deadbyte-mcp 0.15.41 → 0.15.43

package/scripts/gate-windows-r66-prepublish.ps1

@@ -0,0 +1,65 @@
+param(
+  [ValidateSet('all','preflight','focused','full','manifest','doctor')]
+  [string]$Stage='all'
+)
+
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version 3.0
+$root=Split-Path $PSScriptRoot -Parent
+Set-Location -LiteralPath $root
+
+function Invoke-Npm([string]$Name,[string[]]$NpmArgs){
+  Write-Host "==== $Name ===="
+  & npm.cmd @NpmArgs
+  if($LASTEXITCODE -ne 0){ throw "R66 prepublish gate failed at $Name exit=$LASTEXITCODE" }
+}
+
+function Get-FileSha256([string]$File){
+  $hasher=[Security.Cryptography.SHA256]::Create()
+  try{
+    $bytes=[IO.File]::ReadAllBytes($File)
+    return (($hasher.ComputeHash($bytes) | ForEach-Object { $_.ToString('x2') }) -join '')
+  }finally{ $hasher.Dispose() }
+}
+
+$sourceRoot='D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.42-r65'
+$sourceManifest='1b4754103dd4ca43eb81f8e33cf188b36eee3051cb182396ccc6abe2a6e6c250'
+if(-not (Test-Path -LiteralPath $sourceRoot -PathType Container)){ throw 'R66 source predecessor missing' }
+$observedSourceManifest=Get-FileSha256 (Join-Path $sourceRoot 'MANIFEST.SHA256')
+if($observedSourceManifest -ne $sourceManifest){ throw 'R66 source predecessor manifest identity mismatch' }
+& node (Join-Path $root 'scripts\verify-r65-parent-source.mjs') --root $sourceRoot --expected-manifest-sha256 $sourceManifest
+if($LASTEXITCODE -ne 0){ throw 'R66 source predecessor declared-manifest verification failed' }
+
+$stateRoot=Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$pointer=Join-Path $stateRoot 'active-release.json'
+if(-not (Test-Path -LiteralPath $pointer -PathType Leaf)){ throw "R66 runtime predecessor pointer missing: $pointer" }
+$active=Get-Content -LiteralPath $pointer -Raw | ConvertFrom-Json
+if($active.release_id -ne 'v0.15.42-1b4754103dd4ca43'){ throw "R66 runtime predecessor release mismatch: $($active.release_id)" }
+if($active.manifest_sha256 -ne $sourceManifest){ throw 'R66 runtime predecessor manifest mismatch' }
+if($active.generation_manifest_sha256 -ne '62dc68be55ad627f8d872b8be8c1369ecca0edf08fdedc8336c9ccee2d2809fb'){ throw 'R66 runtime predecessor generation mismatch' }
+if($Stage -eq 'preflight'){Write-Host '==== R66 WINDOWS GATE: PASS preflight ====';return}
+
+if($Stage -eq 'all' -or $Stage -eq 'focused'){
+  Invoke-Npm 'r66-focused' @('run','r66:focused:test')
+  if($Stage -eq 'focused'){Write-Host '==== R66 WINDOWS GATE: PASS focused ====';return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'full'){
+  Invoke-Npm 'full-regression' @('test')
+  if($Stage -eq 'full'){Write-Host '==== R66 WINDOWS GATE: PASS full ====';return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'manifest'){
+  Invoke-Npm 'manifest-write' @('run','manifest:write')
+  Invoke-Npm 'manifest-verify' @('run','manifest:verify')
+  if($Stage -eq 'manifest'){Write-Host '==== R66 WINDOWS GATE: PASS manifest ====';return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'doctor'){
+  $doctorRoot='D:\Projects\deadbyte-mcp\testing\0.15.43-r66\doctor-isolated-empty'
+  if(Test-Path -LiteralPath (Join-Path $doctorRoot 'active-release.json')){ throw 'R66 isolated doctor root unexpectedly contains a release pointer' }
+  $priorStateRoot=$env:DEADBYTE_STATE_ROOT
+  try{
+    $env:DEADBYTE_STATE_ROOT=$doctorRoot
+    Invoke-Npm 'doctor-isolated-empty-state' @('run','doctor')
+  }finally{ $env:DEADBYTE_STATE_ROOT=$priorStateRoot }
+  if($Stage -eq 'doctor'){Write-Host '==== R66 WINDOWS GATE: PASS doctor ====';return}
+}
+Write-Host '==== R66 PREPUBLISH WINDOWS GATE: PASS ===='

