deadbyte-mcp 0.15.42 → 0.15.44

package/test/r67-npm-cross-volume.test.mjs

@@ -0,0 +1,74 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,readFile,writeFile,rm,lstat,stat,readdir,symlink} from 'node:fs/promises';
+import {tmpdir} from 'node:os';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {preserveNpmTarball,assertVacantPackDestination} from '../scripts/npm-preserve-artifact-r67.mjs';
+
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const digest=(bytes,algo='sha256')=>createHash(algo).update(bytes).digest(algo==='sha512'?'base64':'hex');
+const artifact=Buffer.concat([Buffer.from('R67 immutable npm tarball fixture\\n'),Buffer.alloc(4194305,0x5a)]);
+const integrity='sha512-'+digest(artifact,'sha512');
+
+async function fixture(fn){
+ await mkdir(path.join(root,'tmp'),{recursive:true});
+ const srcDir=await mkdtemp(path.join(root,'tmp','r67-xdev-src-'));
+ const dstDir=await mkdtemp(path.join(tmpdir(),'r67-xdev-dst-'));
+ const source=path.join(srcDir,'deadbyte-mcp-0.15.44.tgz');
+ const destination=path.join(dstDir,'deadbyte-mcp-0.15.44.tgz');
+ try{return await fn({source,destination,srcDir,dstDir});}
+ finally{await rm(srcDir,{recursive:true,force:true});await rm(dstDir,{recursive:true,force:true});}
+}
+test('R67 preserves immutable package across Windows drives without EXDEV, hash-verifies, and removes source only after successful commit',()=>fixture(async ({source,destination})=>{
+ await writeFile(source,artifact);
+ const srcDrive=(await stat(path.dirname(source))).dev,dstDrive=(await stat(path.dirname(destination))).dev;
+ if(process.platform==='win32')assert.notEqual(srcDrive,dstDrive,'Windows test must cover different volumes D and C');
+ const result=await preserveNpmTarball({source,destination,expectedIntegrity:integrity});
+ assert.equal(result.status,'VERIFIED_PRESERVED');
+ assert.equal(result.sha256,digest(artifact));
+ assert.equal(result.bytes,artifact.length);
+ assert.deepEqual(await readFile(destination),artifact);
+ await assert.rejects(()=>lstat(source),{code:'ENOENT'});
+ assert.deepEqual((await readdir(path.dirname(destination))).sort(),[path.basename(destination)]);
+}));
+test('R67 rejects incorrect npm-integrity before writing any destination and retains source',()=>fixture(async ({source,destination})=>{
+ await writeFile(source,artifact);
+ await assert.rejects(()=>preserveNpmTarball({source,destination,expectedIntegrity:'sha512-'+digest(Buffer.from('wrong'),'sha512')}),/integrity/i);
+ assert.deepEqual(await readFile(source),artifact);
+ await assert.rejects(()=>lstat(destination),{code:'ENOENT'});
+}));
+test('R67 never clobbers pre-existing different destination bytes',()=>fixture(async ({source,destination})=>{
+ await writeFile(source,artifact);await writeFile(destination,Buffer.from('other release artifact'));
+ await assert.rejects(()=>preserveNpmTarball({source,destination,expectedIntegrity:integrity}),/exists|conflict|different/i);
+ assert.deepEqual(await readFile(source),artifact);
+ assert.equal((await readFile(destination)).toString(),'other release artifact');
+}));
+test('R67 repairs post-commit/pre-cleanup crash without repeating publication and validates immutable destination',()=>fixture(async ({source,destination})=>{
+ await writeFile(source,artifact);await writeFile(destination,artifact);
+ const result=await preserveNpmTarball({source,destination,expectedIntegrity:integrity});
+ assert.equal(result.status,'VERIFIED_ALREADY_PRESERVED');
+ assert.deepEqual(await readFile(destination),artifact);
+ await assert.rejects(()=>lstat(source),{code:'ENOENT'});
+}));
+test('R67 rejects a symlink/reparse source and leaves destination absent',()=>fixture(async ({source,destination})=>{
+ await writeFile(source+'.real',artifact);
+ try{await symlink(source+'.real',source);}
+ catch(error){
+  if(process.platform!=='win32'||error?.code!=='EPERM')throw error;
+  const junctionTarget=source+'.junction-target';
+  await mkdir(junctionTarget);
+  await symlink(junctionTarget,source,'junction');
+ }
+ await assert.rejects(()=>preserveNpmTarball({source,destination,expectedIntegrity:integrity}),/symlink|regular/i);
+ await assert.rejects(()=>lstat(destination),{code:'ENOENT'});
+}));
+
+test('R67 npm pack never overwrites pre-existing unclaimed artifact after EXDEV',()=>fixture(async ({source})=>{
+ await writeFile(source,artifact);
+ await assert.rejects(()=>assertVacantPackDestination({root:path.dirname(source),filename:path.basename(source)}),/PACK_BLOCKED|preserv|exists/i);
+ assert.deepEqual(await readFile(source),artifact);
+ const fresh=await assertVacantPackDestination({root:path.dirname(source),filename:'new-artifact.tgz'});
+ assert.equal(fresh,path.join(path.dirname(source),'new-artifact.tgz'));
+}));

