deadbyte-mcp 0.15.41 → 0.15.42

package/scripts/npm-release-r48.mjs

@@ -1,7 +1,9 @@
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { verifyPublishedTarballIdentity } from './npm-artifact-identity-r61.mjs';
-import { mkdtemp, readFile, rm, unlink } from 'node:fs/promises';
+import { reconcileNpmPublication } from './npm-publication-r65.mjs';
+import { mkdtemp, readFile, rm, unlink, mkdir, rename } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { resolveStateRoot } from '../src/state-root.mjs';
 import path from 'node:path';
 import os from 'node:os';
 import { fileURLToPath } from 'node:url';
@@ -11,7 +13,7 @@ const node = process.execPath;
 const npmCli = process.env.npm_execpath || path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');
 
 function run(command, args, options = {}) {
-  const { cwd = root, timeout = 180000 } = options;
+  const { cwd = root, timeout = 180000, env=process.env } = options;
   const r = spawnSync(command, args, {
     cwd,
     encoding: 'utf8',
@@ -19,6 +21,7 @@ function run(command, args, options = {}) {
     stdio: ['ignore', 'pipe', 'pipe'],
     shell: false,
     windowsHide: true,
+    env,
   });
   if (r.error) throw r.error;
   if (r.status !== 0) {
@@ -95,30 +98,34 @@ async function main() {
   const existingText = (existing.stdout || '').trim();
   const isAlreadyPublished = existing.status === 0 && existingText && existingText !== 'null';
 
-  if (isAlreadyPublished) {
-    if (!isVerifyOnly) {
-      throw new Error(`deadbyte-mcp@${version} is already published on registry: ${existingText}`);
-    } else {
-      console.log(`Notice: deadbyte-mcp@${version} is already published on registry (${existingText}), proceeding with pre-publish verification only.`);
-    }
-  }
+  if (isAlreadyPublished) console.log(`Notice: deadbyte-mcp@${version} exists on registry (${existingText}); exact-byte reconciliation is required.`);
 
   console.log('[2/7] Pre-pack gates: verifying working tree manifest and doctor...');
   run(node, [path.join(root, 'scripts', 'release-manifest.mjs'), 'verify']);
-  run(node, [path.join(root, 'src', 'deadbyte-cli.mjs'), 'doctor']);
+  const doctorState=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-release-doctor-'));
+  try{run(node,[path.join(root,'src','deadbyte-cli.mjs'),'doctor'],{env:{...process.env,DEADBYTE_STATE_ROOT:doctorState}});}
+  finally{await rm(doctorState,{recursive:true,force:true});}
 
   console.log('[3/7] Packing artifact with npm pack...');
-  const packed = parseJson(runNpm(['pack', '--json'], { timeout: 180000 }));
-  const packRecord = Array.isArray(packed) ? packed[0] : packed?.[pkg.name];
+  const publicationDir=isVerifyOnly?null:path.join(resolveStateRoot(),'evidence','npm-publication',version);
+  const preservedTarball=publicationDir?path.join(publicationDir,`deadbyte-mcp-${version}.tgz`):null;
+  const resuming=Boolean(preservedTarball&&existsSync(path.join(publicationDir,'claim.json')));
+  if(publicationDir)await mkdir(publicationDir,{recursive:true});
+  if(resuming&&!existsSync(preservedTarball))throw new Error('immutable npm publication claim exists but exact local tarball is missing; manual artifact reconciliation required');
+  if(!resuming&&preservedTarball&&existsSync(preservedTarball))throw new Error('unclaimed preserved npm tarball exists; inspect artifact evidence before another pack');
+  const packed=resuming?null:parseJson(runNpm(['pack', '--json'], { timeout: 180000 }));
+  const packRecord=resuming?{filename:path.basename(preservedTarball)}:(Array.isArray(packed) ? packed[0] : packed?.[pkg.name]);
   const filename = packRecord?.filename;
   if (!filename) throw new Error('npm pack did not return a tarball filename');
-  const tarball = path.join(root, filename);
+  const tarball = resuming?preservedTarball:path.join(root, filename);
   let releaseSucceeded = false;
   let publishAttempted = false;
+  let releasePending = false;
 
   try {
     console.log('[4/7] Verifying packed artifact file surface against MANIFEST.SHA256 and packaging contract...');
     const manifestText = await readFile(path.join(root, 'MANIFEST.SHA256'), 'utf8');
+    const manifestSha256=createHash('sha256').update(manifestText).digest('hex');
     const manifestEntries = new Set();
     for (const line of manifestText.split(/\r?\n/)) {
       if (!line) continue;
@@ -169,7 +176,7 @@ async function main() {
       }
 
       run(node, [path.join(extractedPackage, 'src', 'deadbyte-cli.mjs'), 'doctor'], {
-        cwd: extractedPackage,
+        cwd: extractedPackage,env:{...process.env,DEADBYTE_STATE_ROOT:path.join(sandbox,'state')},
       });
 
       console.log('Artifact isolation gate PASS (clean doctor and version check on unpacked tarball in sandbox)');
@@ -189,30 +196,37 @@ async function main() {
       return;
     }
 