package/scripts/npm-publication-r65.mjs

@@ -0,0 +1,139 @@
+import {createHash, randomBytes} from 'node:crypto';
+import {mkdir, open, readFile, readdir, link, unlink} from 'node:fs/promises';
+import path from 'node:path';
+import {performance} from 'node:perf_hooks';
+import {verifyPublishedTarballIdentity} from './npm-artifact-identity-r61.mjs';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const digest=bytes=>createHash('sha256').update(bytes).digest('hex');
+const pause=ms=>new Promise(resolve=>setTimeout(resolve,ms));
+
+async function writeExclusive(file,value){
+  const handle=await open(file,'wx',0o600);
+  try{await handle.writeFile(JSON.stringify(value)+'\n');await handle.sync();}
+  finally{await handle.close();}
+}
+
+async function publishClaim(file,value){
+  const temporary=`${file}.private-${process.pid}-${randomBytes(8).toString('hex')}`;
+  try{
+    await writeExclusive(temporary,value);
+    await link(temporary,file); // Atomic, no-clobber visibility of complete bytes.
+  }finally{
+    await unlink(temporary).catch(error=>{if(error?.code!=='ENOENT')throw error;});
+  }
+}
+
+async function readClaim(file){
+  try{return JSON.parse(await readFile(file,'utf8'));}
+  catch(error){
+    if(error?.code==='ENOENT')return null;
+    if(error instanceof SyntaxError)return {incomplete:true};
+    throw error;
+  }
+}
+
+async function event(recordPath,state,detail={}){
+  const file=path.join(recordPath,`event-${Date.now()}-${randomBytes(8).toString('hex')}.json`);
+  await writeExclusive(file,{schema:'deadbyte.npm-publication-event.r65.v1',state,at_utc:new Date().toISOString(),...detail});
+}
+
+async function priorState(recordPath){
+  const names=(await readdir(recordPath)).filter(name=>/^event-\d+-[0-9a-f]{16}\.json$/.test(name));
+  if(names.length>1024)throw new Error('npm publication evidence event budget exceeded');
+  const states=[];
+  for(const name of names){
+    const value=JSON.parse(await readFile(path.join(recordPath,name),'utf8'));
+    if(value.schema!=='deadbyte.npm-publication-event.r65.v1')throw new Error('npm publication event schema invalid');
+    states.push(value);
+  }
+  return states;
+}
+
+function result(state,extra={}){return Object.freeze({state,...extra});}
+
+// The no-clobber claim is the dispatch fence: once it exists, no invocation may
+// submit the same immutable npm version again, even if the first process dies.
+export async function reconcileNpmPublication({recordPath,version,manifestSha256,localBytes,publish,lookup,tags,fetchTarball,
+  timeoutMs=180000,pollMs=1500,sleep=pause,now=()=>performance.now()}){
+  if(!path.isAbsolute(recordPath)||!/^\d+\.\d+\.\d+$/.test(version)||!HEX64.test(String(manifestSha256))||!Buffer.isBuffer(localBytes)||
+    !Number.isSafeInteger(timeoutMs)||timeoutMs<0||timeoutMs>900000||!Number.isSafeInteger(pollMs)||pollMs<1||pollMs>30000||
+    [publish,lookup,tags,fetchTarball,sleep,now].some(fn=>typeof fn!=='function'))throw new Error('npm publication reconciliation inputs invalid');
+  const tarballSha256=digest(localBytes);
+  if(!HEX64.test(tarballSha256))throw new Error('npm tarball digest invalid');
+  await mkdir(recordPath,{recursive:true});
+  const claimFile=path.join(recordPath,'claim.json');
+  let claim=await readClaim(claimFile);
+  if(claim?.incomplete)return result('OUTCOME_UNKNOWN',{reason:'publication claim incomplete; manual reconciliation required'});
+  if(claim&&(claim.schema!=='deadbyte.npm-publication-claim.r65.v1'||claim.version!==version||claim.manifest_sha256!==manifestSha256||claim.tarball_sha256!==tarballSha256))
+    return result('REGISTRY_REJECTED',{reason:'local artifact differs from existing immutable publication claim'});
+
+  const observe=async()=>{
+    let published;
+    try{published=await lookup();}
+    catch(error){if(error?.code==='E404'||error?.status===404)return null;throw error;}
