deadbyte-mcp 0.15.43 → 0.15.44

package/proof/CONTAINMENT-BUILD.txt

@@ -39,7 +39,7 @@ deadbyte-process-host.cpp
 exit_code=0
 ==== probe-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.30-stabilization\bin\containment-probe.exe
+Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67\bin\containment-probe.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -59,7 +59,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== contained-launcher-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.30-stabilization\bin\deadbyte-exec.exe
+Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67\bin\deadbyte-exec.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -83,7 +83,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== contained-worker-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.30-stabilization\bin\contained-transform-worker.exe
+Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67\bin\contained-transform-worker.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -104,7 +104,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== contained-reverse-worker-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.30-stabilization\bin\contained-reverse-worker.exe
+Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67\bin\contained-reverse-worker.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -125,7 +125,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== named-tunnel-host-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.30-stabilization\bin\deadbyte-tunnel-host.exe
+Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67\bin\deadbyte-tunnel-host.exe
 
 File Type: EXECUTABLE IMAGE
 
@@ -144,7 +144,7 @@ File Type: EXECUTABLE IMAGE
 exit_code=0
 ==== process-host-dependencies ====
 
-Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.30-stabilization\bin\deadbyte-process-host.exe
+Dump of file D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.44-r67\bin\deadbyte-process-host.exe
 
 File Type: EXECUTABLE IMAGE
 

package/scripts/build-native-inspector-r67.ps1

@@ -0,0 +1,28 @@
+param([Parameter(Mandatory=$true)][ValidatePattern('^[0-9a-f]{64}$')][string]$SourceSha256)
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version Latest
+$root=Split-Path -Parent $PSScriptRoot
+$src=Join-Path $root 'native\deadbyte-native-inspect-r67.cpp'
+$observed=(Get-FileHash -LiteralPath $src -Algorithm SHA256).Hash.ToLowerInvariant()
+if($observed -ne $SourceSha256){throw "R67 source SHA mismatch; refusing build"}
+Write-Output "R67_SOURCE_SHA256=$observed"
+$bin=Join-Path $root 'bin'
+$exe=Join-Path $bin 'deadbyte-native-inspect-r67.exe'
+$obj=Join-Path $bin 'deadbyte-native-inspect-r67.obj'
+$vswhere='C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe'
+if(!(Test-Path -LiteralPath $vswhere)){throw 'vswhere missing'}
+$install=(& $vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath | Select-Object -First 1)
+if(!$install){throw 'MSVC x64 C++ toolchain missing'}
+$dev=Join-Path $install 'Common7\Tools\VsDevCmd.bat'
+$cmd=if($env:ComSpec){$env:ComSpec}else{Join-Path $env:SystemRoot 'System32\cmd.exe'}
+New-Item -ItemType Directory -Path $bin -Force | Out-Null
+$common='/nologo /std:c++17 /permissive- /W4 /WX /O2 /MT /EHsc /guard:cf /diagnostics:caret /utf-8 /Brepro /DUNICODE /D_UNICODE /D_WIN32_WINNT=0x0A00'
+$compile='cl {0} "{1}" /Fo:"{2}" /Fe:"{3}" /link bcrypt.lib /Brepro /INCREMENTAL:NO' -f $common,$src,$obj,$exe
+$line='call "{0}" -no_logo -arch=x64 -host_arch=x64 && {1}' -f $dev,$compile
+$output=& $cmd /d /s /c $line 2>&1
+$rc=$LASTEXITCODE
+$output | ForEach-Object { Write-Output ([string]$_) }
+if($rc -ne 0){throw "R67 native build failed exit=$rc"}
+if(!(Test-Path -LiteralPath $exe -PathType Leaf)){throw 'R67 native exe missing'}
+$sha=(Get-FileHash -LiteralPath $exe -Algorithm SHA256).Hash.ToLowerInvariant()
+Write-Output "R67_NATIVE_BUILD_PASS sha256=$sha path=$exe"