package/test/r67-npm-publish-gate.test.mjs

@@ -0,0 +1,38 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+import {assertR67NpmPublishReady} from '../scripts/npm-release-readiness-r67.mjs';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+test('R67 current sealed prepublish candidate satisfies the exact publish-readiness metadata gate',async()=>{
+ const release=JSON.parse(await readFile(path.join(root,'RELEASE.json'),'utf8'));
+ assert.equal(release.r67_native_observation.status,'CANDIDATE_SEALED');
+ assert.doesNotThrow(()=>assertR67NpmPublishReady(release));
+});
+test('R67 exact mandatory gate flags must all pass before candidate npm publication',()=>{
+ const seed={version:'0.15.44',train:'R67',r67_native_observation:{
+  status:'CANDIDATE_SEALED',full_release_gate:'PASS',current_source_full_shards:'PASS',
+  native_fault_injection:'PASS',protocol_parity:'PASS',isolated_activation_rollback_restore:'PASS',
+  independent_machine_observation:'PASS'}};
+ assert.doesNotThrow(()=>assertR67NpmPublishReady(seed));
+ for(const k of Object.keys(seed.r67_native_observation)){
+  const bad=structuredClone(seed);bad.r67_native_observation[k]='PENDING';
+  assert.throws(()=>assertR67NpmPublishReady(bad),/PUBLISH_BLOCKED/);
+ }
+});
+test('R67 real npm publisher must enforce publish readiness before npm pack / dispatch',async()=>{
+ const src=await readFile(path.join(root,'scripts','npm-release-r48.mjs'),'utf8');
+ const guard=src.indexOf('assertR67NpmPublishReady(release)');
+ const pack=src.indexOf("'pack', '--json'");
+ const submit=src.indexOf("'publish',publishTarball");
+ assert.ok(guard>0&&guard<pack&&guard<submit,'trusted metadata gate precedes network/npm pack and publication');
+ assert.ok(src.includes('preserveNpmTarball({source:tarball,destination:preservedTarball'));
+});
+
+test('R67 publisher checks for an existing tarball before npm pack can overwrite historical evidence',async()=>{
+ const src=await readFile(path.join(root,'scripts','npm-release-r48.mjs'),'utf8');
+ const guard=src.indexOf('await assertVacantPackDestination(');
+ const pack=src.indexOf("'pack', '--json'");
+ assert.ok(guard>0&&guard<pack,'pre-existing tarball guard must run before npm pack');
+});