+    if(!published)return null;
+    let registryBytes;
+    try{registryBytes=await fetchTarball(published);}
+    catch(error){if(error?.status===404||error?.code==='E404')throw Object.assign(new Error('registry tarball is still processing'),{code:'REGISTRY_PROCESSING'});throw error;}
+    const distTags=await tags();
+    const identity=verifyPublishedTarballIdentity({version,localBytes,registryBytes,published,tags:distTags});
+    return {identity,registry:{version:published.version,integrity:published.dist?.integrity,shasum:published.dist?.shasum,
+      tarball:published.dist?.tarball,latest:distTags.latest}};
+  };
+  const check=async()=>{
+    try{const evidence=await observe();return evidence?result('REGISTRY_IDENTITY_VERIFIED',evidence):null;}
+    catch(error){
+      if(error?.code==='REGISTRY_PROCESSING')return result('REGISTRY_PROCESSING');
+      if(/metadata does not match|bytes differ|latest tag mismatch/.test(String(error?.message)))return result('REGISTRY_REJECTED',{reason:String(error.message)});
+      return result('OUTCOME_UNKNOWN',{reason:String(error?.code??error?.message??error)});
+    }
+  };
+
+  let observed=await check();
+  if(observed?.state==='REGISTRY_IDENTITY_VERIFIED'||observed?.state==='REGISTRY_REJECTED'){
+    if(claim)await event(recordPath,observed.state,{tarball_sha256:tarballSha256,registry:observed.registry??null});
+    return observed;
+  }
+  if(!claim){
+    if(observed)return observed; // Registry outage: do not submit while identity is unknown.
+    let created=false;
+    try{
+      await publishClaim(claimFile,{schema:'deadbyte.npm-publication-claim.r65.v1',version,manifest_sha256:manifestSha256,tarball_sha256:tarballSha256,created_at_utc:new Date().toISOString()});
+      claim={version,manifest_sha256:manifestSha256,tarball_sha256:tarballSha256};created=true;
+    }catch(error){
+      if(error?.code!=='EEXIST')throw error;
+      claim=await readClaim(claimFile);
+      if(claim?.incomplete||!claim)return result('OUTCOME_UNKNOWN',{reason:'concurrent publication claim unavailable or incomplete'});
+      if(claim.version!==version||claim.manifest_sha256!==manifestSha256||claim.tarball_sha256!==tarballSha256)return result('REGISTRY_REJECTED',{reason:'concurrent publication claim differs'});
+    }
+    // Only the creator of the claim may dispatch publish.
+    if(created){
+      await event(recordPath,'SUBMISSION_STARTED',{tarball_sha256:tarballSha256});
+      try{
+        await publish();
+        await event(recordPath,'SUBMISSION_ACCEPTED',{tarball_sha256:tarballSha256});
+      }catch(error){
+        const auth=/E401|E403|EOTP|authentication|one-time password|2FA/i.test(String(error?.code??'')+' '+String(error?.message??''));
+        await event(recordPath,auth?'AUTH_REQUIRED':'OUTCOME_UNKNOWN',{error_code:String(error?.code??'UNKNOWN').slice(0,64)});
+        return result(auth?'AUTH_REQUIRED':'OUTCOME_UNKNOWN',{reason:String(error?.code??error?.message??error)});
+      }
+    }
+  }
+  const states=await priorState(recordPath);
+  if(states.some(item=>item.state==='AUTH_REQUIRED'))return result('AUTH_REQUIRED');
+  const accepted=states.some(item=>item.state==='SUBMISSION_ACCEPTED');
+  const started=now();
+  do{
+    observed=await check();
+    if(observed?.state==='REGISTRY_IDENTITY_VERIFIED'||observed?.state==='REGISTRY_REJECTED'){
+      await event(recordPath,observed.state,{tarball_sha256:tarballSha256,registry:observed.registry??null});return observed;
+    }
+    if(observed?.state==='OUTCOME_UNKNOWN')return observed;
+    const remaining=timeoutMs-(now()-started);
+    if(remaining<=0)break;
+    await sleep(Math.min(pollMs,remaining));
+  }while(true);
+  await event(recordPath,accepted?'REGISTRY_PROCESSING':'OUTCOME_UNKNOWN',{tarball_sha256:tarballSha256});
+  return result(accepted?'REGISTRY_PROCESSING':'OUTCOME_UNKNOWN');
+}