-    const localBytes = await readFile(tarball);
+    if(!resuming)await rename(tarball,preservedTarball);
+    const publishTarball=preservedTarball;
+    const localBytes = await readFile(publishTarball);
+    const localIntegrity=`sha512-${createHash('sha512').update(localBytes).digest('base64')}`;
+    if(packRecord.integrity&&packRecord.integrity!==localIntegrity)throw new Error('npm packed artifact integrity changed before publication');
 
     console.log('[6/7] Publishing artifact to npm registry...');
     publishAttempted = true;
-    let publishOut;
-    try {
-      publishOut = runNpmInteractive(['publish', tarball, '--access', 'public', '--auth-type=web'], { timeout: 300000 });
-    } catch (publishError) {
-      const detail = String(publishError?.message || publishError);
-      if (/EOTP|one-time password|two-factor|2FA|security.?key|authentication/i.test(detail)) {
-        console.error('Publish requires interactive npm authentication (Security Key/WebAuthn).');
-        console.error('Tarball preserved for retry: ' + tarball);
-      }
-      throw publishError;
+    const reconciliation=await reconcileNpmPublication({recordPath:publicationDir,version,manifestSha256,localBytes,
+      publish:async()=>runNpmInteractive(['publish',publishTarball,'--access','public','--auth-type=web'],{timeout:300000}),
+      lookup:async()=>{
+        try{
+          const viewed=parseJson(runNpm(['view',`deadbyte-mcp@${version}`,'version','dist.integrity','dist.shasum','dist.tarball','--json'],{timeout:120000}));
+          return Array.isArray(viewed)?viewed[0]:viewed;
+        }catch(error){if(/E404|404 Not Found/.test(String(error?.message)))return null;throw error;}
+      },
+      tags:async()=>parseJson(runNpm(['view','deadbyte-mcp','dist-tags','--json'],{timeout:120000})),
+      fetchTarball:async published=>{
+        const response=await fetch(published?.dist?.tarball,{signal:AbortSignal.timeout(120000)});
+        if(!response.ok)throw Object.assign(new Error(`registry tarball fetch failed status=${response.status}`),{status:response.status});
+        return Buffer.from(await response.arrayBuffer());
+      }});
+    if(reconciliation.state!=='REGISTRY_IDENTITY_VERIFIED'){
+      console.log('RELEASE_PENDING '+JSON.stringify({state:reconciliation.state,version,tarball:publishTarball,record_path:publicationDir,reason:reconciliation.reason??null}));
+      releasePending=true;
+      process.exitCode=2;return;
     }
-    const viewed = parseJson(runNpm(['view', `deadbyte-mcp@${version}`, 'version', 'dist.integrity', 'dist.shasum', 'dist.tarball', '--json'], { timeout: 120000 }));
-    const published = Array.isArray(viewed) ? viewed[0] : viewed;
-    const dist = published?.dist ?? published;
-    if(typeof dist?.tarball !== 'string')throw new Error('published registry tarball URL missing');
-    const registryResponse = await fetch(dist.tarball,{signal:AbortSignal.timeout(120000)});
-    if(!registryResponse.ok) throw new Error(`registry tarball fetch failed status=${registryResponse.status}`);
-    const registryBytes = Buffer.from(await registryResponse.arrayBuffer());
-    const tags = parseJson(runNpm(['view', 'deadbyte-mcp', 'dist-tags', '--json'], { timeout: 120000 }));
-    const identity=verifyPublishedTarballIdentity({version,localBytes,registryBytes,published,tags});
+    const identity=reconciliation.identity;
+    const published={version,dist:{integrity:identity.npm_integrity,shasum:identity.shasum}};
+    const tags={latest:version};
+    const publishOut='registry identity verified by durable reconciliation';
 
     console.log('[7/7] Post-publish external registry smoke test (executed outside repo in temp)...');
     const tempDir = os.tmpdir();
@@ -227,6 +241,7 @@ async function main() {
     const externalDoctor = runNpm(['exec', '--yes', `--package=deadbyte-mcp@${version}`, '--', 'deadbyte-mcp', 'doctor'], {
       cwd: tempDir,
       timeout: 300000,
+      env:{...process.env,DEADBYTE_STATE_ROOT:path.join(publicationDir,'external-doctor-state')},
     });
 
     if(!publishOnly){
@@ -253,10 +268,14 @@ async function main() {
     }, null, 2));
 
