze({state:transitionAttempted||dispatched?'ACTIVATION_OUTCOME_UNKNOWN':'ACTIVATION_REJECTED',
+        subject_sha256:initial.subject_sha256,reason:String(error?.message??error).slice(0,256)});
+    }
+  })();
+  if(releaseClaim&&recordOutcome!==null){
+    if(typeof recordOutcome!=='function')
+      return Object.freeze({state:'ACTIVATION_OUTCOME_UNKNOWN',reason:'activation outcome recorder invalid',subject_sha256:initial.subject_sha256});
+    try{await recordOutcome(outcome);}
+    catch(error){
+      return Object.freeze({state:'ACTIVATION_OUTCOME_UNKNOWN',
+        reason:`activation outcome persistence failed: ${String(error?.message??error).slice(0,128)}`,
+        subject_sha256:initial.subject_sha256});
+    }
+  }
+  if(releaseClaim&&(outcome.state==='ACTIVATED'||(!transitionAttempted&&outcome.state==='ACTIVATION_REJECTED'))){
+    try{await releaseClaim();}
+    catch(error){return Object.freeze({state:'ACTIVATION_OUTCOME_UNKNOWN',reason:`activation lock release failed: ${String(error?.message??error).slice(0,128)}`,subject_sha256:initial.subject_sha256});}
+  }
+  return outcome;
+}