package/scripts/npm-release-r48.mjs

@@ -1,7 +1,9 @@
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { verifyPublishedTarballIdentity } from './npm-artifact-identity-r61.mjs';
-import { mkdtemp, readFile, rm, unlink } from 'node:fs/promises';
+import { reconcileNpmPublication } from './npm-publication-r65.mjs';
+import { mkdtemp, readFile, rm, unlink, mkdir, rename } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { resolveStateRoot } from '../src/state-root.mjs';
 import path from 'node:path';
 import os from 'node:os';
 import { fileURLToPath } from 'node:url';
@@ -11,7 +13,7 @@ const node = process.execPath;
 const npmCli = process.env.npm_execpath || path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js');
 
 function run(command, args, options = {}) {
-  const { cwd = root, timeout = 180000 } = options;
+  const { cwd = root, timeout = 180000, env=process.env } = options;
   const r = spawnSync(command, args, {
     cwd,
     encoding: 'utf8',
@@ -19,6 +21,7 @@ function run(command, args, options = {}) {
     stdio: ['ignore', 'pipe', 'pipe'],
     shell: false,
     windowsHide: true,
+    env,
   });
   if (r.error) throw r.error;
   if (r.status !== 0) {
@@ -95,30 +98,34 @@ async function main() {
   const existingText = (existing.stdout || '').trim();
   const isAlreadyPublished = existing.status === 0 && existingText && existingText !== 'null';
 
-  if (isAlreadyPublished) {
-    if (!isVerifyOnly) {
-      throw new Error(`deadbyte-mcp@${version} is already published on registry: ${existingText}`);
-    } else {
-      console.log(`Notice: deadbyte-mcp@${version} is already published on registry (${existingText}), proceeding with pre-publish verification only.`);
-    }
-  }
+  if (isAlreadyPublished) console.log(`Notice: deadbyte-mcp@${version} exists on registry (${existingText}); exact-byte reconciliation is required.`);
 
   console.log('[2/7] Pre-pack gates: verifying working tree manifest and doctor...');
   run(node, [path.join(root, 'scripts', 'release-manifest.mjs'), 'verify']);
-  run(node, [path.join(root, 'src', 'deadbyte-cli.mjs'), 'doctor']);
+  const doctorState=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r65-release-doctor-'));
+  try{run(node,[path.join(root,'src','deadbyte-cli.mjs'),'doctor'],{env:{...process.env,DEADBYTE_STATE_ROOT:doctorState}});}
+  finally{await rm(doctorState,{recursive:true,force:true});}
 