   } finally {
-    if ((releaseSucceeded && !publishOnly) || !publishAttempted) {
+    if (isVerifyOnly || (!publishAttempted&&!publicationDir)) {
       await unlink(tarball).catch(() => {});
+    } else if(releasePending){
+      console.log('Publication processing or reconciliation pending; exact tarball preserved: '+preservedTarball);
+    } else if(releaseSucceeded){
+      console.log('Verified release tarball retained for audit: '+preservedTarball);
     } else {
-      console.error('Release artifact preserved after failure: ' + tarball);
+      console.error('Release artifact preserved for reconciliation: ' + preservedTarball);
     }
   }
 }

package/scripts/r65-canonical-full.mjs

@@ -0,0 +1,45 @@
+import {createHash} from 'node:crypto';
+import {mkdirSync,readdirSync,writeFileSync} from 'node:fs';
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+
+const runId=process.argv[2]??'manual';
+if(!/^[A-Za-z0-9._-]{1,96}$/.test(runId))throw new Error('invalid run id');
+const testDir=path.join(process.cwd(),'test');
+const tests=readdirSync(testDir,{withFileTypes:true})
+  .filter(entry=>entry.isFile()&&entry.name.endsWith('.test.mjs'))
+  .map(entry=>path.join('test',entry.name))
+  .sort((a,b)=>a.localeCompare(b,'en'));
+const startedAt=new Date().toISOString();
+const run=spawnSync(process.execPath,['--test','--test-concurrency=4',...tests],{
+  cwd:process.cwd(),
+  encoding:'utf8',
+  maxBuffer:128*1024*1024,
+  windowsHide:true,
+  shell:false
+});
+const stdout=run.stdout||'',stderr=run.stderr||'';
+const evidenceDir=path.resolve(process.cwd(),'..','..','testing','0.15.42-r65','full-runs',runId);
+mkdirSync(evidenceDir,{recursive:true});
+writeFileSync(path.join(evidenceDir,'stdout.log'),stdout,'utf8');
+writeFileSync(path.join(evidenceDir,'stderr.log'),stderr,'utf8');
+const grab=(name)=>{const m=stdout.match(new RegExp('(?:ℹ|#)\\s*'+name+'\\s+(\\d+)','i'));return m?Number(m[1]):null;};
+const result={
+  schema:'deadbyte.r65-full-run.v1',
+  run_id:runId,
+  started_at_utc:startedAt,
+  finished_at_utc:new Date().toISOString(),
+  command:[process.execPath,'--test','--test-concurrency=4',...tests],
+  test_files:tests.length,
+  exit_code:run.status??null,
+  signal:run.signal??null,
+  error:run.error?String(run.error.stack||run.error):null,
+  tests:grab('tests'),pass:grab('pass'),fail:grab('fail'),skipped:grab('skipped'),
+  stdout_sha256:createHash('sha256').update(stdout).digest('hex'),
+  stderr_sha256:createHash('sha256').update(stderr).digest('hex')
+};
+writeFileSync(path.join(evidenceDir,'result.json'),JSON.stringify(result,null,2)+'\n','utf8');
+process.stdout.write(stdout);
+process.stderr.write(stderr);
+if(run.error)process.stderr.write(String(run.error.stack||run.error)+'\n');
+process.exit(run.status??1);