package/scripts/gate-windows-r67.ps1

@@ -0,0 +1,56 @@
+param(
+ [ValidateSet('preflight','focused','evidence','manifest','doctor','all')]
+ [string]$Stage='preflight',
+ [string]$OperationId=''
+)
+$ErrorActionPreference='Stop'
+Set-StrictMode -Version Latest
+$root=Split-Path -Parent $PSScriptRoot
+$parent='D:\Projects\deadbyte-mcp\development\deadbyte-mcp-0.15.43-r66'
+$expected='4c4a64a4c8e9f5a6e9eecce85fd0007ebcac99121b29c07f1a1fc81d1643cd33'
+$expectedGen='ef3b041e2a87c2e143d4733a98a52d9db80cd16ad7007e112fcb5202e70c77c3'
+$expectedRelease='v0.15.43-4c4a64a4c8e9f5a6'
+if(!(Test-Path -LiteralPath $parent -PathType Container)){throw 'R67 predecessor source missing'}
+$prev=(Get-FileHash -LiteralPath (Join-Path $parent 'MANIFEST.SHA256') -Algorithm SHA256).Hash.ToLowerInvariant()
+if($prev -ne $expected){throw 'R67 predecessor manifest not exact'}
+$stateRoot=Join-Path $env:USERPROFILE '.deadbyte-mcp'
+$pointerPath=Join-Path $stateRoot 'active-release.json'
+if(!(Test-Path -LiteralPath $pointerPath -PathType Leaf)){throw 'R67 active predecessor pointer missing'}
+$pointer=Get-Content -LiteralPath $pointerPath -Raw | ConvertFrom-Json
+if($pointer.release_id -ne $expectedRelease -or $pointer.manifest_sha256 -ne $expected -or
+  $pointer.generation_manifest_sha256 -ne $expectedGen){throw 'R67 active predecessor binding mismatch'}
+$pkg=Get-Content -LiteralPath (Join-Path $root 'package.json') -Raw | ConvertFrom-Json
+if($pkg.version -ne '0.15.44'){throw 'R67 package candidate version mismatch'}
+Write-Output 'R67_PREDECESSOR_PREFLIGHT=PASS'
+if($Stage -eq 'preflight'){return}
+function Invoke-Node([string]$Label,[string[]]$NodeArgs){
+ Write-Output "R67_STAGE_START=$Label"
+ & node @NodeArgs
+ if($LASTEXITCODE -ne 0){throw "R67 stage $Label exit=$LASTEXITCODE"}
+ Write-Output "R67_STAGE_PASS=$Label"
+}
+if($Stage -eq 'all' -or $Stage -eq 'focused'){
+ Invoke-Node 'focused' @('scripts/r67-focused-gate.mjs')
+ Invoke-Node 'machine-fs-smoke' @('src/machine-fs-smoke-client.mjs')
+ if($Stage -eq 'focused'){return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'evidence'){
+ if($OperationId -notmatch '^[a-z0-9][a-z0-9._-]{5,63}$'){throw 'R67 full evidence operation ID required'}
+ Invoke-Node 'evidence' @('scripts/r67-regression-reconcile.mjs',$OperationId)
+ if($Stage -eq 'evidence'){return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'manifest'){
+ Invoke-Node 'manifest-verify' @('scripts/release-manifest.mjs','verify')
+ if($Stage -eq 'manifest'){return}
+}
+if($Stage -eq 'all' -or $Stage -eq 'doctor'){
+ $prior=$env:DEADBYTE_STATE_ROOT
+ $isolated='D:\Projects\deadbyte-mcp\testing\0.15.44-r67\doctor-isolated-empty'
+ if(Test-Path -LiteralPath (Join-Path $isolated 'active-release.json')){throw 'isolated doctor root unexpectedly has active release pointer'}
+ try{
+  $env:DEADBYTE_STATE_ROOT=$isolated
+  Invoke-Node 'isolated-doctor' @('src/deadbyte-cli.mjs','doctor')
+ }finally{$env:DEADBYTE_STATE_ROOT=$prior}
+ if($Stage -eq 'doctor'){return}
+}
+Write-Output 'R67_WINDOWS_GATE=PASS_PREDEPLOY_CANDIDATE'