   console.log('[3/7] Packing artifact with npm pack...');
-  const packed = parseJson(runNpm(['pack', '--json'], { timeout: 180000 }));
-  const packRecord = Array.isArray(packed) ? packed[0] : packed?.[pkg.name];
+  const publicationDir=isVerifyOnly?null:path.join(resolveStateRoot(),'evidence','npm-publication',version);
+  const preservedTarball=publicationDir?path.join(publicationDir,`deadbyte-mcp-${version}.tgz`):null;
+  const resuming=Boolean(preservedTarball&&existsSync(path.join(publicationDir,'claim.json')));
+  if(publicationDir)await mkdir(publicationDir,{recursive:true});
+  if(resuming&&!existsSync(preservedTarball))throw new Error('immutable npm publication claim exists but exact local tarball is missing; manual artifact reconciliation required');
+  if(!resuming&&preservedTarball&&existsSync(preservedTarball))throw new Error('unclaimed preserved npm tarball exists; inspect artifact evidence before another pack');
+  const packed=resuming?null:parseJson(runNpm(['pack', '--json'], { timeout: 180000 }));
+  const packRecord=resuming?{filename:path.basename(preservedTarball)}:(Array.isArray(packed) ? packed[0] : packed?.[pkg.name]);
   const filename = packRecord?.filename;
   if (!filename) throw new Error('npm pack did not return a tarball filename');
-  const tarball = path.join(root, filename);
+  const tarball = resuming?preservedTarball:path.join(root, filename);
   let releaseSucceeded = false;
   let publishAttempted = false;
+  let releasePending = false;
 
   try {
     console.log('[4/7] Verifying packed artifact file surface against MANIFEST.SHA256 and packaging contract...');
     const manifestText = await readFile(path.join(root, 'MANIFEST.SHA256'), 'utf8');
+    const manifestSha256=createHash('sha256').update(manifestText).digest('hex');
     const manifestEntries = new Set();
     for (const line of manifestText.split(/\r?\n/)) {
       if (!line) continue;
@@ -169,7 +176,7 @@ async function main() {
       }
 
       run(node, [path.join(extractedPackage, 'src', 'deadbyte-cli.mjs'), 'doctor'], {
-        cwd: extractedPackage,
+        cwd: extractedPackage,env:{...process.env,DEADBYTE_STATE_ROOT:path.join(sandbox,'state')},
       });
 
       console.log('Artifact isolation gate PASS (clean doctor and version check on unpacked tarball in sandbox)');
@@ -189,30 +196,37 @@ async function main() {
       return;
     }
 
-    const localBytes = await readFile(tarball);
+    if(!resuming)await rename(tarball,preservedTarball);
+    const publishTarball=preservedTarball;
+    const localBytes = await readFile(publishTarball);
+    const localIntegrity=`sha512-${createHash('sha512').update(localBytes).digest('base64')}`;
+    if(packRecord.integrity&&packRecord.integrity!==localIntegrity)throw new Error('npm packed artifact integrity changed before publication');
 