package/scripts/r65-focused.mjs

@@ -0,0 +1,37 @@
+import {spawnSync} from 'node:child_process';
+
+const tests=[
+  'test/r65-activation-lock.test.mjs',
+  'test/r65-activation-lock-recovery.test.mjs',
+  'test/r65-activation-orchestration.test.mjs',
+  'test/r65-activation-preflight.test.mjs',
+  'test/r65-authority-continuity-decision.test.mjs',
+  'test/r65-authority-durable-policy-binding.test.mjs',
+  'test/r65-authority-epoch-cli.test.mjs',
+  'test/r65-authority-epoch-races.test.mjs',
+  'test/r65-authority-epoch-recovery.test.mjs',
+  'test/r65-authority-epoch-store.test.mjs',
+  'test/r65-authority-grant-capture.test.mjs',
+  'test/r65-authority-observation-epoch.test.mjs',
+  'test/r65-authority-policy-envelope.test.mjs',
+  'test/r65-authority-runtime-epoch.test.mjs',
+  'test/r65-authority-runtime-policy-binding.test.mjs',
+  'test/r65-authority-restored-safe.test.mjs',
+  'test/r65-controller-authority-epoch.test.mjs',
+  'test/r65-controller-authority-epoch-live.test.mjs',
+  'test/r65-deploy-preflight.test.mjs',
+  'test/r65-epoch-native-activation-integration.test.mjs',
+  'test/r65-epoch-native-continuity-engine.test.mjs',
+  'test/r65-epoch-native-cross-plane.test.mjs',
+  'test/r65-legacy-authority-migration.test.mjs',
+  'test/r65-legacy-auto-restore-rejection.test.mjs',
+  'test/r65-parent-source-verifier.test.mjs',
+  'test/r65-release-contract.test.mjs',
+  'test/r65-transaction-precondition.test.mjs'
+];
+const run=spawnSync(process.execPath,['--test','--test-concurrency=2',...tests],{
+  cwd:process.cwd(),encoding:'utf8',maxBuffer:64*1024*1024,windowsHide:true
+});
+process.stdout.write(run.stdout||'');
+process.stderr.write(run.stderr||'');
+process.exit(run.status??1);

package/scripts/verify-r65-parent-source.mjs

@@ -0,0 +1,75 @@
+import {createHash} from 'node:crypto';
+import {lstat,readFile,realpath} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+function parseArgs(argv){
+  const out={root:null,expectedManifestSha256:null};
+  for(let i=0;i<argv.length;i++){
+    const arg=argv[i];
+    if(arg==='--root')out.root=argv[++i]??null;
+    else if(arg==='--expected-manifest-sha256')out.expectedManifestSha256=argv[++i]??null;
+    else throw new Error('unknown argument '+arg);
+  }
+  if(typeof out.root!=='string'||out.root.length<1)throw new Error('--root required');
+  if(!HEX64.test(String(out.expectedManifestSha256)))throw new Error('--expected-manifest-sha256 must be lowercase hex');
+  return out;
+}
+
+function parseManifest(text){
+  const entries=[];
+  const seen=new Set();
+  for(const raw of text.split(/\r?\n/)){
+    if(raw==='')continue;
+    const match=/^([0-9a-f]{64})  (.+)$/.exec(raw);
+    if(!match)throw new Error('manifest line invalid');
+    const rel=match[2];
+    if(rel.includes('\\')||path.posix.isAbsolute(rel)||rel==='.'||rel.split('/').includes('..')||path.posix.normalize(rel)!==rel)
+      throw new Error('manifest path invalid: '+rel);
+    if(seen.has(rel))throw new Error('manifest duplicate path: '+rel);
+    seen.add(rel);
+    entries.push({sha256:match[1],rel});
+  }
+  if(entries.length<1)throw new Error('manifest has no entries');
+  return entries;
+}
+
+export async function verifyDeclaredParentSource({root,expectedManifestSha256}){
+  const absolute=path.resolve(root);
+  const rootReal=await realpath(absolute);
+  const manifestPath=path.join(absolute,'MANIFEST.SHA256');
+  const manifestBytes=await readFile(manifestPath);
+  const actualManifestSha=sha(manifestBytes);
+  if(actualManifestSha!==expectedManifestSha256)
+    throw new Error(`manifest SHA-256 mismatch expected=${expectedManifestSha256} actual=${actualManifestSha}`);
+  const entries=parseManifest(manifestBytes.toString('utf8'));
+  for(const entry of entries){
+    const target=path.resolve(absolute,...entry.rel.split('/'));
+    const info=await lstat(target).catch(error=>{
+      if(error?.code==='ENOENT')throw new Error('listed file missing: '+entry.rel);
+      throw error;
+    });
+    if(!info.isFile()||info.isSymbolicLink())throw new Error('listed path is not a regular file: '+entry.rel);
+    const targetReal=await realpath(target);
+    const prefix=rootReal.endsWith(path.sep)?rootReal:rootReal+path.sep;
+    if(targetReal!==rootReal&&!targetReal.startsWith(prefix))throw new Error('listed path escapes root: '+entry.rel);
+    const actual=sha(await readFile(target));
+    if(actual!==entry.sha256)throw new Error(`hash mismatch ${entry.rel} expected=${entry.sha256} actual=${actual}`);
+  }
+  return Object.freeze({files:entries.length,manifest_sha256:actualManifestSha,root:rootReal});
+}
+
+const invoked=process.argv[1]&&path.resolve(process.argv[1])===path.resolve(fileURLToPath(import.meta.url));
+if(invoked){
+  try{
+    const opts=parseArgs(process.argv.slice(2));
+    const result=await verifyDeclaredParentSource(opts);
+    console.log(`R65_PARENT_SOURCE_VERIFY_OK files=${result.files} manifest_sha256=${result.manifest_sha256}`);
+  }catch(error){
+    console.error('R65_PARENT_SOURCE_VERIFY_FAIL '+String(error?.stack??error));
+    process.exitCode=1;
+  }
+}