package/scripts/npm-preserve-artifact-r67.mjs

@@ -0,0 +1,99 @@
+import {createHash,randomBytes} from 'node:crypto';
+import {lstat,readFile,open,link,unlink} from 'node:fs/promises';
+import path from 'node:path';
+
+function sha256(bytes){return createHash('sha256').update(bytes).digest('hex');}
+function integrity(bytes){return 'sha512-'+createHash('sha512').update(bytes).digest('base64');}
+async function regular(pathname,label){
+ const stat=await lstat(pathname);
+ if(!stat.isFile()||stat.isSymbolicLink())throw new Error(label+' must be a regular non-symlink file');
+ return stat;
+}
+function assertSameIdentity(before,after){
+ if(before.dev!==after.dev||before.ino!==after.ino||before.size!==after.size)
+  throw new Error('source artifact identity changed during preservation; do not remove original');
+}
+
+/**
+ * Preserve an npm-packed immutable tarball across Windows volumes.
+ * Uses an exclusive staging file ON THE DESTINATION VOLUME, syncs complete
+ * verified bytes, and publishes with a same-volume, no-clobber hard link.
+ * No rename(D: -> C:), no partial destination visibility, no npm publish.
+ * Preserving exact bytes is NOT permission to send them to npm.
+ */
+export async function preserveNpmTarball({source,destination,expectedIntegrity,expectedShasum}={}){
+ if(typeof source!=='string'||typeof destination!=='string'||
+    !path.isAbsolute(source)||!path.isAbsolute(destination)||
+    path.resolve(source)===path.resolve(destination))throw new Error('absolute distinct source and destination required');
+ if(typeof expectedIntegrity!=='string'||!/^sha512-[A-Za-z0-9+/]+=*$/.test(expectedIntegrity))
+  throw new Error('npm SHA-512 integrity precondition required');
+ if(expectedShasum!==undefined&&!/^[a-f0-9]{40}$/.test(expectedShasum))
+  throw new Error('invalid npm packed artifact SHA-1 precondition');
+
+ const original=await regular(source,'source artifact');
+ if(original.size===0||original.size>128*1024*1024)throw new Error('npm artifact size outside permitted budget');
+ const bytes=await readFile(source);
+ assertSameIdentity(original,await regular(source,'source artifact'));
+ if(bytes.length!==original.size||integrity(bytes)!==expectedIntegrity)
+  throw new Error('npm packed artifact integrity mismatch; original retained');
+ if(expectedShasum!==undefined&&createHash('sha1').update(bytes).digest('hex')!==expectedShasum)
+  throw new Error('npm packed artifact shasum mismatch; original retained');
+ const hash=sha256(bytes);
+ let committed=false;
+ try{
+  const existing=await regular(destination,'preserved artifact');
+  const preserved=await readFile(destination);
+  if(existing.size!==bytes.length||sha256(preserved)!==hash||integrity(preserved)!==expectedIntegrity)
+   throw new Error('existing preserved artifact differs; manual conflict reconciliation required');
+  committed=true;
+ }catch(error){
+  if(error?.code!=='ENOENT')throw error;
+ }
+ let staging=null;
+ if(!committed){
+  staging=path.join(path.dirname(destination),'.'+path.basename(destination)+'.stage-'+process.pid+'-'+randomBytes(8).toString('hex'));
+  try{
+   const handle=await open(staging,'wx',0o600);
+   try{
+    await handle.writeFile(bytes);
+    await handle.sync();
+   }finally{await handle.close();}
+   const staged=await readFile(staging);
+   if(staged.length!==bytes.length||sha256(staged)!==hash||integrity(staged)!==expectedIntegrity)
+    throw new Error('staged artifact integrity mismatch; original retained');
+   // Atomic visibility of already-fsynced bytes, exclusively on the destination volume.
+   try{await link(staging,destination);}
+   catch(error){
+    if(error?.code!=='EEXIST')throw error;
+    const existing=await regular(destination,'preserved artifact');
+    const preserved=await readFile(destination);
+    if(existing.size!==bytes.length||sha256(preserved)!==hash||integrity(preserved)!==expectedIntegrity)
+     throw new Error('concurrent preserved artifact conflict; original retained');
+   }
+   committed=true;
+  }finally{
+   if(staging)await unlink(staging).catch(e=>{if(e?.code!=='ENOENT')throw e;});
+  }
+ }
+ // Final post-commit verification before relinquishing the source artifact.
+ const final=await regular(destination,'preserved artifact');
+ const preserved=await readFile(destination);
+ if(final.size!==bytes.length||sha256(preserved)!==hash||integrity(preserved)!==expectedIntegrity)
+  throw new Error('preserved artifact changed after commit; original retained');
+ const current=await regular(source,'source artifact');
+ assertSameIdentity(original,current);
+ if(sha256(await readFile(source))!==hash)throw new Error('source bytes changed after commit; retain for reconciliation');
+ await unlink(source);
+ return {status:staging?'VERIFIED_PRESERVED':'VERIFIED_ALREADY_PRESERVED',
+  sha256:hash,bytes:bytes.length,integrity:expectedIntegrity};
+}
+
+export async function assertVacantPackDestination({root,filename}={}){
+ if(typeof root!=='string'||!path.isAbsolute(root)||typeof filename!=='string'||
+    !/^[A-Za-z0-9][A-Za-z0-9._-]*\.tgz$/.test(filename)||filename!==path.basename(filename))
+   throw new Error('invalid npm pack target');
+ const target=path.join(root,filename);
+ try{await lstat(target);}
+ catch(error){if(error?.code==='ENOENT')return target;throw error;}
+ throw new Error('PACK_BLOCKED existing npm tarball must be archived and reconciled before npm pack: '+target);
+}

package/scripts/npm-release-r48.mjs

@@ -1,7 +1,9 @@
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { reconcileNpmPublication } from './npm-publication-r65.mjs';
-import { mkdtemp, readFile, rm, unlink, mkdir, rename } from 'node:fs/promises';
+import { mkdtemp, readFile, rm, unlink, mkdir } from 'node:fs/promises';
+import {preserveNpmTarball,assertVacantPackDestination} from './npm-preserve-artifact-r67.mjs';
+import {assertR67NpmPublishReady} from './npm-release-readiness-r67.mjs';
 import { existsSync } from 'node:fs';
 import { resolveStateRoot } from '../src/state-root.mjs';
 import path from 'node:path';
@@ -86,6 +88,7 @@ async function main() {
   if (provenance.version !== version) {
     throw new Error(`PROVENANCE.json version mismatch: package=${version} provenance=${provenance.version}`);
   }
+  if (!isVerifyOnly && version==='0.15.44') assertR67NpmPublishReady(release);
   if (release.parent?.release_id !== provenance.parent_release_id ||
       release.parent?.manifest_sha256 !== provenance.parent_manifest_sha256 ||
       release.parent?.generation_manifest_sha256 !== provenance.parent_generation_manifest_sha256) {
@@ -113,6 +116,7 @@ async function main() {
   if(publicationDir)await mkdir(publicationDir,{recursive:true});
   if(resuming&&!existsSync(preservedTarball))throw new Error('immutable npm publication claim exists but exact local tarball is missing; manual artifact reconciliation required');
   if(!resuming&&preservedTarball&&existsSync(preservedTarball))throw new Error('unclaimed preserved npm tarball exists; inspect artifact evidence before another pack');
+  if(!resuming)await assertVacantPackDestination({root,filename:`deadbyte-mcp-${version}.tgz`});
   const packed=resuming?null:parseJson(runNpm(['pack', '--json'], { timeout: 180000 }));
   const packRecord=resuming?{filename:path.basename(preservedTarball)}:(Array.isArray(packed) ? packed[0] : packed?.[pkg.name]);
   const filename = packRecord?.filename;
@@ -196,7 +200,11 @@ async function main() {
       return;
     }
 