package/test/r67-regression-shards.test.mjs

@@ -0,0 +1,184 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createR67ShardPlan,reconcileR67Shards,r67ShardTimeoutMs,r67RegressionTreeHash,parseR67TapSummary} from '../src/r67-regression-shards.mjs';
+import {mkdtemp,mkdir,writeFile,rm,symlink} from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+const names=Array.from({length:326},(_,i)=>'test/f-'+String(i).padStart(3,'0')+'.test.mjs');
+test('R67 deterministic shards cover 326 files exactly once and remain stable under input reordering',()=>{
+ const plan=createR67ShardPlan(names,32);
+ const other=createR67ShardPlan([...names].reverse(),32);
+ assert.deepEqual(other,plan);
+ assert.equal(plan.shards.length,32);
+ assert.deepEqual(plan.shards.flatMap(x=>x.files).sort(),names);
+ assert.equal(new Set(plan.shards.flatMap(x=>x.files)).size,326);
+ assert.match(plan.plan_sha256,/^[a-f0-9]{64}$/);
+ for(const shard of plan.shards){
+  assert.ok(shard.files.length>=10&&shard.files.length<=11);
+  assert.match(shard.files_sha256,/^[a-f0-9]{64}$/);
+ }
+});
+test('R67 verifier must BLOCK incomplete coverage, reject duplicates and never forge full PASS',()=>{
+ const plan=createR67ShardPlan(names,32);
+ const make=shard=>({shard_index:shard.index,plan_sha256:plan.plan_sha256,
+  files_sha256:shard.files_sha256,status:'PASS',exit_code:0,test_count:shard.files.length,passed:shard.files.length,failed:0});
+ const receipts=plan.shards.slice(0,31).map(make);
+ const incomplete=reconcileR67Shards(plan,receipts);
+ assert.equal(incomplete.status,'BLOCKED');
+ assert.deepEqual(incomplete.missing,[31]);
+ assert.throws(()=>reconcileR67Shards(plan,[...receipts,receipts[0]]),/duplicate/i);
+ const complete=reconcileR67Shards(plan,plan.shards.map(make));
+ assert.equal(complete.status,'PASS');
+ assert.equal(complete.file_count,326);
+ assert.equal(complete.failed,0);
+});
+test('R67 verifier fails closed for tampered test partition, nonzero exit and UNKNOWN outcomes',()=>{
+ const plan=createR67ShardPlan(names,32);
+ const good=plan.shards.map(shard=>({shard_index:shard.index,plan_sha256:plan.plan_sha256,
+  files_sha256:shard.files_sha256,status:'PASS',exit_code:0,test_count:shard.files.length,passed:shard.files.length,failed:0}));
+ const altered=structuredClone(good);altered[5].files_sha256='0'.repeat(64);
+ assert.equal(reconcileR67Shards(plan,altered).status,'FAILED');
+ const failed=structuredClone(good);failed[3].exit_code=1;failed[3].status='FAILED';failed[3].failed=1;
+ assert.equal(reconcileR67Shards(plan,failed).status,'FAILED');
+ const unknown=structuredClone(good);unknown[2].status='OUTCOME_UNKNOWN';unknown[2].exit_code=null;
+ assert.equal(reconcileR67Shards(plan,unknown).status,'OUTCOME_UNKNOWN');
+ assert.throws(()=>createR67ShardPlan([...names,names[0]],32),/duplicate/);
+});
+
+test('R67 real timed-out shard with null TAP counts remains OUTCOME_UNKNOWN, not forged FAILED',()=>{
+ const plan=createR67ShardPlan(names,32);
+ const receipts=plan.shards.map(shard=>({shard_index:shard.index,plan_sha256:plan.plan_sha256,
+  files_sha256:shard.files_sha256,status:'PASS',exit_code:0,test_count:shard.files.length,passed:shard.files.length,failed:0}));
+ receipts[5]={...receipts[5],status:'OUTCOME_UNKNOWN',exit_code:null,test_count:null,passed:null,failed:null};
+ const result=reconcileR67Shards(plan,receipts);
+ assert.equal(result.status,'OUTCOME_UNKNOWN');
+ assert.equal(result.integrity_failed,false);
+});
+
+test('R67 measured 110.4s remote and 53.2s controller integration suites get isolated bounded deadlines',()=>{
+ const remote='test/remote-session-cli.test.mjs';
+ const controller='test/r58-controller-live-local.test.mjs';
+ const input=[...names,remote,controller];
+ const first=createR67ShardPlan(input,32);
+ const repeat=createR67ShardPlan([...input].reverse(),32);
+ assert.deepEqual(repeat,first);
+ const remoteShard=first.shards.find(s=>s.files.includes(remote));
+ const controllerShard=first.shards.find(s=>s.files.includes(controller));
+ assert.deepEqual(remoteShard.files,[remote]);
+ assert.deepEqual(controllerShard.files,[controller]);
+ assert.notEqual(remoteShard.index,controllerShard.index);
+ assert.equal(r67ShardTimeoutMs(remoteShard),165000);
+ assert.equal(r67ShardTimeoutMs(controllerShard),120000);
+ assert.deepEqual(first.shards.flatMap(s=>s.files).sort(),[...input].sort());
+ for(const shard of first.shards.filter(s=>s.index!==remoteShard.index&&s.index!==controllerShard.index)){
+  assert.ok(shard.files.length>=10&&shard.files.length<=11);
+  assert.equal(r67ShardTimeoutMs(shard),58000);
+ }
+});
+
+test('R67 regression fingerprint detects implementation-only source drift even if tests are untouched',async()=>{
+ const dir=await mkdtemp(path.join(os.tmpdir(),'deadbyte-r67-fingerprint-'));
+ try{
+  await mkdir(path.join(dir,'src'));await mkdir(path.join(dir,'test'));
+  await writeFile(path.join(dir,'package.json'),'{}');
+  await writeFile(path.join(dir,'src','core.mjs'),'export const number = 1;');
+  await writeFile(path.join(dir,'test','core.test.mjs'),'test does not change');
+  const opts={roots:['src','test'],topLevel:['package.json'],extra:[]};
+  const baseline=await r67RegressionTreeHash(dir,opts);
+  assert.match(baseline.sha256,/^[a-f0-9]{64}$/);
+  assert.equal(baseline.file_count,3);
+  const same=await r67RegressionTreeHash(dir,opts);
+  assert.deepEqual(same,baseline);
+  await writeFile(path.join(dir,'src','core.mjs'),'export const number = 2;');