     console.log('[6/7] Publishing artifact to npm registry...');
     publishAttempted = true;
-    let publishOut;
-    try {
-      publishOut = runNpmInteractive(['publish', tarball, '--access', 'public', '--auth-type=web'], { timeout: 300000 });
-    } catch (publishError) {
-      const detail = String(publishError?.message || publishError);
-      if (/EOTP|one-time password|two-factor|2FA|security.?key|authentication/i.test(detail)) {
-        console.error('Publish requires interactive npm authentication (Security Key/WebAuthn).');
-        console.error('Tarball preserved for retry: ' + tarball);
-      }
-      throw publishError;
+    const reconciliation=await reconcileNpmPublication({recordPath:publicationDir,version,manifestSha256,localBytes,
+      publish:async()=>runNpmInteractive(['publish',publishTarball,'--access','public','--auth-type=web'],{timeout:300000}),
+      lookup:async()=>{
+        try{
+          const viewed=parseJson(runNpm(['view',`deadbyte-mcp@${version}`,'version','dist.integrity','dist.shasum','dist.tarball','--json'],{timeout:120000}));
+          return Array.isArray(viewed)?viewed[0]:viewed;
+        }catch(error){if(/E404|404 Not Found/.test(String(error?.message)))return null;throw error;}
+      },
+      tags:async()=>parseJson(runNpm(['view','deadbyte-mcp','dist-tags','--json'],{timeout:120000})),
+      fetchTarball:async published=>{
+        const response=await fetch(published?.dist?.tarball,{signal:AbortSignal.timeout(120000)});
+        if(!response.ok)throw Object.assign(new Error(`registry tarball fetch failed status=${response.status}`),{status:response.status});
+        return Buffer.from(await response.arrayBuffer());
+      }});
+    if(reconciliation.state!=='REGISTRY_IDENTITY_VERIFIED'){
+      console.log('RELEASE_PENDING '+JSON.stringify({state:reconciliation.state,version,tarball:publishTarball,record_path:publicationDir,reason:reconciliation.reason??null}));
+      releasePending=true;
+      process.exitCode=2;return;
     }
-    const viewed = parseJson(runNpm(['view', `deadbyte-mcp@${version}`, 'version', 'dist.integrity', 'dist.shasum', 'dist.tarball', '--json'], { timeout: 120000 }));
-    const published = Array.isArray(viewed) ? viewed[0] : viewed;
-    const dist = published?.dist ?? published;
-    if(typeof dist?.tarball !== 'string')throw new Error('published registry tarball URL missing');
-    const registryResponse = await fetch(dist.tarball,{signal:AbortSignal.timeout(120000)});
-    if(!registryResponse.ok) throw new Error(`registry tarball fetch failed status=${registryResponse.status}`);
-    const registryBytes = Buffer.from(await registryResponse.arrayBuffer());
-    const tags = parseJson(runNpm(['view', 'deadbyte-mcp', 'dist-tags', '--json'], { timeout: 120000 }));
-    const identity=verifyPublishedTarballIdentity({version,localBytes,registryBytes,published,tags});
+    const identity=reconciliation.identity;
+    const published={version,dist:{integrity:identity.npm_integrity,shasum:identity.shasum}};
+    const tags={latest:version};
+    const publishOut='registry identity verified by durable reconciliation';
 
     console.log('[7/7] Post-publish external registry smoke test (executed outside repo in temp)...');
     const tempDir = os.tmpdir();
@@ -227,6 +241,7 @@ async function main() {
     const externalDoctor = runNpm(['exec', '--yes', `--package=deadbyte-mcp@${version}`, '--', 'deadbyte-mcp', 'doctor'], {
       cwd: tempDir,
       timeout: 300000,
+      env:{...process.env,DEADBYTE_STATE_ROOT:path.join(publicationDir,'external-doctor-state')},
     });
 
     if(!publishOnly){
@@ -253,10 +268,14 @@ async function main() {
     }, null, 2));
 
   } finally {
-    if ((releaseSucceeded && !publishOnly) || !publishAttempted) {
+    if (isVerifyOnly || (!publishAttempted&&!publicationDir)) {
       await unlink(tarball).catch(() => {});
+    } else if(releasePending){
+      console.log('Publication processing or reconciliation pending; exact tarball preserved: '+preservedTarball);
+    } else if(releaseSucceeded){
+      console.log('Verified release tarball retained for audit: '+preservedTarball);
     } else {
-      console.error('Release artifact preserved after failure: ' + tarball);
+      console.error('Release artifact preserved for reconciliation: ' + preservedTarball);
     }
   }
 }