-    if(!resuming)await rename(tarball,preservedTarball);
+    if(!resuming){
+      const preserved=await preserveNpmTarball({source:tarball,destination:preservedTarball,
+        expectedIntegrity:packRecord.integrity,expectedShasum:packRecord.shasum});
+      console.log('Immutable cross-volume artifact preservation verified: '+JSON.stringify(preserved));
+    }
     const publishTarball=preservedTarball;
     const localBytes = await readFile(publishTarball);
     const localIntegrity=`sha512-${createHash('sha512').update(localBytes).digest('base64')}`;

package/scripts/npm-release-readiness-r67.mjs

@@ -0,0 +1,26 @@
+/**
+ * R67 npm publish fence. Does not prove Windows release readiness by itself:
+ * only the independent release verifier may change these metadata gates.
+ * The package publisher must never interpret focused or package-only PASS as
+ * authority to make an immutable public release.
+ */
+export function assertR67NpmPublishReady(release){
+ if(release?.version!=='0.15.44'||release?.train!=='R67')
+  throw new Error('PUBLISH_BLOCKED R67 release identity does not match candidate');
+ const state=release.r67_native_observation;
+ const gates={
+  status:'CANDIDATE_SEALED',
+  full_release_gate:'PASS',
+  current_source_full_shards:'PASS',
+  native_fault_injection:'PASS',
+  protocol_parity:'PASS',
+  isolated_activation_rollback_restore:'PASS',
+  independent_machine_observation:'PASS'
+ };
+ for(const [key,expected] of Object.entries(gates)){
+  if(state?.[key]!==expected)
+   throw new Error('PUBLISH_BLOCKED R67 '+key+' '+String(state?.[key]??'MISSING')+
+    '; require independently verified gate '+expected+' before npm publication');
+ }
+ return {status:'R67_METADATA_GATES_MATCH',policy:'PUBLISH_REQUIRES_INDEPENDENT_RELEASE_EVIDENCE'};
+}