+  const drift=await r67RegressionTreeHash(dir,opts);
+  assert.notEqual(drift.sha256,baseline.sha256,'changing only source must invalidate receipts');
+  try{await symlink(path.join(dir,'package.json'),path.join(dir,'src','backdoor.mjs'));}
+  catch(error){
+   if(process.platform!=='win32'||error?.code!=='EPERM')throw error;
+   const junctionTarget=path.join(dir,'junction-target');
+   await mkdir(junctionTarget);
+   await symlink(junctionTarget,path.join(dir,'src','backdoor'),'junction');
+  }
+  await assert.rejects(()=>r67RegressionTreeHash(dir,opts),/symlink/i);
+ }finally{await rm(dir,{recursive:true,force:true});}
+});
+
+test('R67 terminal TAP summary enforces complete counts and rejects forged/truncated PASS',()=>{
+ const ok=['✔ fixture succeeded (1ms)','ℹ tests 5','ℹ suites 0','ℹ pass 4','ℹ fail 0','ℹ cancelled 0','ℹ skipped 1','ℹ todo 0'].join('\n');
+ const parsed=parseR67TapSummary(ok);
+ assert.deepEqual(parsed,{tests:5,pass:4,fail:0,cancelled:0,skipped:1,todo:0});
+ assert.equal(parseR67TapSummary('test does not carry terminal TAP'),null);
+ assert.equal(parseR67TapSummary(ok.replace('ℹ tests 5','ℹ tests 6')),null);
+ assert.equal(parseR67TapSummary(ok.replace('ℹ cancelled 0','ℹ cancelled 1')),null);
+ assert.equal(parseR67TapSummary(ok.replace('ℹ todo 0','ℹ todo 1')),null);
+});
+
+test('R67 v2 shard receipt rejects inconsistent skip totals and cancelled outcomes',()=>{
+ const plan=createR67ShardPlan(names,32);
+ const good=plan.shards.map(shard=>({schema:'deadbyte.r67-shard-result.v2',shard_index:shard.index,
+  plan_sha256:plan.plan_sha256,files_sha256:shard.files_sha256,status:'PASS',exit_code:0,
+  test_count:shard.files.length,passed:shard.files.length,failed:0,skipped:0,cancelled:0,todo:0}));
+ assert.equal(reconcileR67Shards(plan,good).status,'PASS');
+ const altered=structuredClone(good);altered[1].skipped=1;
+ assert.equal(reconcileR67Shards(plan,altered).status,'FAILED');
+ const cancelled=structuredClone(good);cancelled[1].passed-=1;cancelled[1].cancelled=1;
+ assert.equal(reconcileR67Shards(plan,cancelled).status,'FAILED');
+});
+
+test('R67 CLI reconciliation delegates to same independently tested v2 evaluator',async()=>{
+ const {readFile}=await import('node:fs/promises');
+ const {fileURLToPath}=await import('node:url');
+ const here=path.dirname(fileURLToPath(import.meta.url));
+ const runner=await readFile(path.join(here,'..','scripts','r67-regression-shard-run.mjs'),'utf8');
+ const cli=await readFile(path.join(here,'..','scripts','r67-regression-reconcile.mjs'),'utf8');
+ const core=await readFile(path.join(here,'..','src','r67-evidence-reconcile.mjs'),'utf8');
+ assert.ok(runner.includes("schema:'deadbyte.r67-shard-result.v2'"));
+ assert.ok(cli.includes("import {reconcileR67Evidence} from"));
+ assert.ok(core.includes("result.schema!=='deadbyte.r67-shard-result.v2'"));
+ assert.ok(cli.includes("if(result.status!=='PASS')process.exitCode=2;"));
+});
+
+test('R67 evidence reconciler fails closed on absent operation identity',async()=>{
+ const {reconcileR67Evidence}=await import('../src/r67-evidence-reconcile.mjs');
+ await assert.rejects(()=>reconcileR67Evidence({root:'X',evidenceRoot:'Y',operationId:'../escape'}),/bounded root|operation identity/);
+});
+
+test('R67 TAP nonpass ledger preserves test name and explicit SKIP reason, rejects unnamed skips',async()=>{
+ const {parseR67NonpassCases}=await import('../src/r67-regression-shards.mjs');
+ const tap=[
+ 'TAP version 13',
+ 'ok 1 - works',
+ 'ok 2 - Windows-only hook # SKIP unavailable on platform',
+ '    ok 1 - case without reason # SKIP',
+ 'ok 3 - not yet implemented # TODO waiting on API',
+ '# tests 4','# pass 1','# fail 0','# cancelled 0','# skipped 2','# todo 1'
+ ].join('\n');
+ const v=parseR67NonpassCases(tap);
+ assert.equal(v.cases.length,3);
+ assert.equal(v.cases[0].name,'Windows-only hook');
+ assert.equal(v.cases[0].reason,'unavailable on platform');
+ assert.equal(v.cases[1].reason,null);
+ assert.equal(v.cases[2].kind,'TODO');
+ assert.equal(v.fully_classified,false);
+ assert.equal(v.unclassified_count,1);
+});
+
+test('R67 preserves bounded case identity for a TAP FAILED leaf instead of empty nonpass evidence',async()=>{
+ const {parseR67FailedCases}=await import('../src/r67-regression-shards.mjs');
+ const tap=['TAP version 13','# Subtest: remote test','not ok 4 - remote owner cleanup is durable',
+ '  ---','  error: \'sensitive runtime stack omitted\'','  ...','# tests 26','# pass 25','# fail 1','# cancelled 0','# skipped 0','# todo 0'].join('\n');
+ const parsed=parseR67FailedCases(tap);
+ assert.equal(parsed.count,1);
+ assert.equal(parsed.cases[0].name,'remote owner cleanup is durable');
+ assert.match(parsed.cases[0].name_sha256,/^[a-f0-9]{64}$/);
+ assert.ok(!JSON.stringify(parsed).includes('sensitive runtime stack'));
+});
+test('R67 failed-case parser remains fail closed on missing TAP and secret-shaped titles',async()=>{
+ const {parseR67FailedCases}=await import('../src/r67-regression-shards.mjs');
+ const missing=parseR67FailedCases('TAP version 13\n# tests 2\n# pass 1\n# fail 1\n');
+ assert.equal(missing.complete,false);
+ const title='remote failed sk-proj-secret-token-value';
+ const guarded=parseR67FailedCases('not ok 1 - '+title+'\n# tests 1\n# pass 0\n# fail 1\n# cancelled 0\n# skipped 0\n# todo 0');
+ assert.equal(guarded.cases[0].name,'[redacted]');
+ assert.equal(guarded.count,1);
+});