package/src/activation-continuity-engine-r65.mjs

@@ -0,0 +1,225 @@
+import {createHash,randomBytes} from 'node:crypto';
+import {open,readFile,rm} from 'node:fs/promises';
+import path from 'node:path';
+import {canonicalJson} from './canonical-json.mjs';
+import {
+  captureStandingGrant,compareSecurityEnvelopes,createAuthorityEpochStore,deriveSecurityEnvelope
+} from './authority-continuity-r65.mjs';
+
+const PLANES=Object.freeze(['process','coding','autonomous','desktop','host']);
+const REVOKE_ORDER=Object.freeze(['host','desktop','autonomous','coding','process']);
+const RESTORE_ORDER=Object.freeze(['process','coding','autonomous','desktop','host']);
+const HEX64=/^[0-9a-f]{64}$/;
+const GRANT_PATH_FIELD=Object.freeze({
+  process:'grant_file',coding:'lease_file',autonomous:'lease_file',desktop:'grant_file',host:'arm_file'
+});
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+const plain=value=>value&&typeof value==='object'&&!Array.isArray(value);
+
+function parseJson(bytes,label){
+  try{return JSON.parse(bytes.toString('utf8'));}
+  catch{throw new Error(`${label} JSON invalid`);}
+}
+function inside(root,target){
+  const rel=path.relative(path.resolve(root),path.resolve(target));
+  return rel===''||(!rel.startsWith('..'+path.sep)&&rel!=='..'&&!path.isAbsolute(rel));
+}
+function grantPath(policy,plane,stateRoot){
+  const field=GRANT_PATH_FIELD[plane],raw=policy?.[field];
+  if(typeof raw!=='string'||!path.isAbsolute(raw))throw new Error(`${plane} grant path missing`);
+  const resolved=path.resolve(raw),runtimeRoot=path.join(path.resolve(stateRoot),'runtime');
+  if(!inside(runtimeRoot,resolved))throw new Error(`${plane} grant path escapes runtime state`);
+  return resolved;
+}
+async function readOptional(file){
+  try{return await readFile(file);}catch(error){if(error?.code==='ENOENT')return null;throw error;}
+}
+async function writeExclusive(file,bytes){
+  const handle=await open(file,'wx',0o600);
+  try{await handle.writeFile(bytes);await handle.sync();}
+  finally{await handle.close();}
+}
+async function removeIfExact(file,expectedSha256){
+  const current=await readOptional(file);
+  if(current===null)return {removed:false,reason:'absent'};
+  if(sha(current)!==expectedSha256)return {removed:false,reason:'replacement'};
+  await rm(file,{force:true});
+  return {removed:true,reason:'matched'};
+}
+function validateCapture(capture){
+  if(!plain(capture)||typeof capture.update_id!=='string'||!Array.isArray(capture.planes)||!plain(capture.records))throw new Error('authority continuity capture invalid');
+  for(const plane of capture.planes)if(!PLANES.includes(plane)||!capture.records[plane])throw new Error('authority continuity capture plane invalid');
+}
+function scopePermitted(plane,scope,policy){
+  if(plane==='process')return Array.isArray(scope.root_ids)&&Array.isArray(scope.profile_ids)&&
+    scope.root_ids.every(id=>Object.hasOwn(policy.roots??{},id))&&
+    scope.profile_ids.every(id=>Object.hasOwn(policy.profiles??{},id)&&
+      Array.isArray(policy.profiles[id]?.root_ids)&&policy.profiles[id].root_ids.every(rootId=>scope.root_ids.includes(rootId)));
+  if(plane==='coding')return Array.isArray(scope.root_ids)&&scope.root_ids.every(id=>Object.hasOwn(policy.roots??{},id));
+  if(plane==='autonomous')return Array.isArray(scope.root_ids)&&scope.root_ids.every(id=>(policy.root_ids??[]).includes(id));
+  if(plane==='desktop')return Array.isArray(scope.action_kinds)&&scope.action_kinds.every(id=>(policy.allowed_actions??[]).includes(id));
+  return plane==='host';
+}
+function buildSuccessorGrant({plane,record,successorPolicyBytes,successorPolicy}){
+  const policySha256=sha(successorPolicyBytes),instanceNonce=randomBytes(32).toString('hex'),grantedAt=new Date().toISOString();
+  let grant;
+  if(plane==='process')grant={schema:record.grant_schema,policy_sha256:policySha256,instance_nonce:instanceNonce,
+    profile_ids:[...record.granted_scope.profile_ids],root_ids:[...record.granted_scope.root_ids],granted_at_utc:grantedAt};