package/scripts/r67-acquire-alpha-reference.mjs

@@ -0,0 +1,95 @@
+import https from 'node:https';
+import {createHash} from 'node:crypto';
+import {gunzipSync} from 'node:zlib';
+import {mkdir,open,writeFile,readFile} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const ref=path.resolve(root,'..','..','references','desktop-commander-0.3.1-alpha.2');
+const version='0.3.1-alpha.2';
+const packageName='@wonderwhy-er/desktop-commander';
+const url='https://registry.npmjs.org/@wonderwhy-er%2fdesktop-commander/'+version;
+const hash=(b,algo='sha256')=>createHash(algo).update(b).digest('hex');
+async function fetchBounded(url,maxSize){
+ const parsed=new URL(url);
+ if(parsed.protocol!=='https:'||parsed.hostname!=='registry.npmjs.org'||parsed.username||parsed.password||parsed.port)throw new Error('untrusted npm endpoint');
+ return await new Promise((resolve,reject)=>{
+  const req=https.get(parsed,{timeout:20000,headers:{'Accept':'application/json','User-Agent':'deadbyte-reference-verifier/1.0'}},res=>{
+   if(res.statusCode!==200){res.resume();reject(new Error('npm GET HTTP '+res.statusCode));return;}
+   const parts=[];let size=0;
+   res.on('data',b=>{size+=b.length;if(size>maxSize){req.destroy(new Error('download exceeded declared safety cap'));return;}parts.push(b);});
+   res.on('end',()=>resolve(Buffer.concat(parts)));
+   res.on('error',reject);
+  });
+  req.on('timeout',()=>req.destroy(new Error('npm request timeout')));
+  req.on('error',reject);
+ });
+}
+async function saveNew(file,data){
+ const h=await open(file,'wx',0o600);
+ try{await h.writeFile(data);await h.sync();}finally{await h.close();}
+}
+const metadata=JSON.parse((await fetchBounded(url,1024*1024)).toString('utf8'));
+if(metadata.name!==packageName||metadata.version!==version)throw new Error('npm metadata identity mismatch');
+const tarball=metadata.dist?.tarball;
+const expected='https://registry.npmjs.org/@wonderwhy-er/desktop-commander/-/desktop-commander-'+version+'.tgz';
+if(tarball!==expected)throw new Error('registry tarball URL is not exact pinned package');
+if(!/^sha512-[A-Za-z0-9+/]+=*$/.test(metadata.dist.integrity??''))throw new Error('missing registry SHA512 integrity');
+const tar=await fetchBounded(tarball,32*1024*1024);
+const integrity='sha512-'+createHash('sha512').update(tar).digest('base64');
+if(integrity!==metadata.dist.integrity)throw new Error('npm SHA512 integrity mismatch');
+if(metadata.dist.shasum&&hash(tar,'sha1')!==metadata.dist.shasum)throw new Error('npm SHA1 mismatch');
+const expanded=gunzipSync(tar,{maxOutputLength:128*1024*1024});
+const files=[];let offset=0,total=0;
+const selected=[];
+const names=new Set();
+function cstr(b){return b.toString('utf8').split('\0')[0];}
+while(offset+512<=expanded.length){
+ const header=expanded.subarray(offset,offset+512);
+ if(header.every(v=>v===0))break;
+ const filename=cstr(header.subarray(0,100));
+ const prefix=cstr(header.subarray(345,500));
+ const name=prefix?prefix+'/'+filename:filename;
+ const szText=cstr(header.subarray(124,136)).trim();
+ if(!/^[0-7]*$/.test(szText))throw new Error('non-octal tar entry size');
+ const size=parseInt(szText||'0',8);
+ const type=header[156];
+ if(!Number.isSafeInteger(size)||size<0||offset+512+size>expanded.length)throw new Error('corrupt archive boundary');
+ if(type===50||type===49)throw new Error('tar link entry denied');
+ if(type===0||type===48){
+  if(!name.startsWith('package/')||name.includes('\\')||name.includes(':')||
+    name.split('/').some(c=>!c||c==='.'||c==='..')||names.has(name))throw new Error('unsafe tar entry '+name);
+  names.add(name);files.push({path:name,size});total+=size;
+  if(files.length>1000||total>128*1024*1024)throw new Error('tar inventory budget exceeded');
+  const rel=name.slice('package/'.length);
+  if(/^(?:package\.json|README\.md|LICENSE|LICENCE|dist\/[a-zA-Z0-9_./-]+\.(?:js|mjs|cjs|json|map))$/.test(rel)&&size<=8*1024*1024)
+   selected.push({rel,content:Buffer.from(expanded.subarray(offset+512,offset+512+size))});
+ }else if(![53,120,103].includes(type))throw new Error('unsupported tar type '+type+' for '+name);
+ offset+=512+Math.ceil(size/512)*512;
+}
+const packageEntry=selected.find(e=>e.rel==='package.json');
+if(!packageEntry)throw new Error('tarball has no package.json');
+const packaged=JSON.parse(packageEntry.content.toString('utf8'));
+if(packaged.name!==packageName||packaged.version!==version)throw new Error('tarball package version disagrees with registry metadata');
+await mkdir(path.join(ref,'static'),{recursive:true});
+const archivePath=path.join(ref,'desktop-commander-'+version+'.tgz');
+await saveNew(archivePath,tar);
+let selectedBytes=0;
+for(const e of selected){
+ const target=path.join(ref,'static',...e.rel.split('/'));
+ await mkdir(path.dirname(target),{recursive:true});
+ await saveNew(target,e.content);selectedBytes+=e.content.length;
+}
+const receipt={
+ schema:'deadbyte.competitor-reference-acquisition.v1',status:'VERIFIED_STATIC_ONLY',
+ package:packageName,version,metadata_source:url,
+ source_archive:archivePath,archive_bytes:tar.length,archive_sha256:hash(tar),
+ archive_sha512_integrity:integrity,registry_shasum_sha1:metadata.dist.shasum??null,
+ files_total:files.length,files_size_bytes:total,files_selected: selected.length,selected_bytes:selectedBytes,
+ has_lifecycle_scripts:Boolean(packaged.scripts&&(packaged.scripts.preinstall||packaged.scripts.install||packaged.scripts.postinstall)),
+ lifecycle_scripts_executed:false,dependencies_installed:false,remote_started:false,network_action:'registry_https_download_only',
+ selected_files_sha256:selected.map(e=>({path:e.rel,sha256:hash(e.content)})),
+ full_archive_inventory_sha256:hash(Buffer.from(JSON.stringify(files)))
+};
+await saveNew(path.join(ref,'ACQUISITION.json'),JSON.stringify(receipt,null,2)+'\n');
+console.log(JSON.stringify({status:receipt.status,version,archive_sha256:receipt.archive_sha256,archive_bytes:tar.length,files_total:files.length,files_selected:selected.length,lifecycle_scripts_executed:false,reference_path:ref,source:metadata.dist.tarball},null,2));