package/test/r67-release-contract.test.mjs

@@ -0,0 +1,44 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+const get=async rel=>JSON.parse(await readFile(new URL('../'+rel,import.meta.url),'utf8'));
+const parent={
+ release_id:'v0.15.43-4c4a64a4c8e9f5a6',
+ manifest_sha256:'4c4a64a4c8e9f5a6e9eecce85fd0007ebcac99121b29c07f1a1fc81d1643cd33',
+ generation_manifest_sha256:'ef3b041e2a87c2e143d4733a98a52d9db80cd16ad7007e112fcb5202e70c77c3'
+};
+test('R67 release version, predecessor evidence, and observed prepublish seal are exact',async()=>{
+ const [pkg,lock,bridge,release,prov,matrix,sbom,version]=await Promise.all([
+  get('package.json'),get('package-lock.json'),get('bridge/package.json'),
+  get('RELEASE.json'),get('PROVENANCE.json'),get('TEST-MATRIX.json'),get('SBOM.cdx.json'),
+  readFile(new URL('../src/version.mjs',import.meta.url),'utf8')
+ ]);
+ assert.equal(pkg.version,'0.15.44');
+ assert.equal(lock.version,pkg.version);
+ assert.equal(lock.packages[''].version,pkg.version);
+ assert.equal(bridge.version,pkg.version);
+ assert.match(version,/DEADBYTE_VERSION = '0\.15\.44'/);
+ assert.equal(release.version,pkg.version);
+ assert.equal(release.train,'R67');
+ assert.equal(release.parent.version,'0.15.43');
+ assert.equal(release.parent.release_id,parent.release_id);
+ assert.equal(release.parent.manifest_sha256,parent.manifest_sha256);
+ assert.equal(release.parent.generation_manifest_sha256,parent.generation_manifest_sha256);
+ assert.deepEqual(release.runtime_predecessor,parent);
+ assert.equal(prov.version,pkg.version);
+ assert.equal(prov.parent_release_id,parent.release_id);
+ assert.equal(prov.parent_manifest_sha256,parent.manifest_sha256);
+ assert.equal(prov.parent_generation_manifest_sha256,parent.generation_manifest_sha256);
+ assert.equal(matrix.version,pkg.version);
+ assert.equal(matrix.train,'R67');
+ assert.equal(sbom.metadata.component.version,pkg.version);
+ assert.equal(sbom.serialNumber,'urn:cdx:deadbyte-mcp:r67:0.15.44');
+ assert.equal(release.r67_native_observation.status,'CANDIDATE_SEALED');
+ assert.equal(release.r67_native_observation.new_public_tools,0);
+ assert.equal(release.r67_native_observation.full_release_gate,'PASS');
+ assert.equal(release.r67_native_observation.current_source_full_shards,'PASS');
+ assert.equal(release.r67_native_observation.isolated_activation_rollback_restore,'PASS');
+ assert.ok(matrix.required.some(x=>x.id==='r67-sharded-full'));
+ assert.match(pkg.scripts['gate:windows'],/gate-windows-r67\.ps1/);
+ assert.match(pkg.scripts['r67:focused:test'],/r67-focused-gate\.mjs/);
+});

package/test/r67-runtime-observation-binding.test.mjs

@@ -0,0 +1,86 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {createHash} from 'node:crypto';
+import {mkdtemp,mkdir,writeFile,rm} from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import {createMachineRuntime} from '../src/machine-identity.mjs';
+import {independentlyVerifyR67RuntimeObservation} from '../scripts/r67-independent-runtime-observation-verify.mjs';
+const sha=b=>createHash('sha256').update(b).digest('hex');
+const POLICY='a'.repeat(64),GRANT='r67-fixture-grant-1';
+async function fixture(callback){
+ const stateRoot=await mkdtemp(path.join(os.tmpdir(),'r67-owned-observation-'));
+ const release=path.join(stateRoot,'releases','r67'),generation=path.join(stateRoot,'generations','r67');
+ await mkdir(release,{recursive:true});await mkdir(generation,{recursive:true});
+ const releaseBytes=Buffer.from('candidate-r67-release\n'),generationBytes=Buffer.from('candidate-r67-generation\n');
+ await writeFile(path.join(release,'MANIFEST.SHA256'),releaseBytes);
+ await writeFile(path.join(generation,'GENERATION.SHA256'),generationBytes);
+ const releaseHash=sha(releaseBytes),generationHash=sha(generationBytes);
+ const pointer={
+  schema:'deadbyte.active-release.v1',release_id:'v0.15.43-'+releaseHash.slice(0,16),version:'0.15.43',
+  manifest_sha256:releaseHash,release_root:release,generation_root:generation,
+  generation_manifest_sha256:generationHash,launcher_sha256:'1'.repeat(64),
+  config_path:path.join(generation,'controller-config.psd1')
+ };
+ const activePointerPath=path.join(stateRoot,'active-release.json');
+ await writeFile(activePointerPath,JSON.stringify(pointer)+'\n');
+ const runtime=await createMachineRuntime({stateRoot,activePointerPath,assertObservationAuthority:callback});
+ return {runtime,stateRoot,cleanup:()=>rm(stateRoot,{recursive:true,force:true})};
+}
+const grant=()=>({grant_id:GRANT,policy_sha256:POLICY,scope:'native-observe-readonly',authority_generation:4});
+test('R67 isolated machine-owned observation signs actual Windows native process data with generation and scoped standing-grant',async()=>{
+ const phases=[];
+ const x=await fixture(async({phase,operation})=>{phases.push(phase);assert.equal(operation,'process');return grant();});
+ try{
+  const before=await x.runtime.status();
+  const output=await x.runtime.observeNative({args:['process','4']});
+  assert.equal(output.result.status,'ok');
+  assert.equal(output.receipt.machine_id,before.machine_id);
+  assert.equal(output.receipt.generation_manifest_sha256,before.generation_manifest_sha256);
+  assert.equal(output.receipt.authority.grant_id,GRANT);
+  assert.deepEqual(phases,['pre','post']);
+  const check=independentlyVerifyR67RuntimeObservation({
+   receipt:output.receipt,result:output.result,requestArgs:['process','4'],
+   machinePublicSpkiBase64:before.public_key_spki_base64,
+   expectedMachineStatus:before,expectedPolicySha256:POLICY,expectedGrantId:GRANT
+  });
+  assert.equal(check.ok,true,check.reason);
+  assert.equal(check.signature_valid,true);
+ }finally{await x.cleanup();}
+});
+test('R67 runtime observer denies missing authority, changing lease and revoked grant before signing',async()=>{
+ const noAuthority=await fixture(null);
+ try{await assert.rejects(()=>noAuthority.runtime.observeNative({args:['process','4']}),/authority/i);}
+ finally{await noAuthority.cleanup();}
+ let armed=true,rotate=false;
+ const x=await fixture(async({phase})=>{
+  if(phase==='post'&&rotate)armed=false;
+  if(!armed)throw new Error('LOCAL_AUTHORITY_REVOKED');
+  return grant();
+ });
+ try{
+  rotate=true;
+  await assert.rejects(()=>x.runtime.observeNative({args:['process','4']}),/LOCAL_AUTHORITY_REVOKED/);
+  assert.equal(armed,false);
+ }finally{await x.cleanup();}
+});
+test('R67 runtime observation verifier rejects changed result, request, generation, grant and signature',async()=>{
+ const x=await fixture(async()=>grant());
+ try{
+  const before=await x.runtime.status();
+  const xResult=await x.runtime.observeNative({args:['process','4']});
+  const verify=(receipt,result,args=['process','4'],status=before)=>independentlyVerifyR67RuntimeObservation({
+   receipt,result,requestArgs:args,machinePublicSpkiBase64:before.public_key_spki_base64,
+   expectedMachineStatus:status,expectedPolicySha256:POLICY,expectedGrantId:GRANT
+  }).ok;
+  assert.equal(verify(xResult.receipt,xResult.result),true);
+  const corrupt=structuredClone(xResult.result);corrupt.data.processes[0].name+='INJECTED';
+  assert.equal(verify(xResult.receipt,corrupt),false);
+  assert.equal(verify(xResult.receipt,xResult.result,['process','8']),false);
+  assert.equal(verify({...xResult.receipt,generation_manifest_sha256:'0'.repeat(64)},xResult.result),false);
+  assert.equal(verify({...xResult.receipt,authority:{...xResult.receipt.authority,grant_id:'wrong'}},xResult.result),false);
+  assert.equal(verify({...xResult.receipt,attestation:{...xResult.receipt.attestation,signature_base64:'AA=='}},xResult.result),false);
+  const after={...before,identity_generation:before.identity_generation+1};
+  assert.equal(verify(xResult.receipt,xResult.result,['process','4'],after),false);
+ }finally{await x.cleanup();}
+});