package/scripts/r65-canonical-full.mjs

@@ -0,0 +1,45 @@
+import {createHash} from 'node:crypto';
+import {mkdirSync,readdirSync,writeFileSync} from 'node:fs';
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+
+const runId=process.argv[2]??'manual';
+if(!/^[A-Za-z0-9._-]{1,96}$/.test(runId))throw new Error('invalid run id');
+const testDir=path.join(process.cwd(),'test');
+const tests=readdirSync(testDir,{withFileTypes:true})
+  .filter(entry=>entry.isFile()&&entry.name.endsWith('.test.mjs'))
+  .map(entry=>path.join('test',entry.name))
+  .sort((a,b)=>a.localeCompare(b,'en'));
+const startedAt=new Date().toISOString();
+const run=spawnSync(process.execPath,['--test','--test-concurrency=4',...tests],{
+  cwd:process.cwd(),
+  encoding:'utf8',
+  maxBuffer:128*1024*1024,
+  windowsHide:true,
+  shell:false
+});
+const stdout=run.stdout||'',stderr=run.stderr||'';
+const evidenceDir=path.resolve(process.cwd(),'..','..','testing','0.15.42-r65','full-runs',runId);
+mkdirSync(evidenceDir,{recursive:true});
+writeFileSync(path.join(evidenceDir,'stdout.log'),stdout,'utf8');
+writeFileSync(path.join(evidenceDir,'stderr.log'),stderr,'utf8');
+const grab=(name)=>{const m=stdout.match(new RegExp('(?:ℹ|#)\\s*'+name+'\\s+(\\d+)','i'));return m?Number(m[1]):null;};
+const result={
+  schema:'deadbyte.r65-full-run.v1',
+  run_id:runId,
+  started_at_utc:startedAt,
+  finished_at_utc:new Date().toISOString(),
+  command:[process.execPath,'--test','--test-concurrency=4',...tests],
+  test_files:tests.length,
+  exit_code:run.status??null,
+  signal:run.signal??null,
+  error:run.error?String(run.error.stack||run.error):null,
+  tests:grab('tests'),pass:grab('pass'),fail:grab('fail'),skipped:grab('skipped'),
+  stdout_sha256:createHash('sha256').update(stdout).digest('hex'),
+  stderr_sha256:createHash('sha256').update(stderr).digest('hex')
+};
+writeFileSync(path.join(evidenceDir,'result.json'),JSON.stringify(result,null,2)+'\n','utf8');
+process.stdout.write(stdout);
+process.stderr.write(stderr);
+if(run.error)process.stderr.write(String(run.error.stack||run.error)+'\n');
+process.exit(run.status??1);

package/scripts/r65-focused.mjs

@@ -0,0 +1,37 @@
+import {spawnSync} from 'node:child_process';
+
+const tests=[
+  'test/r65-activation-lock.test.mjs',
+  'test/r65-activation-lock-recovery.test.mjs',
+  'test/r65-activation-orchestration.test.mjs',
+  'test/r65-activation-preflight.test.mjs',
+  'test/r65-authority-continuity-decision.test.mjs',
+  'test/r65-authority-durable-policy-binding.test.mjs',
+  'test/r65-authority-epoch-cli.test.mjs',
+  'test/r65-authority-epoch-races.test.mjs',
+  'test/r65-authority-epoch-recovery.test.mjs',
+  'test/r65-authority-epoch-store.test.mjs',
+  'test/r65-authority-grant-capture.test.mjs',
+  'test/r65-authority-observation-epoch.test.mjs',
+  'test/r65-authority-policy-envelope.test.mjs',
+  'test/r65-authority-runtime-epoch.test.mjs',
+  'test/r65-authority-runtime-policy-binding.test.mjs',
+  'test/r65-authority-restored-safe.test.mjs',
+  'test/r65-controller-authority-epoch.test.mjs',
+  'test/r65-controller-authority-epoch-live.test.mjs',
+  'test/r65-deploy-preflight.test.mjs',
+  'test/r65-epoch-native-activation-integration.test.mjs',
+  'test/r65-epoch-native-continuity-engine.test.mjs',
+  'test/r65-epoch-native-cross-plane.test.mjs',
+  'test/r65-legacy-authority-migration.test.mjs',
+  'test/r65-legacy-auto-restore-rejection.test.mjs',
+  'test/r65-parent-source-verifier.test.mjs',
+  'test/r65-release-contract.test.mjs',
+  'test/r65-transaction-precondition.test.mjs'
+];
+const run=spawnSync(process.execPath,['--test','--test-concurrency=2',...tests],{
+  cwd:process.cwd(),encoding:'utf8',maxBuffer:64*1024*1024,windowsHide:true
+});
+process.stdout.write(run.stdout||'');
+process.stderr.write(run.stderr||'');
+process.exit(run.status??1);