package/scripts/r67-audit-nonpass-source.mjs

@@ -0,0 +1,39 @@
+import {readFile,readdir,open,mkdir} from 'node:fs/promises';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.resolve(fileURLToPath(new URL('..',import.meta.url)));
+const evidence=path.resolve(root,'..','..','testing','0.15.44-r67','regression-shards');
+const operation='r67audit-20261011c';
+const cases=[];
+const files=(await readdir(path.join(root,'test'))).filter(n=>n.endsWith('.test.mjs'));
+const texts=new Map();for(const file of files)texts.set(file,(await readFile(path.join(root,'test',file),'utf8')).split(/\r?\n/));
+const fileSha=b=>createHash('sha256').update(b).digest('hex');
+for(let index=0;index<32;index++){
+ const p=path.join(evidence,operation+'-shard-'+String(index).padStart(2,'0'),'result.json');
+ const r=JSON.parse(await readFile(p,'utf8'));
+ for(const c of r.nonpass_cases??[]){
+  const name=c.name;
+  const matches=[];
+  for(const [file,lines] of texts){
+   for(let line=0;line<lines.length;line++){
+    const hay=lines[line];
+    const short=name.replace(/^R\d+ /,'').slice(0,40);
+    if(hay.includes(name)||hay.includes(short)){
+     matches.push({file,line:line+1,context:lines.slice(Math.max(0,line-3),Math.min(lines.length,line+4)).join(' ').slice(0,780)});
+     if(matches.length>=5)break;
+    }
+   }
+   if(matches.length>=5)break;
+  }
+  cases.push({shard:index,name,reason:c.reason,source_matches:matches});
+ }
+}
+const summary={schema:'deadbyte.r67-nonpass-source-audit.v1',operation,
+count:cases.length,with_reason:cases.filter(c=>c.reason).length,
+without_reason:cases.filter(c=>!c.reason).length,unmatched:cases.filter(c=>!c.source_matches.length).length,
+cases};
+const out=path.resolve(root,'..','..','testing','0.15.44-r67','R67-NONPASS-SOURCE-AUDIT-20261011.json');
+const h=await open(out,'wx',0o600);try{await h.writeFile(JSON.stringify(summary,null,2)+'\n');await h.sync();}finally{await h.close();}
+console.log(JSON.stringify({count:summary.count,with_reason:summary.with_reason,without_reason:summary.without_reason,
+unmatched:summary.unmatched,findings:cases.filter(c=>!c.reason).map(c=>({shard:c.shard,name:c.name,matches:c.source_matches}))},null,2));

package/scripts/r67-compare-desktop-alpha.mjs

@@ -0,0 +1,48 @@
+import {readdir,readFile,writeFile,mkdir,open} from 'node:fs/promises';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..','..','..');
+const refs=path.join(root,'references');
+const stable=path.join(refs,'desktop-commander','dist');
+const alpha=path.join(refs,'desktop-commander-0.3.1-alpha.2','static','dist');
+const output=path.resolve(path.dirname(fileURLToPath(import.meta.url)),'..','docs','R67-ALPHA-STATIC-COMPARISON.json');
+const sha=b=>createHash('sha256').update(b).digest('hex');
+async function inventory(dir,prefix=''){
+ const items=await readdir(path.join(dir,prefix),{withFileTypes:true});
+ const out=[];
+ for(const x of items){
+  const sub=[prefix,x.name].filter(Boolean).join('/');
+  if(x.isDirectory())out.push(...await inventory(dir,sub));
+  else if(x.isFile()&&/\.(?:js|mjs|cjs|json)$/.test(sub)){
+   const b=await readFile(path.join(dir,sub));
+   out.push({path:sub,sha256:sha(b),bytes:b.length});
+  }
+ }
+ return out;
+}
+const older=await inventory(stable),newer=await inventory(alpha);
+const map=new Map(older.map(f=>[f.path,f]));
+const changes=[];
+for(const f of newer){
+ const old=map.get(f.path);
+ changes.push({path:f.path,status:!old?'ADDED':old.sha256===f.sha256?'UNCHANGED':'CHANGED',
+  stable_sha256:old?.sha256??null,alpha_sha256:f.sha256,delta_bytes:old?f.bytes-old.bytes:null});
+}
+const relevant=changes.filter(x=>/diagnostic|remote-device|annotations|schema|mcp|pdf|process|reconnect|terminal/i.test(x.path));
+const report={
+ schema:'deadbyte.r67-competitor-static-compare.v1',
+ scope:'static npm archives only; do not execute or install competitor',
+ stable_version:'0.2.52',alpha_version:'0.3.1-alpha.2',
+ alpha_tarball_sha256:'faaf3f34f114589c0630ce4eaa7114ecc628ce2030822dfe67feac0e17fedc4b',
+ stable_compared_files:older.length,alpha_selected_compared_files:newer.length,
+ added:changes.filter(x=>x.status==='ADDED').length,
+ changed:changes.filter(x=>x.status==='CHANGED').length,
+ unchanged:changes.filter(x=>x.status==='UNCHANGED').length,
+ removed_from_selected_scope:0,
+ relevant_changes:relevant,
+ caveat:'Alpha was selectively extracted; do not treat missing alpha inventory as deleted without checking full archive.'
+};
+const handle=await open(output,'wx');
+try{await handle.writeFile(JSON.stringify(report,null,2)+'\n');await handle.sync();}finally{await handle.close();}
+console.log(JSON.stringify({status:'STATIC_DIFFERENTIAL_PASS',stable_files:report.stable_compared_files,alpha_files:report.alpha_selected_compared_files,added:report.added,changed:report.changed,unchanged:report.unchanged,relevant:relevant.filter(x=>x.status!=='UNCHANGED').map(x=>({path:x.path,status:x.status,delta:x.delta_bytes})).slice(0,60)},null,2));