package/test/r67-server-observation-wiring.test.mjs

@@ -0,0 +1,12 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+test('R67 server-owned Native Observer is wired to live Coding standing epoch and explicitly opted in',async()=>{
+ const source=await readFile(new URL('../src/mcp-server.mjs',import.meta.url),'utf8');
+ assert.match(source,/import \{ createR67NativeObservationAuthority \} from '\.\/r67-native-observation-authority\.mjs'/);
+ assert.match(source,/let codingPolicy=null;/);
+ assert.match(source,/DEADBYTE_R67_NATIVE_OBSERVE \?\? '0'/);
+ assert.match(source,/getCodingPolicy:\(\)=>codingPolicy,enabled:nativeObserveMode==='1'/);
+ assert.match(source,/createMachineRuntime\(\{stateRoot:runtimeStateRoot,assertObservationAuthority:assertNativeObservationAuthority\}\)/);
+ assert.equal((source.match(/let codingPolicy=null;/g)??[]).length,1);
+});

package/test/r67-signed-receipt.test.mjs

@@ -0,0 +1,66 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {generateKeyPairSync,createHash} from 'node:crypto';
+import {signR67Observation} from '../src/r67-observation-receipt.mjs';
+import {independentlyVerifyR67Receipt} from '../scripts/r67-independent-observation-verify.mjs';
+import {runNativeInspect} from '../src/native-inspector-r67.mjs';
+
+const sha=s=>createHash('sha256').update(s).digest('hex');
+const pair=generateKeyPairSync('ed25519');
+const trustedPublicSpkiBase64=pair.publicKey.export({type:'spki',format:'der'}).toString('base64');
+const other=generateKeyPairSync('ed25519');
+const otherSpki=other.publicKey.export({type:'spki',format:'der'}).toString('base64');
+const requestSha256=sha(Buffer.from(JSON.stringify(['process','4']),'utf8'));
+const executableSha256='c814771dddac8bfb184250b868ddb6ab9f5e0e43613c04c3ed8abe09324ec4db';
+
+test('R67 signs a real Windows native observation and independently verifies exact result bytes',async()=>{
+ const result=await runNativeInspect(['process','4']);
+ assert.equal(result.status,'ok');
+ const receipt=signR67Observation({privateKey:pair.privateKey,publicKey:pair.publicKey,operation:'process',requestSha256,executableSha256,result});
+ const verified=independentlyVerifyR67Receipt({receipt,result,trustedPublicSpkiBase64,requestArgs:['process','4'],expectedExecutableSha256:executableSha256});
+ assert.equal(verified.ok,true,verified.reason);
+ assert.equal(verified.signature_valid,true);
+ assert.equal(verified.signer_key_id,sha(Buffer.from(trustedPublicSpkiBase64,'base64')));
+});
+
+test('R67 independent verifier rejects changed result, changed receipt, alternate signer and malformed encoding',async()=>{
+ const result=await runNativeInspect(['process','4']);
+ const receipt=signR67Observation({privateKey:pair.privateKey,publicKey:pair.publicKey,operation:'process',requestSha256,executableSha256,result});
+ const changedResult=structuredClone(result);
+ changedResult.data.processes[0].name+='INJECTED';
+ assert.equal(independentlyVerifyR67Receipt({receipt,result:changedResult,trustedPublicSpkiBase64,requestArgs:['process','4'],expectedExecutableSha256:executableSha256}).ok,false);
+ const changedReceipt={...receipt,executable_sha256:sha(Buffer.from('ATTACK'))};
+ assert.equal(independentlyVerifyR67Receipt({receipt:changedReceipt,result,trustedPublicSpkiBase64,requestArgs:['process','4'],expectedExecutableSha256:executableSha256}).ok,false);
+ assert.equal(independentlyVerifyR67Receipt({receipt,result,trustedPublicSpkiBase64:otherSpki,requestArgs:['process','4'],expectedExecutableSha256:executableSha256}).ok,false);
+ const forged=signR67Observation({privateKey:other.privateKey,publicKey:other.publicKey,operation:'process',requestSha256,executableSha256,result});
+ assert.equal(independentlyVerifyR67Receipt({receipt:forged,result,trustedPublicSpkiBase64,requestArgs:['process','4'],expectedExecutableSha256:executableSha256}).ok,false);
+ const badSig={...receipt,attestation:{...receipt.attestation,signature_base64:'AAA='}};
+ assert.equal(independentlyVerifyR67Receipt({receipt:badSig,result,trustedPublicSpkiBase64,requestArgs:['process','4'],expectedExecutableSha256:executableSha256}).ok,false);
+});
+
+test('R67 signing fails closed without trusted caller signer or on mismatched public/private key and corrupt data SHA',async()=>{