+  else if(plane==='coding')grant={schema:record.grant_schema,policy_sha256:policySha256,instance_nonce:instanceNonce,
+    root_ids:[...record.granted_scope.root_ids],granted_at_utc:grantedAt};
+  else if(plane==='autonomous')grant={schema:record.grant_schema,policy_sha256:policySha256,
+    coding_policy_sha256:successorPolicy.coding_policy_sha256,instance_nonce:instanceNonce,
+    root_ids:[...record.granted_scope.root_ids],granted_at_utc:grantedAt};
+  else if(plane==='desktop')grant={schema:record.grant_schema,policy_sha256:policySha256,instance_nonce:instanceNonce,
+    action_kinds:[...record.granted_scope.action_kinds],granted_at_utc:grantedAt};
+  else if(plane==='host')grant={schema:record.grant_schema,policy_sha256:policySha256,instance_nonce:instanceNonce,granted_at_utc:grantedAt};
+  else throw new Error('authority continuity plane invalid');
+  return {grant,bytes:Buffer.from(canonicalJson(grant),'utf8'),instanceNonce};
+}
+function classifyConflict(head,record,updateId){
+  if(!head)return 'REAUTH_REQUIRED';
+  if(head.action==='user_revoke')return 'REVOKED_DURING_UPDATE';
+  if((head.action==='grant'||head.action==='transaction_restore')&&
+      (head.grant_sha256!==record.grant_sha256||head.grant_instance_nonce!==record.grant_instance_nonce))return 'REPLACED';
+  if(head.action==='transaction_revoke'&&head.update_id===updateId&&
+      head.grant_sha256===record.grant_sha256&&head.grant_instance_nonce===record.grant_instance_nonce)return null;
+  return 'REAUTH_REQUIRED';
+}
+
+export function createEpochNativeContinuityEngine({stateRoot,predecessorPolicyPaths,successorPolicyPaths,updateId}={}){
+  const state=path.resolve(String(stateRoot??''));
+  if(!stateRoot||!plain(predecessorPolicyPaths)||typeof successorPolicyPaths!=='function'||
+      typeof updateId!=='string'||!/^[A-Za-z0-9._-]{1,96}$/.test(updateId))
+    throw new Error('authority continuity engine configuration invalid');
+
+  return Object.freeze({
+    async capture({observation,subject_sha256,pointer,expectedParent,candidate,expectedCandidate}){
+      if(!HEX64.test(String(subject_sha256))||!plain(observation?.authority))throw new Error('authority continuity capture subject invalid');
+      if(expectedParent?.release_id!==pointer?.release_id||expectedParent?.generation_manifest_sha256!==pointer?.generation_manifest_sha256||
+          expectedCandidate?.version!==candidate?.version||expectedCandidate?.manifest_sha256!==candidate?.manifest_sha256)
+        throw new Error('authority continuity lineage mismatch');
+      const records={},planes=[];
+      for(const plane of PLANES){
+        const authority=observation.authority[plane];
+        if(!authority?.armed)continue;
+        if(!Number.isSafeInteger(authority.epoch_seq)||authority.epoch_seq<1||!HEX64.test(String(authority.epoch_sha256)))
+          throw new Error(`${plane} standing authority is legacy or epoch identity is incomplete`);
+        const policyPath=predecessorPolicyPaths[plane];
+        if(typeof policyPath!=='string'||!path.isAbsolute(policyPath))throw new Error(`${plane} predecessor policy path unavailable`);
+        const policyBytes=await readFile(policyPath),policy=parseJson(policyBytes,`${plane} predecessor policy`);
+        const file=grantPath(policy,plane,state),grantBytes=await readFile(file),grant=parseJson(grantBytes,`${plane} predecessor grant`);
+        const store=createAuthorityEpochStore({runtimeDir:path.dirname(file),policyBytes});
+        const verified=await store.verifyGrant({plane,grantBytes,grantInstanceNonce:grant.instance_nonce,policyBytes});
+        const head=await store.readHead({plane});
+        if(!verified.trusted||!head||head.action!=='grant'&&head.action!=='transaction_restore'||
+            head.seq!==authority.epoch_seq||head.event_sha256!==authority.epoch_sha256)
+          throw new Error(`${plane} observed standing authority does not match durable epoch`);