package/scripts/r67-diagnose-failed-shard.mjs

@@ -0,0 +1,23 @@
+import {readFile} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const op=process.argv[2],shard=process.argv[3];
+if(!/^[a-z0-9._-]{6,64}$/.test(op??'')||!/^(0|[1-9]\d?)$/.test(shard??''))throw new Error('operation and shard required');
+const file=path.resolve(root,'..','..','testing','0.15.44-r67','regression-shards',op+'-shard-'+String(shard).padStart(2,'0'),'intent.json');
+const intent=JSON.parse(await readFile(file,'utf8'));
+if(intent.operation!==op||intent.shard_index!==Number(shard))throw new Error('historical intent mismatch');
+const r=spawnSync(process.execPath,['--test','--test-reporter=tap','--test-concurrency=2',...intent.files],{
+ cwd:root,encoding:'utf8',windowsHide:true,shell:false,timeout:60000,maxBuffer:8*1024*1024,
+ env:Object.fromEntries(Object.entries(process.env).filter(([k])=>k!=='NODE_TEST_CONTEXT'))
+});
+const output=String(r.stdout??'');
+const lines=output.split(/\r?\n/);
+const failures=[];
+for(let i=0;i<lines.length;i++){
+ if(/^(?:not ok |# (?:error|failure)|✖ )/.test(lines[i]))failures.push(lines.slice(Math.max(0,i-1),Math.min(lines.length,i+28)).join('\n').slice(0,4200));
+}
+console.log(JSON.stringify({schema:'deadbyte.r67-diagnostic-replay.v1',role:'NON_RELEASE_TEST_DIAGNOSIS_ONLY',
+ from_historical_operation:op,shard:Number(shard),exit_code:r.status,child_error:r.error?.code??null,
+ failures:failures.slice(0,20),tail:output.slice(-1800),stderr:String(r.stderr??'').slice(-1000)},null,2));

package/scripts/r67-durable-batch.mjs

@@ -0,0 +1,42 @@
+import {readdir,mkdir,open,readFile,rename} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import {createHash} from 'node:crypto';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const evidence=path.resolve(root,'../../testing/0.15.44-r67/full-batches');
+const tests=(await readdir(path.join(root,'test'))).filter(n=>n.endsWith('.test.mjs')).sort();
+const size=27;
+const indexRaw=process.argv[2];
+if(!/^(?:0|[1-9]\d*)$/.test(indexRaw??''))throw new Error('batch index required');
+const index=Number(indexRaw);
+const total=Math.ceil(tests.length/size);
+if(!Number.isInteger(index)||index<0||index>=total)throw new Error('batch index out of range');
+await mkdir(evidence,{recursive:true});
+const attempt=process.argv[3]??'initial';
+if(!/^[a-zA-Z0-9_-]{1,24}$/.test(attempt))throw new Error('invalid attempt label');
+const suffix=attempt==='initial'?'':'-'+attempt;
+const file=path.join(evidence,'batch-'+String(index).padStart(2,'0')+suffix+'.json');
+const start=new Date().toISOString();
+const mode=process.argv[4]??'all';
+if(!['all','core','remote'].includes(mode)||(mode!=='all'&&index!==10))throw new Error('invalid batch split mode');
+const window=tests.slice(index*size,(index+1)*size);
+const selected=mode==='core'?window.filter(n=>n!=='remote-session-cli.test.mjs'):mode==='remote'?window.filter(n=>n==='remote-session-cli.test.mjs'):window;
+if(selected.length===0)throw new Error('batch split is empty');
+const sha=s=>createHash('sha256').update(s).digest('hex');
+const identity={schema:'deadbyte.r67-durable-test-batch.v1',batch_index:index,batch_count:total,total_test_files:tests.length,test_files:selected,split_mode:mode,candidate_root:root,started_at_utc:start};
+const staged=await open(file,'wx',0o600);
+try{await staged.writeFile(JSON.stringify({...identity,status:'RUNNING'})+'\n');await staged.sync();}finally{await staged.close();}
+const cmd=['--test','--test-concurrency=4',...selected.map(f=>'test/'+f)];
+const result=spawnSync(process.execPath,cmd,{cwd:root,shell:false,windowsHide:true,encoding:'utf8',timeout:mode==='remote'?180000:90000,maxBuffer:24*1024*1024});
+const output=String(result.stdout??''),error=String(result.stderr??'');
+const count=k=>{const matches=[...output.matchAll(new RegExp('(?:^|\n)[#ℹ ]*'+k+'\\s+(\\d+(?:\\.\\d+)?)','g'))];return matches.length?Number(matches[matches.length-1][1]):null;};
+const testsCount=count('tests'),pass=count('pass'),fail=count('fail'),skip=count('skipped');
+const status=result.status===0&&result.error===undefined&&testsCount!==null&&pass!==null&&fail===0?'PASS':(result.error?.code==='ETIMEDOUT'?'TIMED_OUT':'FAIL');
+const completed={...identity,status,finished_at_utc:new Date().toISOString(),exit_code:result.status,timed_out:result.error?.code==='ETIMEDOUT',observed_test_count:testsCount,passed:pass,failed:fail,skipped:skip,stdout_sha256:sha(Buffer.from(output)),stderr_sha256:sha(Buffer.from(error)),...(status==='PASS'?{}:{failure_tail:(output+'\n'+error).slice(-3500)})};
+const tmp=file+'.finished-'+process.pid;
+const handle=await open(tmp,'wx',0o600);
+try{await handle.writeFile(JSON.stringify(completed,null,2)+'\n');await handle.sync();}finally{await handle.close();}
+await rename(tmp,file);
+console.log(JSON.stringify({batch_index:index,batch_count:total,test_files:selected.length,status,passed:pass,failed:fail,skipped:skip,exit_code:result.status,evidence_path:file},null,2));
+if(status!=='PASS')process.exitCode=1;