package/scripts/verify-r65-parent-source.mjs

@@ -0,0 +1,75 @@
+import {createHash} from 'node:crypto';
+import {lstat,readFile,realpath} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+const HEX64=/^[0-9a-f]{64}$/;
+const sha=bytes=>createHash('sha256').update(bytes).digest('hex');
+
+function parseArgs(argv){
+  const out={root:null,expectedManifestSha256:null};
+  for(let i=0;i<argv.length;i++){
+    const arg=argv[i];
+    if(arg==='--root')out.root=argv[++i]??null;
+    else if(arg==='--expected-manifest-sha256')out.expectedManifestSha256=argv[++i]??null;
+    else throw new Error('unknown argument '+arg);
+  }
+  if(typeof out.root!=='string'||out.root.length<1)throw new Error('--root required');
+  if(!HEX64.test(String(out.expectedManifestSha256)))throw new Error('--expected-manifest-sha256 must be lowercase hex');
+  return out;
+}
+
+function parseManifest(text){
+  const entries=[];
+  const seen=new Set();
+  for(const raw of text.split(/\r?\n/)){
+    if(raw==='')continue;
+    const match=/^([0-9a-f]{64})  (.+)$/.exec(raw);
+    if(!match)throw new Error('manifest line invalid');
+    const rel=match[2];
+    if(rel.includes('\\')||path.posix.isAbsolute(rel)||rel==='.'||rel.split('/').includes('..')||path.posix.normalize(rel)!==rel)
+      throw new Error('manifest path invalid: '+rel);
+    if(seen.has(rel))throw new Error('manifest duplicate path: '+rel);
+    seen.add(rel);
+    entries.push({sha256:match[1],rel});
+  }
+  if(entries.length<1)throw new Error('manifest has no entries');
+  return entries;
+}
+
+export async function verifyDeclaredParentSource({root,expectedManifestSha256}){
+  const absolute=path.resolve(root);
+  const rootReal=await realpath(absolute);
+  const manifestPath=path.join(absolute,'MANIFEST.SHA256');
+  const manifestBytes=await readFile(manifestPath);
+  const actualManifestSha=sha(manifestBytes);
+  if(actualManifestSha!==expectedManifestSha256)
+    throw new Error(`manifest SHA-256 mismatch expected=${expectedManifestSha256} actual=${actualManifestSha}`);
+  const entries=parseManifest(manifestBytes.toString('utf8'));
+  for(const entry of entries){
+    const target=path.resolve(absolute,...entry.rel.split('/'));
+    const info=await lstat(target).catch(error=>{
+      if(error?.code==='ENOENT')throw new Error('listed file missing: '+entry.rel);
+      throw error;
+    });
+    if(!info.isFile()||info.isSymbolicLink())throw new Error('listed path is not a regular file: '+entry.rel);
+    const targetReal=await realpath(target);
+    const prefix=rootReal.endsWith(path.sep)?rootReal:rootReal+path.sep;
+    if(targetReal!==rootReal&&!targetReal.startsWith(prefix))throw new Error('listed path escapes root: '+entry.rel);
+    const actual=sha(await readFile(target));
+    if(actual!==entry.sha256)throw new Error(`hash mismatch ${entry.rel} expected=${entry.sha256} actual=${actual}`);
+  }
+  return Object.freeze({files:entries.length,manifest_sha256:actualManifestSha,root:rootReal});
+}
+
+const invoked=process.argv[1]&&path.resolve(process.argv[1])===path.resolve(fileURLToPath(import.meta.url));
+if(invoked){
+  try{
+    const opts=parseArgs(process.argv.slice(2));
+    const result=await verifyDeclaredParentSource(opts);
+    console.log(`R65_PARENT_SOURCE_VERIFY_OK files=${result.files} manifest_sha256=${result.manifest_sha256}`);
+  }catch(error){
+    console.error('R65_PARENT_SOURCE_VERIFY_FAIL '+String(error?.stack??error));
+    process.exitCode=1;
+  }
+}