+        const record=captureStandingGrant({plane,policyBytes,grantBytes,predecessor:expectedParent,candidate:expectedCandidate,updateId});
+        records[plane]=Object.freeze({record,policy_path:policyPath,grant_file:file,prior_policy_bytes:policyBytes,
+          prior_grant_bytes:grantBytes,captured_head:Object.freeze({...head})});
+        planes.push(plane);
+      }
+      if(planes.length===0)throw new Error('epoch-native continuity capture has no armed planes');
+      return Object.freeze({schema:'deadbyte.activation-authority-capture.r65.v1',update_id:updateId,subject_sha256,
+        planes:Object.freeze(planes),records:Object.freeze(records)});
+    },
+
+    async revoke(capture){
+      validateCapture(capture);
+      const outcomes={};
+      for(const plane of REVOKE_ORDER){
+        const item=capture.records[plane];
+        if(!item)continue;
+        const {record,prior_policy_bytes:policyBytes,prior_grant_bytes:grantBytes,grant_file:file,captured_head:capturedHead}=item;
+        const store=createAuthorityEpochStore({runtimeDir:path.dirname(file),policyBytes});
+        const current=await store.readHead({plane});
+        if(!current||current.event_sha256!==capturedHead.event_sha256||current.seq!==capturedHead.seq)
+          throw new Error(`${plane} authority changed before transaction revoke`);
+        const revoked=await store.append({plane,action:'transaction_revoke',grantBytes,
+          grantInstanceNonce:record.grant_instance_nonce,updateId:capture.update_id,expectedHeadSha256:capturedHead.event_sha256});
+        let observed=await store.readHead({plane});
+        if(!observed||observed.event_sha256!==revoked.event_sha256)
+          throw new Error(`${plane} authority changed during transaction revoke`);
+        const sentinel=await readOptional(file);
+        if(sentinel===null)throw new Error(`${plane} grant disappeared during transaction revoke`);
+        if(sha(sentinel)!==record.grant_sha256)throw new Error(`${plane} replacement grant appeared during transaction revoke`);
+        observed=await store.readHead({plane});
+        if(!observed||observed.event_sha256!==revoked.event_sha256){
+          const conflict=classifyConflict(observed,record,capture.update_id);
+          throw new Error(`${plane} authority changed after transaction revoke: ${conflict??'unknown'}`);
+        }
+        const verification=await store.verifyGrant({plane,grantBytes,grantInstanceNonce:record.grant_instance_nonce,policyBytes});
+        if(verification.trusted)throw new Error(`${plane} remained trusted after transaction revoke`);
+        outcomes[plane]='TRANSACTION_REVOKED';
+      }
+      return Object.freeze(outcomes);
+    },
+
+    async restore({capture,successor_observation,activation,candidate,expectedCandidate,subject_sha256}){
+      validateCapture(capture);
+      if(capture.subject_sha256!==subject_sha256||expectedCandidate?.version!==candidate?.version||
+          expectedCandidate?.manifest_sha256!==candidate?.manifest_sha256||activation?.verified!==true)
+        throw new Error('authority continuity restore subject invalid');
+      const paths=await successorPolicyPaths();
+      if(!plain(paths))throw new Error('successor authority policy paths unavailable');
+      const outcomes=Object.fromEntries(PLANES.map(plane=>[plane,capture.records[plane]?'REAUTH_REQUIRED':'NOT_APPLICABLE']));
+      const reauth=[],restoredNonces={};
+      let codingRestored=!capture.records.coding;
+      for(const plane of RESTORE_ORDER){
+        const item=capture.records[plane];
+        if(!item)continue;
+        const {record,prior_policy_bytes:priorPolicyBytes,prior_grant_bytes:priorGrantBytes,grant_file:file}=item;
+        if(plane==='autonomous'&&!codingRestored){outcomes[plane]='REAUTH_REQUIRED';reauth.push(plane);continue;}
+        const policyPath=paths[plane];
+        if(typeof policyPath!=='string'||!path.isAbsolute(policyPath)){outcomes[plane]='REAUTH_REQUIRED';reauth.push(plane);continue;}