package/scripts/r67-focused-gate.mjs

@@ -0,0 +1,58 @@
+import {createHash} from 'node:crypto';
+import {readFile,lstat} from 'node:fs/promises';
+import {spawnSync} from 'node:child_process';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {parseR67TapSummary} from '../src/r67-regression-shards.mjs';
+const root=path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const hash=b=>createHash('sha256').update(b).digest('hex');
+const manifest=JSON.parse(await readFile(path.join(root,'docs','R67-NATIVE-INSPECT-BINARY.json'),'utf8'));
+const binary=path.join(root,manifest.exe);
+const info=await lstat(binary);
+if(manifest.schema!=='deadbyte.r67-native-inspector-binary.v1'||!info.isFile()||info.isSymbolicLink()||hash(await readFile(binary))!==manifest.sha256)throw new Error('R67 native observer hash pin invalid');
+const specs=[
+ 'test/r67-native-inspector.test.mjs',
+ 'test/r67-signed-receipt.test.mjs',
+ 'test/r67-cli-integration.test.mjs',
+ 'test/r67-diagnostics.test.mjs',
+ 'test/r67-diagnostics-cli.test.mjs',
+ 'test/r67-diagnostics-zip-oracle.test.mjs',
+ 'test/r67-diagnostics-verify.test.mjs',
+ 'test/r67-regression-shards.test.mjs',
+ 'test/r67-evidence-reconcile.test.mjs',
+ 'test/r67-skip-rationale.test.mjs',
+ 'test/r67-runtime-observation-binding.test.mjs',
+ 'test/r67-native-observation-authority.test.mjs',
+ 'test/r67-server-observation-wiring.test.mjs',
+ 'test/r67-machine-fs-smoke-epoch.test.mjs',
+ 'test/r67-isolated-slot-rollback-restore.test.mjs',
+ 'test/r65-epoch-native-activation-integration.test.mjs',
+ 'test/machine-identity.test.mjs',
+ 'test/r67-tool-annotations.test.mjs',
+ 'test/remote-live-log-r36.test.mjs',
+ 'test/remote-live-log-r37.test.mjs',
+ 'test/r67-live-log-secret-canary.test.mjs',
+ 'test/r51-live-log-polling.test.mjs',
+ 'test/cli-entrypoint.test.mjs',
+ 'test/observation-runtime.test.mjs',
+ 'test/observation-mcp-tools.test.mjs',
+ 'test/windows-observation-r48.test.mjs',
+ 'test/r67-release-contract.test.mjs',
+ 'test/r67-npm-cross-volume.test.mjs',
+ 'test/r67-npm-publish-gate.test.mjs',
+ 'test/r65-npm-publication.test.mjs'
+];
+const args=['--test','--test-concurrency=1',...specs];
+const result=spawnSync(process.execPath,args,{cwd:root,encoding:'utf8',windowsHide:true,shell:false,timeout:180000,maxBuffer:16*1024*1024});
+const stdout=String(result.stdout??'');
+const stderr=String(result.stderr??'');
+const tap=parseR67TapSummary(stdout);
+const counts=tap?{tests:tap.tests,pass:tap.pass,fail:tap.fail,skipped:tap.skipped,cancelled:tap.cancelled,todo:tap.todo}:null;
+const complete=Boolean(tap&&tap.tests>=specs.length&&tap.fail===0&&tap.skipped===0&&tap.cancelled===0&&tap.todo===0&&result.status===0&&!result.error);
+const receipt={schema:'deadbyte.r67-focused-gate.v1',status:complete?'pass':'fail',
+ candidate_version:'0.15.44-draft',predecessor_manifest_sha256:'4c4a64a4c8e9f5a6e9eecce85fd0007ebcac99121b29c07f1a1fc81d1643cd33',
+ native_exe_sha256:manifest.sha256,tests:specs,summary:counts,exit_code:result.status,timed_out:result.error?.code==='ETIMEDOUT',
+ stdout_sha256:hash(Buffer.from(stdout,'utf8')),stderr_sha256:hash(Buffer.from(stderr,'utf8'))};
+console.log(JSON.stringify(receipt,null,2));
+if(result.status!==0){console.error('TEST_OUTPUT_TAIL\n'+stdout.slice(-15000));console.error('TEST_ERROR_TAIL\n'+stderr.slice(-4000));}
+if(!complete)process.exitCode=1;