+ const result=await runNativeInspect(['process','4']);
+ assert.throws(()=>signR67Observation({operation:'process',requestSha256,executableSha256,result}),/trusted runtime/);
+ assert.throws(()=>signR67Observation({privateKey:pair.privateKey,publicKey:other.publicKey,operation:'process',requestSha256,executableSha256,result}),/mismatch/);
+ const altered={...result,data_sha256:sha(Buffer.from('forged'))};
+ assert.throws(()=>signR67Observation({privateKey:pair.privateKey,publicKey:pair.publicKey,operation:'process',requestSha256,executableSha256,result:altered}),/digest invalid/);
+});
+
+test('R67 trusted caller signing is integrated into actual native process inspection, not implicit CLI authority',async()=>{
+ const {result,receipt}=await runNativeInspect(['process','4'],{trustedSigner:{privateKey:pair.privateKey,publicKey:pair.publicKey}});
+ assert.equal(result.status,'ok');
+ assert.equal(receipt.operation,'process');
+ const check=independentlyVerifyR67Receipt({receipt,result,trustedPublicSpkiBase64,requestArgs:['process','4'],expectedExecutableSha256:executableSha256});
+ assert.equal(check.ok,true,check.reason);
+ const untrusted=await runNativeInspect(['process','4']);
+ assert.equal(untrusted.status,'ok');
+ assert.equal(Object.hasOwn(untrusted,'attestation'),false);
+});
+
+test('R67 independent verifier requires exact request argv and trusted executable pin',async()=>{
+ const result=await runNativeInspect(['process','4']);
+ const receipt=signR67Observation({privateKey:pair.privateKey,publicKey:pair.publicKey,operation:'process',requestSha256,executableSha256,result});
+ assert.equal(independentlyVerifyR67Receipt({receipt,result,trustedPublicSpkiBase64,requestArgs:['process','8'],expectedExecutableSha256:executableSha256}).ok,false);
+ assert.equal(independentlyVerifyR67Receipt({receipt,result,trustedPublicSpkiBase64,requestArgs:['process','4'],expectedExecutableSha256:sha(Buffer.from('WRONG EXE'))}).ok,false);
+ assert.equal(independentlyVerifyR67Receipt({receipt,result,trustedPublicSpkiBase64}).ok,false);
+});

package/test/r67-skip-rationale.test.mjs

@@ -0,0 +1,31 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {spawnSync} from 'node:child_process';
+import {fileURLToPath} from 'node:url';
+import path from 'node:path';
+import {parseR67NonpassCases,parseR67TapSummary} from '../src/r67-regression-shards.mjs';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const historical=[
+ 'test/r53-release-contract.test.mjs','test/r54-release-contract.test.mjs','test/r55-release-contract.test.mjs',
+ 'test/r56-release-contract.test.mjs','test/r57-release-contract.test.mjs','test/r58-release-contract.test.mjs',
+ 'test/r58-windows-gate.test.mjs','test/r58-bundled-bridge.test.mjs','test/r60-release-contract.test.mjs',
+ 'test/r61-release-contract.test.mjs','test/r62-release-contract.test.mjs','test/r63-release-contract.test.mjs',
+ 'test/r64-release-contract.test.mjs','test/r65-release-contract.test.mjs','test/semantic-multilang.test.mjs'
+];
+test('R67 real TAP from historical release and R35 fixture skips has individual source-derived reasons',()=>{
+ const r=spawnSync(process.execPath,['--test','--test-reporter=tap','--test-concurrency=2',...historical],{
+ cwd:root,encoding:'utf8',windowsHide:true,shell:false,timeout:90000,maxBuffer:16*1024*1024,
+ env:Object.fromEntries(Object.entries(process.env).filter(([key])=>key!=='NODE_TEST_CONTEXT'))
+ });
+ assert.equal(r.error,undefined,r.error?.message);
+ assert.equal(r.status,0,'selected regression exit '+r.status+' output tail '+r.stdout?.slice(-1500));
+ const tap=parseR67TapSummary(r.stdout);
+ assert.ok(tap,'valid full TAP totals; stdout-tail='+String(r.stdout).slice(-1600)+'; stderr-tail='+String(r.stderr).slice(-500));
+ assert.equal(tap.fail,0);
+ const ledger=parseR67NonpassCases(r.stdout);
+ assert.ok(ledger,'nonpass parser output');
+ assert.ok(ledger.expected_nonpass>0,'must exercise real skip path');
+ assert.equal(ledger.fully_classified,true,JSON.stringify(ledger.cases.filter(x=>!x.reason)));
+ assert.equal(ledger.cases.length,ledger.expected_nonpass);
+ for(const c of ledger.cases)assert.match(c.reason,/Historical|historical|fixture|R35|R\d+/);
+});