+        let successorPolicyBytes,successorPolicy,priorPolicy;
+        try{
+          successorPolicyBytes=await readFile(policyPath);
+          successorPolicy=parseJson(successorPolicyBytes,`${plane} successor policy`);
+          priorPolicy=parseJson(priorPolicyBytes,`${plane} predecessor policy`);
+        }catch{outcomes[plane]='REAUTH_REQUIRED';reauth.push(plane);continue;}
+        const priorEnvelope=deriveSecurityEnvelope(plane,priorPolicy),successorEnvelope=deriveSecurityEnvelope(plane,successorPolicy);
+        const relation=compareSecurityEnvelopes(plane,priorEnvelope,successorEnvelope).relation;
+        if(relation==='WIDER'){outcomes[plane]='POLICY_WIDENED';reauth.push(plane);continue;}
+        if(relation==='UNVERIFIED'||!scopePermitted(plane,record.granted_scope,successorPolicy)){
+          outcomes[plane]='REAUTH_REQUIRED';reauth.push(plane);continue;
+        }
+        const successorGrantPath=grantPath(successorPolicy,plane,state);
+        if(successorGrantPath!==file){outcomes[plane]='REAUTH_REQUIRED';reauth.push(plane);continue;}
+        const store=createAuthorityEpochStore({runtimeDir:path.dirname(file),policyBytes:successorPolicyBytes});
+        const head=await store.readHead({plane}),conflict=classifyConflict(head,record,capture.update_id);
+        if(conflict){
+          if(conflict==='REVOKED_DURING_UPDATE')await removeIfExact(file,record.grant_sha256).catch(()=>{});
+          outcomes[plane]=conflict;reauth.push(plane);continue;
+        }
+        const existing=await readOptional(file);
+        if(existing===null){outcomes[plane]='REVOKED_DURING_UPDATE';reauth.push(plane);continue;}
+        if(sha(existing)!==record.grant_sha256){outcomes[plane]='REPLACED';reauth.push(plane);continue;}
+        await rm(file,{force:true});
+        const prepared=buildSuccessorGrant({plane,record,successorPolicyBytes,successorPolicy});
+        try{await writeExclusive(file,prepared.bytes);}
+        catch(error){if(error?.code==='EEXIST'){outcomes[plane]='REPLACED';reauth.push(plane);continue;}throw error;}
+        try{
+          const restoreBinding={prior_grant_sha256:record.grant_sha256,prior_grant_instance_nonce:record.grant_instance_nonce,
+            predecessor_policy_envelope_sha256:record.prior_policy_envelope_sha256,successor_policy_envelope_sha256:successorEnvelope.sha256,
+            candidate_manifest_sha256:expectedCandidate.manifest_sha256,continuity_subject_sha256:capture.subject_sha256};
+          const restored=await store.append({plane,action:'transaction_restore',grantBytes:prepared.bytes,
+            grantInstanceNonce:prepared.instanceNonce,updateId:capture.update_id,expectedHeadSha256:head.event_sha256,restoreBinding});
+          const verified=await store.verifyGrant({plane,grantBytes:prepared.bytes,grantInstanceNonce:prepared.instanceNonce,policyBytes:successorPolicyBytes});
+          if(!verified.trusted||verified.event_sha256!==restored.event_sha256)throw new Error(`${plane} restored grant did not verify`);
+          outcomes[plane]=relation==='NARROWER'?'RESTORED_SAFE':'RESTORED_EXACT';restoredNonces[plane]=prepared.instanceNonce;
+          if(plane==='coding')codingRestored=true;
+        }catch(error){
+          const current=await store.readHead({plane}).catch(()=>null);
+          const currentConflict=classifyConflict(current,record,capture.update_id);
+          const cleanup=await removeIfExact(file,sha(prepared.bytes)).catch(()=>({reason:'cleanup-failed'}));
+          if(currentConflict){outcomes[plane]=currentConflict;reauth.push(plane);continue;}
+          if(cleanup.reason==='replacement'){outcomes[plane]='REPLACED';reauth.push(plane);continue;}
+          throw error;
+        }
+      }
+      return Object.freeze({authority_outcomes:Object.freeze(outcomes),restored_nonces:Object.freeze(restoredNonces),
+        reauth_planes:Object.freeze([...new Set(reauth)])});
+    }
+  });
+}