package/test/r67-tool-annotations.test.mjs

@@ -0,0 +1,21 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {registerMachineTools} from '../src/machine-mcp-tools.mjs';
+test('R67 MCP annotations classify pure observation distinctly from machine revoke, without granting authority',async()=>{
+ const catalog=new Map();
+ const server={registerTool:(name,config,fn)=>catalog.set(name,{config,fn})};
+ let granted=false;
+ const runtime={list:async()=>({status:'ok',machines:[]}),status:async()=>({status:'ok'}),ping:async()=>({status:'ok'}),revoke:async()=>({status:'revoked'})};
+ registerMachineTools(server,{runtime,assertRevokeAuthority:async()=>{if(!granted)throw new Error('LOCAL_DENY');}});
+ for(const name of ['machine_list','machine_status','machine_ping']){
+  const hint=catalog.get(name).config.annotations;
+  assert.equal(hint.readOnlyHint,true,name);
+  assert.equal(hint.destructiveHint,false,name);
+  assert.equal(hint.openWorldHint,false,name);
+ }
+ const rev=catalog.get('machine_revoke');
+ assert.deepEqual(rev.config.annotations,{readOnlyHint:false,destructiveHint:true,idempotentHint:false,openWorldHint:false});
+ const denial=await rev.fn({reason:'check'});
+ assert.ok(denial.isError||denial.structuredContent?.status==='denied','annotations cannot grant revocation');
+ assert.equal(granted,false);
+});

package/test/r67-windows-gate-argv.test.mjs

@@ -0,0 +1,13 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+
+test('R67 Windows release gate must not shadow automatic PowerShell $Args when passing node script argv',async()=>{
+ const source=await readFile(path.join(root,'scripts','gate-windows-r67.ps1'),'utf8');
+ assert.doesNotMatch(source,/\[string\[\]\]\$Args\b/i,'PowerShell automatic $Args silently discards function parameters');
+ assert.match(source,/\[string\[\]\]\$NodeArgs\b/);
+ assert.match(source,/\& node @NodeArgs/);
+});

package/test/release-version.test.mjs

@@ -10,7 +10,7 @@ const PARENT_RELEASE='v0.15.2-0fb46542f6a4345f';
 const PARENT_MANIFEST='0fb46542f6a4345f1c527565d06bf6e9b8e283260e47bf684fb70a60308fcf34';
 const PARENT_GENERATION='00cde7bf540cc2804d679a39040d5b07193c5f8a0d49cac3b882402f8f4e6ad8';
 
-test.skip('R46 historical release contract is frozen at 0.15.15 and V0.15.2 parent identity',async()=>{
+test('R46 historical release contract is frozen at 0.15.15 and V0.15.2 parent identity',{skip:'Historical R46 release-version contract requires 0.15.15; current successor differs'},async()=>{
   const pkg=JSON.parse(await text('package.json'));
   const release=JSON.parse(await text('RELEASE.json'));
   const [version,controller,gate,readme,architecture,controllerReadme,deferred,parity,closure,closureVerify,windowsGate,processPolicy]=await Promise.all([

package/test/remote-live-log-r36.test.mjs

@@ -35,3 +35,13 @@ test('compact live activity shows failed result duration',()=>{
 test('compact live activity ignores unrelated audit events',()=>{
   assert.equal(formatCompactAuditEvent({event_type:'checkpoint',tool:'coding_tree'}),null);
 });
+
+test('R67 live logs must reject terminal control injection and path escape codes',()=>{
+ const attacker=String.fromCharCode(27)+'[2J'+String.fromCharCode(27)+'[31mINJECTED';
+ const injectedTool=formatCompactAuditEvent({event_type:'tool.request',tool:'coding_file_read'+attacker,args:{root_id:'projects',path:'src/test.txt'}});
+ assert.equal(injectedTool,null,'tool names carrying control codes must never render');
+ const injectedPath=formatCompactAuditEvent({event_type:'tool.request',tool:'coding_file_read',args:{root_id:'projects',path:'src/'+attacker}});
+ assert.ok(injectedPath!==null);
+ assert.equal(injectedPath.includes(String.fromCharCode(27)),false,'terminal ESC must not be included in line');
+ assert.equal(injectedPath.includes('INJECTED'),false,'invalid path should be rejected rather than partially displayed');
+});